CSR enrollment

Upload or paste a PKCS#10 CSR, declare the user, and download the signed certificate. Inspect either the CSR or the issued certificate (subject, key, and the Pontes privilege attribute).

1 · Certificate Signing Request

Upload a .csr / .pem file …or paste the CSR (PEM)

2 · User declaration

NCB / ORG (realm)

Username (= CSR Common Name)

Password

Entity BIC (MSPID)

Profile

3 · Issued certificate

PEM

4 · Download as PKCS#12 (.p12)

Bundle the issued certificate with your private key for import into Keychain / a browser. ⚠️ Your private key is sent to this local mock only to assemble the bundle (never stored). For real keys, prefer the command line below.

Private key (PEM) — upload or paste Export password

5 · Create & install from the command line

Recommended for real keys — the private key never leaves your machine.

Create the .p12 (you'll be prompted for an export password)

openssl pkcs12 -export \
  -inkey <your_private_key>.pem \
  -in    <your_cert>.pem \
  -name  "PFRBSUIFRPPXXX0001" \
  -out   PFRBSUIFRPPXXX0001.p12

Install — macOS Keychain (Safari / Chrome / Edge)

security import PFRBSUIFRPPXXX0001.p12 -k ~/Library/Keychains/login.keychain-db
# verify:
security find-identity -v ~/Library/Keychains/login.keychain-db | grep PFRBSUIFRPPXXX0001

Install — Firefox (separate certificate store)

Settings → Privacy & Security → Certificates → View Certificates
  → Your Certificates → Import… → select the .p12

Use directly for CLI / app mTLS (no install)

curl --cert <your_cert>.pem --key <your_private_key>.pem \
     -k https://localhost:3001/check/mtls