TPP Assurance

Certificate Continuity

During the transition the Bank must be able to validate legitimate certificates chaining to either the existing Entrust trust infrastructure or the new Keyfactor trust infrastructure.

Entrust certificates137
Keyfactor certificates35
Expiring / expired2
Validation failures1
Certificate migration risks3

Bank trust capability

Both chains must validate during the transition window

  • Entrust chainTRUSTED
  • Keyfactor chainTRUSTED
  • Dual trust (edge)PASS
  • Dual trust (all in-scope trust stores)ACTION REQUIRED
  • 4096-bit RSA compatibilityPASS

12 PKI-dependent systems do not yet trust the Keyfactor chain. Open PKI / Dual Trust

Entrust trust path

137 existing TPP certificates

  1. TPP Certificate
    Entrust
  2. Issuing CA
    OpenBanking Issuing CA
  3. Root CA
    OpenBanking Root CA
  4. Bank Trust Store
    Chain present
  5. TRUSTED ✓
    Path builds and validates

Keyfactor trust path

35 existing TPP certificates

  1. TPP Certificate
    Keyfactor
  2. Issuing CA
    Open Banking Limited Issuing CA G3
  3. Root CA
    Open Banking Limited Root CA G3
  4. Bank Trust Store
    Chain present
  5. TRUSTED ✓
    Path builds and validates

Certificate migration risk

TPPs whose certificate trust may not survive migration unchanged

  • MEDIUMArclight Track LtdKeyfactor · expires 18 Mar 2027EXPIRINGTPP

    Certificate expires within the migration window. Renewal is a normal TPP lifecycle action, not a Directory migration defect.

  • CRITICALFinPayments LtdKeyfactor · expires 13 Aug 2026VALIDATION FAILEDBANK

    Current certificate chains to Keyfactor but the affected Bank trust store contains the Entrust chain only. The TPP certificate will not be trusted by this Bank component. Add the required Keyfactor trust chain and execute certificate validation tests.

    Affected system: Open Banking API Gateway

  • HIGHCredaScore Analytics LtdEntrust · expires 11 Oct 2026EXPIREDTPP

    Certificate expired. Existing Bank registration remains present; this is a TPP certificate lifecycle event, not a Directory migration defect.