Certificates for the production environment

Starting with the ApitamoPKI interface

First make a subscription for a certificate. After you have done that, your organisation can start using the ApitamoPKI. 

However, if the user organisation’s software application already contains a Web Service certificate, issued to data providers by the Incomes Register, there is no need for a new certificate. ApitamoPKI can be access with the certificate you already have.

To apply for a certificate for the production environment:

The application must be made in the Incomes Register’s e-service.

• Log in and select the company applying for a certificate (a production certificate can be requested only by a person authorised to sign for the company).
• On the company’s pages, select: Settings > Technical interface
• Check that the purpose of use of the interface indicated at Valid rights is “Earnings payment data, organisation reports the wages it has paid and Earnings payment data, organisation reports wages on behalf of another party”, and that the channel selection is “Earnings payment data – Web Service”. Other rights may also be selected.
  • If the purpose of use is not reporting earnings payment data and the channel selection is not Web Service, then you must submit a replacement application. Select Make a replacement application.
  • In the replacement application, tick the following options in addition to any other options already selected: at purpose of use of the interface, tick “Earnings payment data, organisation reports the wages it has paid and Earnings payment data, organisation reports wages on behalf of another party”, and at channel, tick “Earnings payment data – Web Service”. The replacement application replaces all previous selections, so make sure the application contains all the purposes of use and all the channels that the company needs.
• When your right to access the interface has been verified, make the certificate application: Certificates > Apply for a new certificate
• Select “Earnings payment data – Web Service” as the type of production certificate
• Production certificate users must accept and follow the terms and conditions of use for the Tax Administration’s and the Incomes Register’s interface services (available in pdf format in Finnish and Swedish, link to Finnish)
• You must specify a technical contact person in the certificate application. The technical contact person retrieves the certificate from the certificate service interface.
• Send the application by clicking Submit. The system immediately starts processing your request.
• The technical contact person will be sent instructions for retriving the certificate by secure e-mail. They will receive a text message on their mobile phone containing a PIN for opening the secure e-mail message. The PIN will be sent after the contact person has clicked the “Open message” link on the secure e-mail message they received when they applied for the certificate. The certificate must be retrieved from the certificate service interface within 14 days after you submitted the application.
• after successful retrieval, you (as the IT developer of the interface) are the party that must feed the certificate into the software program. If the certificate is not there, the interface will not return the requested answer files or other data to the user organisation.

For more information on the certificate service, visit the pages of the Incomes Register:
Certificate service
Questions and answers about certificates

You can watch the following videoclip about the Incomes Register:
Näin käytät tulorekisteriä - Hae uutta varmennetta (only in finnish) 

Notes for IT developers:

• The organisation that wants to have a certificate subscription must have an agreement on the provision of services with their customer within the meaning of the terms and conditions of interface services. You may have a software program designed for accounting firms or other third-party providers of services to taxpayers. If the users of your software are usually not taxpayers or filers, the users must submit applications for certificates.
• After retrieval of a certificate, the commercial software vendor must give sufficient guidance to their customers, the user organisations, on how certificates must be handled when the software program is being used.
• The user organisation’s certificate must be fed into the software program because it replaces the user organisation’s electronic signature.
• The Tax Administration recommends that software programs are encoded so as to support certificate-based authentication and production certificates.

Go back to the ApitamoPKI page