This article is valid for Smart ID Identity Manager 24.R1 or later.
IDM 24.R1 makes a number of significant changes compared to earlier releases!
Please review this document and its related pages carefully before proceeding with a fresh installation or upgrade.
TODO: Write some high level description of the engine here
This article describes the sign and encrypt engine in Smart ID Identity Manager. There are a number of use cases in Identity Manager that are based on encryption or signing, for example:
Encrypt and decrypt fields in the Identity Manager database
Sign and verify object history
Sign and validate config zip files
Encrypt config zip files
Sign and encrypt emails
Create device encryption certificates used in certain Hermod scenarios
Authenticate Smart ID Self-Service users to the Identity Manager backend
Creating JWS signatures used for Hermod's content provider API
Decrypting PIN blobs from pre-personalized smart-cards created with Personal Desktop Client
Attestation for provisioning to Smart ID Mobile / Desktop Apps
The sign and encrypt engine provides a consistent configuration of keys and certificates for both signing and encryption. You can define algorithms and parameters and reference keys from an HSM (for most use-cases) or from PKCS#12 files (always supported).