Table of Contents

Order and renew the Swissdec company certificate with SUA

The SUA company certificate authenticates bidirectional Swissdec processes. SwissSalary runs registration, result retrieval, signing, certificate creation, and renewal through the same action. The current Status determines the next step. Order the certificate before you use EPO and KLE productively (it isn't currently required for payroll declarations yet), and renew it in good time before it expires.

Prerequisites

  • The UID-BFS-No. is maintained in Payroll Setup.
  • The Swissdec Setup is open and the Live environment is chosen.
  • KLE Setup section: the number series for KLE is set up.
  • SUA Setup section: Contact Person, SUA Contract Domain, and SUA Contract Code are known.

Procedure

  1. Open Swissdec Setup.

  2. In the KLE Setup area, check the following:

    Field Description
    No. Series KLE The number series for KLE is created and set up.

  3. In the SUA Setup area, check the following:

    Field Description
    Version SUA protocol version in use.
    Certificate Live for productive operation or Test for the Swissdec test environment.
    Status Current step in the certificate life cycle. The field is read-only.
    URL Distributor Endpoint for registration and certificate requests.
    URL Distributor Renew Endpoint for renewal.
    Contact Person Contact responsible for Swissdec and certificate management. The contact entered here is named in the password letter. At least the name and email address must be maintained on the contact card.
    SUA Contract Domain Insurance domain for which the certificate is requested. UVG, UVGZ, KTG, and BVG are allowed.
    SUA Contract Code Insurance contract that identifies the company.

  4. Check the UID-BFS-No. in Payroll Setup.

  5. If the default endpoints are unchanged, choose Restore Default Values.

  6. If necessary, test Check Connectivity (Ping) and Check Interoperability.

Warnung

If you switch between Live and Test, SwissSalary resets the SUA process and can delete the existing certificate after confirmation. Don't switch the environment during a running productive process.

Order the certificate

  1. In Swissdec Setup, choose SUA > Order SUA Certificate.
  2. SwissSalary confirms that the process was successful with the message "The new certificate doesn't have a password yet. It will be sent to you by post."
  3. When you receive the letter from Swissdec, enter the password in Swissdec Setup via General > Certificates.

Process the password and the signature

After you receive the letter from Swissdec with the password, proceed as follows:

  1. In Swissdec Setup, open the Certificates list via General to check the SUA certificate entry. Among other information, the page shows Code, Description, Company Name, Password, Revoke Password, and whether the certificate file is available.
  2. Select the SUA certificate entry of the company you're currently working in.
  3. Enter the password in the Password field exactly in the format you received.
  4. Leave the field.

As of update 5068, SwissSalary validates the password and continues a waiting signing process. The expected format of the SUA one-time password is XXXX-XXXX-XXXX-XXXX.

After successful signing, SwissSalary stores the signed PEM certificate, the renewal period, and the revocation password, if you've also entered it. SwissSalary then creates the usable PKCS#12 certificate file.

Hinweis

If you use a SwissSalary version lower than 5068, you must validate the password manually by choosing Order SUA Certificate again via SUA in Swissdec Setup.

You can check the status of the certificate in the Status field:

Status Next processing step
Register Organization Send the registration data to Swissdec.
Waiting for Result Retrieve the result of the organization registration.
Create PKCS#10 Certificate Create the certificate request and the key pair.
Sign Certificate Send the signing request.
Create PKCS#12 Certificate Combine the signed certificate and the private key into a usable certificate.
Renew Certificate Renew the existing certificate within the permitted period.

If Swissdec returns an expected availability, wait until that time before you retrieve the result again.

Wichtig

Treat the password, private key, exported certificate file, and revocation password as confidential data. Don't store this data in unprotected documents or tickets.

Monitor the certificate status

SwissSalary shows notifications for the following situations:

  • No SUA certificate is available.
  • The certificate is valid.
  • The certificate must be renewed within the next six weeks.
  • The certificate expires in less than six weeks and can't be renewed again.

For a normal renewal, choose Order SUA Certificate in the notification or in Swissdec Setup.

SwissSalary prevents the following:

  • a renewal before Renew from;
  • a renewal after Renew to;
  • a renewal without a stored certificate password.

If the end of the renewal period is at least three years after its start, the notification requests a new certificate instead of another renewal.

Check the completion

  1. Open Certificates.
  2. Check that Certificate is available.
  3. If necessary, show Renew from and Renew to.
  4. Return to Swissdec Setup.
  5. Check the Renew Certificate status.
  6. Run a connection test for the intended Swissdec process.

The message that a valid SUA certificate is available confirms technical availability. Always also check the correct live or test environment and the assigned contract.

Good to know

  • Switching between Live and Test deletes the existing certificate.
  • Running Order SUA Certificate before the next status is ready—the action fails or retrieves nothing.
  • Not entering the SUA password in the XXXX-XXXX-XXXX-XXXX format, or not leaving the field—the signing doesn't continue.
  • Starting the renewal before Renew from, after Renew to, or without a stored password—it isn't possible.
  • Treat the password, private key, exported file, and revocation password confidentially.

See also