J.P. Morgan Host-to-Host Partner Key Management Overview

• You are able to perform your renewal online via Host-to-Host on J.P. Morgan Access
• Digital Signature or Token approval is required for this option
• Self-activate your renewal key when you are ready to use it
• Enrollment is required. If you do not have the necessary entitlements, please contact your service representative

1. Login into J.P. Morgan ACCESS

a. You must have the Key Management entitlement for the applicable Host-to-Host Partner ID
b. These entitlements are managed by your company’s J.P. Morgan ACCESS Security Administrator.

1. Click on Administration and select Key Management
2. Identify the key to be renewed on the applicable Partner ID and click the Upload button

1. Select either the Certificate or Token box or both for digital signature.

a. If Certificate is used, the key file must be Ascii Armor signed with your current PGP key

1. Click the Browse button and select the applicable replacement key file and click Upload

a. Filenames must not contain spaces or special characters

b. SSH and PGP key filenames must have a .txt extension

c. SSL certificates must be in p7b format and extension

2. A second user with Activate entitlements should then Activate when you are ready to begin using the new key.
3. If you are activating a PGP key, please wait 30 minutes before using the new key after it has been activated.

The use of Rapid Renewal is a secure submission process in which you use your existing credentials to submit new certificates.

• You must be able to send a digitally signed inbound file to us.
• You must submit new certificates prior to their existing credentials expiration.

Benefits include:

• The elimination of documentation requirements such as the signed hardcopy and SADF validation
• A more effective method that improves SLAs, and lowers rejection rates

Rapid Renewal Process

1. Digitally sign your new key with your current active PGP key or X.509 certificate. 
2. Transmit the new key as you would normally send files to J.P. Morgan, using the following naming conventions:

<Partner ID>.TRANSPORT.IN.DAT (for SSH or SSL)
<Partner ID>.PAYLOAD.IN.DAT (for PGP or x.509)

3. Once the file is received, the digital signature will be validated, and the key will be inspected to ensure it meets acceptable criteria.
4. An email will be sent to confirm success or failure of the validation process.

a. The email will be sent to the contacts of record in Host-to-Host.
b. Please contact your J.P. Morgan Service representative to update these contacts.

5. If the key meets minimum requirements:
   An SSH key will be installed with a 2-year expiration.  You may begin using it immediately.
   An SSL, x509 or PGP key will be staged for activation. 
6. SSL, x509 or PGP Only: After you receive the email indicating successful staging, transmit an activation file that is digitally signed with your current active PGP key or x509 certificate.

a. The activation filename must be: <Partner ID>.ACTIVATE.IN.DAT.
b. The content of the activation file is structured XML, as shown below.
c. After the activation file has been successfully processed, you will receive an email, and your SSL, x509 or PGP key will be live. 
d. The previous SSL, x509 or PGP key can no longer be used.

Activation File Contents

<?xml version="1.0"?>
<activateRapidRenewalKeyDetails>

<!—Replace ‘XXXXXX’ with your Partner ID. -->
<partnerID>XXXXXX</partnerID>

<!—Replace XXX with either PGP or SSL. -->
<keyType>PGP</keyType>

<!—Replace XXXX with either TRANSPORT or PAYLOAD. -->
<keyUsage>XXXX</keyUsage>

<!—For PGP the serialNumber is the last eight characters of the fingerprint, also called the short KeyID, of the PGP key to replace the ‘Ox1A2B3C4D’ string below.   Add '0x' at the start of the serial number if it is missing. -->

<!-- For SSL the serialNumber is the complete serial number of the new certificate to replace Ox1A2B3C4D in the string below.-->

<serialNumber>0x1A2B3C4D</serialNumber>

</activateRapidRenewalKeyDetails>

If you do not meet the criteria for Rapid Renewal, the email submission process must be used as described below. The J.P. Morgan Security Services (IMSD) group will action only those requests received from authorized individuals listed as Security Administrators using the Security Administration Designation Form (SADF). Using the SADF, you will identify the individuals with their names, mailing addresses, signatures, phone numbers and email addresses. IMSD cannot disclose security administrator or SADF information, so please contact your J.P. Morgan client service representative for further assistance with this requirement.

Email Submission Process (Requires two Security Administrators)
IMSD has a 5-business day SLA for PKM request review; please account for this when submitting requests.

Requests are actioned Monday through Friday, 8:00 a.m. to 1:00 a.m. Eastern Time.

1. A Security Administrator should draft an email with your Host-to-Host Partner ID and Keyword "Renewal" in the subject line. In the body of the email, include a description of the action to be taken, the requested date and time the action is to be taken, and an attached zipped text file containing the key/certificate(s).
2. The Security Administrator should then send the email to IMSD at the email address below and copy an additional Security Administrator(s) listed on the SADF.
3. The additional Security Administrator must then ‘reply all’ to the email and approve the submission.
4. Upon receipt of the approval email, IMSD will confirm that both Security Administrator names and email addresses match the current SADF, and that the keys and/or certificates meet minimum requirements for strength and expiration.

a. If the key/certificate is approved, IMSD will forward the approved keys for installation.

i. You will then be informed of receipt of the key file via email and the scheduled date and time for the action to take place will be confirmed or requested.

b. If the key is not approved, IMSD will notify you directly via email to indicate the rejection reason(s) and provide steps to remediate the issue, copying the associated service representatives for awareness.

J.P. Morgan
IMSD Security Operations: Key Management
Fax: 813-649-8367
Email: IMSD.Security.Operations@jpmorgan.com