Certificate and unlocking

Every document for UJP is signed on your computer, with your qualified certificate. The private key never leaves the file, the token or Keychain.

Choosing a source

In Settings, in the Signing certificate section, there are three cards, one per source. Click the one where your certificate is kept.

.p12 / .pfx file

1. Press Choose… and find the file.
2. Press Save settings.

USB token / smart card (PKCS#11)

1. Plug in the token.
2. In Module, enter the path to the token’s PKCS#11 library. For OpenSC on a Mac this is usually /opt/homebrew/lib/opensc-pkcs11.so, on Linux /usr/lib/opensc-pkcs11.so, on Windows C:\Windows\System32\opensc-pkcs11.dll. For other tokens, the manufacturer provides the path.
3. Press Find certificates. A table with the certificates on the token appears.
4. Click the row with your certificate. Below the table, the app shows which slot and key are selected.
5. Press Save settings.

macOS Keychain

1. Press Find certificates.
2. Click your certificate. Its SHA-256 fingerprint appears below the table.
3. Press Save settings.

The app doesn’t remember your selection from the table until you press Save settings.

Unlock and Lock

Unlock opens the certificate with your PIN or password. The PIN stays in memory only while the app is open, so you need to unlock again each time you open the app.

The app asks for the PIN by itself: at startup, if a certificate is selected, and whenever something needs a signature (sending, the UJP lists) while the certificate is locked. Later lets you continue without unlocking. You can also open the window yourself by clicking Certificate at the bottom left of the menu, or with Unlock… in Settings → Certificate status. macOS Keychain has no PIN; macOS may ask for permission.

After unlocking, Settings → Certificate status shows the subject, issuer, validity period, whether the certificate is valid today, the RSA key size, and the EDB written in the certificate, if it has one.

Lock (in the same window or in Settings) clears the unlocked certificate from memory. Use it when you leave your computer.

Test signature and UJP clock

Test signature signs a test message and verifies the signature immediately. Nothing is sent to UJP.

UJP clock is always shown at the bottom of the left menu. It shows the exact UJP time in Skopje time, ticking every second, for example Time 14:03:22 +142s. The number at the end is the difference from your computer; it’s hidden when there is none. Every 30 seconds the app checks the difference with UJP, and the button on the right checks it at once. Before each signature, if the last check is older than 30 seconds, the difference is checked again, so requests always carry UJP’s time. “Today” and “last N days” in date fields are also based on UJP time in Skopje, not on your computer’s clock and time zone. If the time and difference turn orange, the difference is 5 minutes or more; a dash instead of the time means UJP isn’t responding. In that case, set your computer’s clock or check your connection.

What works without a certificate

Taxpayers, Code lists and the exchange rate list work even when the certificate is locked. Document lists, status changes and sending need an unlocked certificate.