Auth Codes

When CoCCA or a registrar creates or edits an domain or contact authorisation code, the code is one-way hashed and only the hash is stored in the database.

The only option for a TLD manager or a registrar to know the code - if they dont have a record of it, is to re-set the authcode.

Authorization codes can only be re-set in the web portal or via EPP by the TLD manager or the controlling registrar.

When requesting the current authcode over EPP CoCCA will return the hash value, not the actual authorisation code.

If a registrar does not know the existing code and needs to provide one to a registrant to enable a transfer, the recomended process would be to re-set the authorisation code to a known value and provide that to the registrant.

Authcodes have a validity period equal to the transfer time-out configured by the TLD manager for the zone the domain is in. An attemept to transfer using an expired authcode will fail.

Registars can check if an authcode is valid prior to initiating a transfer using the REST API on the RDAP server. Prior to doing this the registrar must 1.) Generate their API Token in the CoCCA portal, and 2.) Add the IP they will query from to their trusted EPP/API IPs.

Example:

curl --location 'https://lab03-rdap.coccaregistry.org/domain/nic.cx/attributes?authToken=123456Abc890' --header 'Authorization: Bearer 7ad326a4-23af-4cd3-ae0f-8e6f80cfd36f'

PEM Client Certs

Extract private key and cert from pfx:

Extract private key
openssl pkcs12 -in CoCCA.pfx -nocerts -out CoCCA_key.pem -legacy

Extract certificate
openssl pkcs12 -in CoCCA.pfx -clcerts -nokeys -out CoCCA_client_cert.pem -legacy

The above command will ask for password, and the password is changeit