Free tool
ELIF Certificate Tool: keys and certificates without OpenSSL
Make private keys and CSRs for any certificate authority, read and convert certificate files, sign and encrypt, on this page or in a free app for Windows, Mac and Linux. Made for MoR e-invoicing, Fayda, Telebirr and bank integrations in Ethiopia, and useful for any certificate anywhere. Your keys stay on your computer.
In plain words
- Private key: your secret. It signs for you. Whoever holds it can act as you, so it is never sent to anyone.
- Public key: the matching part that anyone may see. It checks what the private key signed.
- CSR: a request for a certificate. It holds your details and your public key, never the private key. This is what you give the authority.
- Certificate: what the authority sends back. It says that this public key belongs to you, until a stated date.
- Certificate authority (CA): the body that issues certificates. For MoR e-invoicing, that is INSA.
- Chain: your certificate together with the certificates of those who issued it.
- File formats: PEM is text, DER is the same thing in binary, Base64 is a way to write binary as text. PFX (or P12) holds a key and certificates under one password. P7B holds certificates only. JWK is a key written as JSON.
MoR e-invoicing, step by step
- Enter your organisation name, TIN, system number and e-mail, then generate.
- Download the private key and keep it safe. It exists nowhere else.
- Download the CSR and e-mail it with the Certificate Request Form to INSA (ica@insa.gov.et).
- When the certificate arrives, choose it in step 3 and copy its Base64.
- For a renewal, choose Use my existing key, so your systems keep the same key.
- Wherever your e-invoicing system runs, on your own server, with a hosting company or as an agent on your computer, the key file goes only where that system keeps it, under your control.
Fayda, the national ID
- The guide uses private_key_jwt with RS256. There is no client secret; your system signs with an RSA private key.
- Test client: generate a new RSA 2048 key here and register the public JWK.
- Production: use the private key of your partner certificate. The tool can check that the two match, because a different key gets invalid_client.
- Copy the one-line Base64 value into your server's PRIVATE_KEY setting. Keep it out of your code and out of e-mail.
For organisations connecting a system to Fayda through eSignet. It follows the VeriFayda 2.0 integration guide published by a member of the Fayda programme, so confirm the details with the Fayda team before you rely on them. This tool does not read ID cards and does not hold anyone's ID details.
Telebirr and banks
- Telebirr: open-source integrations describe an RSA key pair. You give Telebirr your public key, often as one line of Base64 with no header lines, and sign with your private key. Some of them sign with RSA-PSS and some with PKCS#1, so follow the Telebirr developer portal.
- Banks and payment switches: each sets its own rules. Ask the integration team which key type and size to use, what the CSR's fields must say and how to send it.
- Whichever provider it is, the private key stays with you. Only the CSR or the public key goes to them.
These integrations use a key pair or a CSR you prepare yourself. This tool does not follow an official Telebirr or bank document, so check the details with the provider.
Other authorities and websites
Choose Website or Other authority, fill in what your authority asks for, and generate. Each authority sets its own rules for key type, key size and how to apply, and many take the CSR through a form on their website rather than by e-mail, so follow their instructions. Other Ethiopian services, such as teleSign, have their own procedures. If yours takes e-mail, the tool prepares the message with the CSR attached, and the desktop app can send it through your own mail server.
Which OpenSSL command is where
- openssl genpkey, genrsa, ecparam: Key and CSR
- openssl req -new: Key and CSR
- openssl req -x509, openssl x509 -req -CA: Own certificates
- openssl x509 -text, req -text, verify: Read a file
- openssl pkcs12, pkcs8, pkey, rsa, x509 -outform, crl2pkcs7, certutil -encode: Convert
- openssl dgst, dgst -sign, dgst -verify, enc, rand: Sign and encrypt
- openssl s_client: Check a server (desktop app)
What it does not do
- It does not issue trusted certificates: only an authority can. What you sign yourself is for your own systems and for testing.
- No command line or scripts: for automation on a server, OpenSSL remains the tool.
- No USB tokens or smart cards: the key has to be a file.
- No S/MIME, CMS, CRL or OCSP, no secp256k1 curve, and no MD5.
- Old OpenSSL password-protected PEM keys (with a Proc-Type line) cannot be opened. Keys in the current PKCS#8 form can.
Keep your private key safe
Whoever holds this key can sign invoices in your name. Use a computer you trust, keep a backup in a safe place, never send the key by e-mail or chat, and use one key for each system number.
Does my private key go to ELIF?
No. Your browser makes the key with its own built-in cryptography, and this page never sends it anywhere. To check, load the page, disconnect from the internet and generate: it still works.
Can I use this instead of OpenSSL?
Yes. MoR's certificate guide uses OpenSSL commands as its example and says other tools can be used. This page makes the same 3024-bit RSA key in the same standard format, and a CSR with the fields the guide asks for.
What do I send to INSA?
Only the CSR file and the completed Certificate Request Form, by e-mail to ica@insa.gov.et. Never send the private key.
Why does it warn that one certificate is not enough?
MoR's signed gateway refuses a certificate on its own with error 67012. It needs the whole chain INSA supplies: your certificate and the certificates that issued it.
Does it work with ETEIMS and with other systems?
Yes, the files are standard. On a server you run yourself, load the key and certificate into your system. On a system hosted by ELIF, your key can stay with you on your own machine with the signing agent, which can also make its own key. Uploading it to a hosted system means handing it over, so that needs your recorded consent.
Can I use my Fayda number or ID card here?
No, and you do not need to. This tool is for organisations that connect their own systems to Fayda. It makes and converts their keys. It never asks for an ID number, a card or a fingerprint.
How can the tool send my CSR?
On this page it prepares an e-mail draft with the CSR attached, which opens in your mail program. The desktop app can send it itself: enter your mail server's details once. The e-mail goes from your account through your server, never through ELIF, and your password is not saved. Any attachment holding a private key is refused.
Why does Windows or Mac warn about the app?
The app does not yet carry a code-signing certificate, so your system does not recognise the publisher. To be sure of your copy, compare its SHA-256 with the published list, using the Hash tool on this page.
What does the desktop app send out?
Only what you ask it to: your e-mail through your mail server, and a connection to a server you ask it to check. It has no tracking and no update check, and your keys never leave the page. The address it runs on can only be reached from your own computer.
Does Telebirr need a CSR?
Open-source integrations describe a key pair, with your public key given to Telebirr, rather than a CSR. The tool makes both, so you are ready either way. Confirm in the Telebirr developer portal.