NHS Public Key Infrastructure - G2 Certificate Technical Implementation

First generation (G1) certificates are expiring in 2024.

All certificates should be updated to the second generation (G2) certificates by 2 May 2024 to avoid any loss of service.

NHS England will be making changes to our internal services week commencing 6 May 2024, where spine and associated services will only be accepting and issuing on the G2 certificates. If you have not made the required changes, you will lose service.

Information about how to do this is available below.

If your system functions exclusively as a client, such as Message Exchange for Social Care and Health (MESH) and the Demographics Batch Service (DBS), the update of certificates issued by the certificate authority (CA) will need to be renewed by 31 December 2023. 

This deadline is to avoid large numbers of renewals when outgoing certificates expire, potentially leading to impacts on services.

There are very few instances in which a system may function purely as a server without the use of mutual Transport Layer Security (TLS). 

If you feel your system falls into this category, please email [email protected] to discuss.

Many end points (such as synchronous and asynchronous Spine-connected systems) act as both a client and a server depending upon the business operation. These need to support mutual TLS for the new G2 certificate in the same way they support it for current NHS PKI.

In addition to presenting a G2 certificate to clients, they must also accept G2 certificates from other clients.

Some implementations may be based around a common trust store. However, others may have separate trust stores depending upon whether they are the client or the server in any given transaction.

In the server context, an example implementation might involve installing the G2 root and subordinate CA certificates to the computer accounts Trusted Root and Intermediate CA stores respectively.

When a server requests a client certificate to complete the mutual TLS handshake, it will need to specify that it accepts certificates issued by both the outgoing NHS Level 1C authority, and the new NHS Authentication G2 authority.

Certificate Authority certificates

The required Certificate Authority (CA) certificates (.crt format) can be downloaded from the following locations:

• NHS Root Authority G2 (Trusted Root)
• NHS Authentication G2 (Intermediate/Subordinate)
• NHS Signing G2 (Intermediate/Subordinate – only required for dispensing systems but included for completeness

If you have questions regarding any of the above, please email [email protected]. If your question relates to a specific system, please include your organisation’s nhsidcode, software version and system supplier details where possible.

Additional certificate formats

The links above provide the new G2 certificates as a .crt binary file commonly referred to as DER format. To assist users, we provide the same certificates in Base-64 encoded X.509 ASCII commonly referred to as PEM format below.

• NHS Root Authority G2 (Trusted Root)
• NHS Authentication G2 (Intermediate/Subordinate)
• NHS Signing G2 (Intermediate/Subordinate)

Certificates for testing

The following links provide the new G2 certificates (.crt format) for the NHS Path to Live Environment (PTL), which suppliers are encouraged to use to test their deployment process.

• NHS INT Root Authority G2 (Trusted Root)
• NHS INT Authentication G2 (Intermediate/Subordinate)
• NHS INT Signing G2 (Intermediate/Subordinate)

For further advice, please email [email protected].