Runtime extension
The extended validity extension allows the certificates of dual-personalized connectors to be extended as follows, depending on the production date of the gSMC-Ks:
- gSMC-K's produced in 2020: extension until 31.12.2027
- gSMC-K's produced in 2021: extension until 31.12.2028
- gSMC-K's produced in 2022: extension until 30.11.2029.
The requirement for the extended runtime extension is a dual-personalized connector with at least firmware 5.50.4, in which the runtime extension feature is/was activated via a license. You can purchase the license to activate the feature from your contractual partner.
According to gematik's current plan, the certificates for the extended runtime extension for dual-personalized connectors will be available from 04.04.2025*, so that they can be downloaded as part of the extended runtime extension**.
* The terms of the certificates of the first dual-personalized connectors expire in August 2025. These connectors will start searching for extended certificates at the PU download point from 26.02.2025, depending on whether a license for an LZV has been imported. Until gematik provides the extended certificates from 04.04.2025, these connectors will search for certificate packages at the corresponding download points on a daily basis until they are available. This will not affect the ongoing operation of the connectors and there is no risk of the certificates expiring.
** The certificate packages for dual-personalized connectors already at the download points for the previous lifetime extension (LZV) until the end of 2025 will be replaced by new ones.
- According to gematik's current plan, the old certificate extension packages are to be deleted from the PU at the download point on 20.02.2025.
- From 04.04.2025, new certificate renewal packages for gSMC-Ks produced in 2020 will be available at the download point in the PU for dual-personalized connectors.
- From 11.04.2025, new certificate renewal packages for gSMC-Ks produced in 2021/2022 will be available at the download point in the PU for dual-personalized connectors.
Previous runtime extension until the end of 2025
Dual-personalized connectors:
The previous term extension (LZV) until 31.12.2025 for dual-personalized secunet konnektor will be replaced by the eLZV. Licenses that have already been purchased for the LZV for dual-personalized connectors will continue to apply and thus also automatically for the eLZV. It is not necessary to purchase and install another license.
RSA-only connectors:
The previous LZV until 31.12.2025 can still be used for RSA-Only secunet connectors. The previous LZV makes it possible to extend RSA-only connectors until 31.12.2025 at the latest, so that the connection to the TI is guaranteed until then. The requirements are that at least version 5.50.4 is installed as firmware and that the license intended for the LZV has been purchased and installed.
Explanatory notes
Dual-personalized connectors
What are dual-personalized connectors?
Dual-personalized connectors are connectors whose gSMC-K (device-specific security module card type connector) has both cryptographic RSA and ECC keys and associated certificates.
How do I recognize dual-personalized connectors?
Dual-personalized connectors can be identified by the first three digits of the connector's serial number.
If these are greater than or equal to 307 for a single-box connector or greater than or equal to 315 for a data centre connector, it is a dual-personalized connector in both cases.
Where can I find the serial number?
The serial number can be found on the type plate on the back of the connector.
Runtime certificates of the gSMC-K
How do I find out when the gSMC-K that is installed in my connector was produced?
You can view the expiry dates of the gSMC-K certificates in the connector. To do this, use the following path in the connector GUI: Practice > Cards > SMC-K > Certificate expiration date. The start of the certificate's term is the production date.
RSA-only connectors
What are RSA-only connectors?
RSA-only connectors are connectors whose gSMC-K (device-specific security module card type connector) only has cryptographic RSA keys and only associated RSA certificates.
How do I recognize RSA-only connectors?
RSA-only connectors can be recognized by the first three digits of the connector's serial number.
If these are less than 307 for a single-box connector or less than 315 for a data center connector, it is an RSA-only connector in both cases.
Where can I find the serial number?
The serial number can be found on the type plate on the back of the connector.
Background
The security of the connectors is based on the cryptography of a smart card, the so-called gSMC-K.
These gSMC-K, which are permanently installed in the connectors, are personalized with TI certificates at the time of hardware production. According to gematik and BSI specifications, the component certificates may be valid for a maximum of five years from the time of retrieval. As a result, the connectors have a maximum service life of five years.
The first connectors from secunet for online productive operation were produced at the end of November 2018. Thus, their certificates expire by the end of 2023 and become invalid as a result. After the certificates expire, the essential functions of the connector are no longer available.
Connectors with expired certificates must either be replaced with new connectors or equipped with new valid certificates as part of the "runtime extension".
Write to us via the contact form. We are happy to help.
