Planning certificate
How to obtain, register and renew the OV client certificate that the Fluvius planning API requires for Fall-Back Flex day-ahead steering: requirements, where to buy one, the ordering steps and the ren
Zones with mandatory day-ahead steering publish the Fall-Back Flex plan through the Fluvius planning API. That API has no API keys, no accounts and no shared secrets: the only way in is a client certificate presented in a mutual TLS (mTLS) handshake. Without a valid certificate the controller cannot fetch the plan and cannot acknowledge it, which Fluvius counts as a non-delivered service.
The certificate is bought by the grid user (the customer, the DNG in the Fluvius documents), not by Voltmasters. It confirms the legal existence of your company, so only your company can complete the validation with the certificate authority. Once issued, Fluvius couples the certificate server-side to one asset point id and scopes everything the API returns to that connection. The EMS therefore selects nothing itself: whatever the API answers on this certificate belongs to this connection.
Start the order at least three weeks before you need the day-ahead steering to run. Organisation validation with a certificate authority takes a few working days, and longer when the CA cannot find your company in a public register or cannot reach you on a published phone number.
What Fluvius requires
Type
OV (Organisation Validation) SSL certificate from a recognised commercial CA
Self-signed
Not allowed, the request is refused
Key type
RSA, KeySpec = Signature
Key length
2048 bits minimum
Validity
Maximum one year
Usage
X.509 client certificate in a mutual TLS setup, one certificate per execution client
Binding
Server-side coupled to a single assetPointId, which must match every message you send
Cost
Roughly 60 to 300 EUR per year, depending on the CA
Expiry notice
Announce a replacement certificate to Fluvius at the earliest 90 days and at the latest 15 days before the expiry date
Fluvius leaves the choice of certificate authority to you, as long as the certificate meets these requirements.
There is no test or acceptance environment for the planning API outside a concrete connection file: Fluvius does not open one for product development. The first handshake therefore happens on the production API, which is why the registration with Fluvius and the verification below are part of the commissioning and not something to postpone.
Before you order
An OV certificate is issued to a company, not to a person or a device. Have the following ready:
the legal name, address and company number (in Belgium the KBO/BCE number) exactly as they appear in the official register;
a phone number on which the CA can reach your company, listed in a public source the CA accepts (the company register, an official directory or your own domain);
a domain name you control, with access to its DNS records or to an email address on that domain: the CA validates domain control as part of the order;
a technical contact who can receive the issued files and keep the private key safe;
the asset point id Fluvius assigned to the connection, from the bid form or zone sheet.
Where to buy one
Any recognised commercial CA that issues OV certificates qualifies. The most commonly used ones, with the page where the OV product is ordered:
Buying through a reseller is fine too and is often cheaper. Belgian resellers that carry the OV products of the CAs above include Kinamo and Combell. What matters is the certificate itself, not who sold it.
Free certificates from Let's Encrypt, ZeroSSL and comparable services are domain validated (DV), not organisation validated. They do not meet the Fluvius requirement, however technically valid they are. Self-signed certificates and certificates from your own internal CA are refused as well.
Ordering step by step
Generate a private key and a CSR
Generate the key pair yourself and keep the private key: a CA never needs it, and a key that was mailed around cannot be trusted any more. On any machine with OpenSSL:
Use a domain you control as CN, and fill in O with the legal company name as it appears in the register. -nodes leaves the private key without a passphrase, which is what the platform expects on upload.
Order the OV certificate
Order the OV product with the CA or reseller of your choice and submit the CSR from the previous step. Ask explicitly for Client Authentication in the extended key usage: most OV TLS products carry both server and client authentication, but a server-only certificate cannot be used for mTLS. Mention that the certificate is used as a client certificate in a machine-to-machine setup.
Complete the organisation validation
The CA verifies the legal and physical existence of your company against the official register and a public directory, and calls the published phone number. Answer their requests quickly: this step decides the lead time. The CA may ask for a recent extract from the company register.
Collect the issued files
You receive the certificate and the CA chain (intermediate plus root). Together with the private key from step 1 that is everything you need. The platform expects PEM (.pem, .crt, .cer for certificates, .pem or .key for the private key). See file formats if your CA delivered a PKCS#12 or DER file.
Register the certificate with Fluvius
Send the public certificate (never the private key) to FRPflex@fluvius.be, together with the asset point id it must be bound to. Fluvius couples the certificate to that asset point; until that coupling exists the API answers UNAUTHORIZED_CERTIFICATE or FORBIDDEN, even with a perfectly valid certificate.
Upload it in the platform
Under Configuration → Grid & market → DSO RTU settings, in the Fall-Back Flex section, upload the client certificate, the private key and optionally the CA chain, and fill in the asset point id. The platform checks that the certificate is readable, that the key belongs to it and that it has not expired, then shows the thumbprint and the expiry date. The controller picks the credentials up within a minute.
Verify
On the Fall-Back Flex page the day-ahead plan must appear after the next Fluvius publication (around 12:00 for the following day). Check that no Fluvius planning API unreachable incident is raised. When in doubt, ask Voltmasters support to check the handshake on the controller.
File formats and conversions
The platform stores the certificate and the key as PEM. PEM is text and starts with -----BEGIN CERTIFICATE----- or -----BEGIN PRIVATE KEY-----. If your CA delivered something else:
PKCS#12 bundle (.pfx, .p12)
openssl pkcs12 -in bundle.pfx -clcerts -nokeys -out certificate.pem and openssl pkcs12 -in bundle.pfx -nocerts -nodes -out private.key
DER certificate (.der, .cer binary)
openssl x509 -inform der -in certificate.der -out certificate.pem
Encrypted private key
openssl rsa -in encrypted.key -out private.key
The private key must be uploaded without a passphrase: the platform does not ask for one, and an encrypted key is rejected as unreadable. Keep the original encrypted copy in your own password manager.
Renewal
A certificate is valid for at most one year, so renewal is part of running a Fall-Back Flex connection, not an exception.
90 days before expiry
Fluvius accepts the announcement of a replacement certificate from this moment on.
60 days before expiry
The platform sends the first reminder mail to the project members who receive notifications.
30 days before expiry
Reminder mail, and the EMS raises the Planning certificate expiring incident.
15 days before expiry
Reminder mail. This is the last moment to announce the replacement certificate to Fluvius; a later announcement risks a gap in the day-ahead steering.
7 days and 1 day before
Final reminder mails.
After expiry
The API refuses the handshake, the plan is no longer fetched and the Planning certificate expired incident is raised. The controller keeps applying the last confirmed plan and the live Netflex setpoint, so an activation is still executed.
Renewing without a gap:
Order the new certificate 6 to 8 weeks before the expiry date, with a new key pair (a renewal is a new order with the CA, not an extension).
Send the new public certificate to FRPflex@fluvius.be, at the earliest 90 and at the latest 15 days before the expiry date, and mention the asset point id and the expiry date of the current certificate.
Once Fluvius confirms the new coupling, upload the new certificate and key in the same form. The upload replaces the stored files and restarts the reminder cycle on the new expiry date; the expiry incident is resolved once the controller runs on the new certificate.
Troubleshooting
UNAUTHORIZED_CERTIFICATE
The certificate is not known at Fluvius, or the coupling to the asset point id is not active yet. Confirm the registration with Fluvius.
FORBIDDEN
The certificate is valid but is not coupled to this connection, or the coupling was made for another asset point. Ask Fluvius which asset point the certificate is bound to and compare it with the bid form.
The upload says the key does not belong to the certificate
Certificate and key come from different orders. Use the key generated for the CSR that produced this certificate.
The upload says the certificate cannot be read
The file is DER or PKCS#12, not PEM. Convert it first, see file formats.
The upload says the private key cannot be read
The key is passphrase protected. Remove the passphrase, see file formats.
The plan stays empty while the certificate is accepted
Fluvius publishes the plan for the following day around 12:00. Before the first publication after registration there is nothing to fetch.
Frequently asked questions
Last updated