April 18, 2017 at 23:30

We go to your personal account on zakupki.gov.ru without Internet Explorer and other useful tips when working with CryptoPro

In this note, I will try to summarize the experience of using the CryptoPro crypto provider to access the closed part of the official website of the unified information system in the field of procurement (zakupki.gov.ru) and the website of public services (gosuslugi.ru). The cryptoprovider itself has already become a de facto standard for state institutions, in its format it issues an EDS, for example, a certification center (CA) of the Federal Treasury or a CA of the Ministry of Health.

First of all, we will talk about the site zakupki.gov.ru. The personal account of this site is available only via HTTPS using GOST encryption algorithms. For a long time, HTTPS via GOST only worked in Internet Explorer, which relied entirely on a crypto provider. The denouement came not so long ago, when the site zakupki.gov.ru stopped supporting older versions of IE, including IE8. The trouble is that IE8 is the last version of this browser supported on Windows XP, and government agencies tend to be very conservative when it comes to licensing. Thus, quite a large part of the users suddenly turned out to be “overboard”.

Fortunately, the CryptoPro company releases a special build of the Firefox browser called CryptoPro Fox (CryptoFox), which supports GOST algorithms and, of course, works only in conjunction with the corresponding crypto provider. There was a time when the development of the assembly almost completely stopped, but now new versions are released regularly. The latest build is based on Firefox 45, you can download builds, versions are available for Windows, Linux and even Apple OS X.

The English version of the browser is available at the link. To localize it, you need to download a package with interface translation. Please note that the version of the package must match the version of the browser itself.

After installing the package, you need to open a new tab, type about:config there, and in the list of parameters that opens, enter general.useragent.locale and change its value from en-US to ru-RU. After restarting the browser, the interface will be in Russian.

Now you can put the root certificate of the CA of the Federal Treasury in the "Trusted Root Certification Authorities" store, the user's personal certificate in the "Personal" store, restart the browser and enter the personal account zakupki.gov.ru according to 44-FZ.

There are no valid certificates of authorized persons installed at my workplace, therefore access to my personal account is prohibited. However, the encryption of the connection in any case is carried out by the algorithm of the GOST family.

In case of access to the closed part of the site according to 223-FZ, authorization will go through the ESIA (that is, through the site gosuslugi.ru). Here the situation is simplified, because this site has a plugin for Firefox for a long time and is being developed by Rostelecom. When you first visit the site, we will be prompted to download the plugin. After installation, the plug-in should be switched to the “Always enable” mode in the CryptoFox settings, otherwise a window with a certificate request will not appear on the public services website.

Unfortunately, the signing of documents on the site zakupki.gov.ru is implemented through a specific component sing.cab, which uses ActiveX technology. Naturally, this component will not work in CryptoPro, so we will wait for the transition to a more common technology. Fortunately, signing a document is only a small part of what an operator must do while working on zakupki.gov.ru, so CryptoFox can be used for everyday operations.

Sometimes it is necessary to keep a copy of the private key on the local computer. This can be done if the key is marked as unloadable when created in the CA. Copying is done using the “Copy” button (what a surprise) in the CryptoPro applet interface

If there are two options for storing the key on the local machine - in the "Register" reader and on a virtual removable disk. In principle, the key storage security is approximately the same in both cases, so the choice of means is up to the reader.

In the “Registry” reader, the keys are stored in the branch

HKLM\SOFTWARE\Crypto Pro\Settings\Users\\Keys
per user and per branch

HKLM\SOFTWARE\Crypto Pro\Settings\Keys
for the computer as a whole.

In the case of a 64-bit OS, the paths will be slightly different:

HKLM\SOFTWARE\Wow6432Node\Crypto Pro\Settings\Users\\Keys
and

HKLM\SOFTWARE\Wow6432Node\Crypto Pro\Settings\Keys

When CryptoPro is running on a terminal server, the user may not have the rights to write the key to these branches, since they are not in the user profile. This situation can be corrected by assigning the appropriate rights to the branches through the Regedit utility.

CryptoPro looks for key containers on disks that have the “removable” attribute, that is, a flash drive or, God forgive me, a floppy disk will be considered key containers, but a network drive or a drive forwarded via RDP will not. This allows you to store keys on floppy disk images on the principle of one key - one floppy disk and thereby increase security. To create a virtual drive, you can use the utility

In order to gain access to electronic procurement, an organization must register in the Unified Information System (UIS) and on the ETP (electronic trading platform).

Registration consists of two stages:

1. Registering a new user in the system and activating an email address
2. Submission of an application for accreditation of an organization on the ETP as an Organizer.

• New User Registration.

You can register a new user from the main page of the EETP at . To do this, click the button "Registration".

Then choose the section you want.
The Add New User form will open. All required fields marked with (*) must be filled in.

Attention! When entering the TIN, the presence of such a TIN number in the system is checked. You will be asked to choose an organization among those already registered on the ETP with this TIN or register a new organization.

If you are registering a new user - an authorized employee with an ES - for an already registered organization, select this organization in the list. If you are registering a new organization with the same TIN that is already in the system (for example, several independent branches of the same parent organization), select the “New Organization” option.

If you have an ES certificate and the workstation from which you are registering has the appropriate software, you can fill in the organization data automatically using the ES certificate. To do this, click on the button "Fill from EP". The system will fill in the name and details of the organization, as well as full name. signature owner and email address. The login is automatically generated from the user's initials.

You must specify a password. It is recommended to use a password containing uppercase and lowercase letters, numbers and symbols to prevent third parties from accessing the account. You should also specify a passphrase for password recovery. If access to the personal account is lost, the user will be able to recover the password using a passphrase and login/email address. After filling in all the required fields, click the button "Registration".

Please note that access to the form for filling out an application for accreditation (or access to the organization's administrator to consider an application for registration of a power of attorney) will be open only after confirmation of the email address. The e-mail activation code will be contained in a letter that will be sent to the e-mail address specified when filling out the application for registration of the organization.

To confirm your email address, follow the activation link provided in the email with registration information, or click the link in the email. Then enter the activation key (code) and click the button "Activate".

Attention! If the letter containing the link and the activation code did not arrive at the specified e-mail (the address was incorrectly specified or for another reason), you must perform the following actions: go to the ETP website, enter the login and password specified during registration in the authorization form. Since your email address has not been activated, you will be taken to an activation form. Click the button "Specify a different email." In the form that appears, enter a new e-mail and click the button "OK". A letter with registration information will be re-sent to the specified e-mail.

• Obtaining accreditation.

To continue registration, go to the page of the closed part of the system again. In the "Login" form, enter your username and password and click the button "Entrance". To obtain accreditation in the system, you must fill out the form shown in Fig. (fields marked with (*) are required), indicating the type of accreditation (as a customer (organizer of procedures) or as an applicant). At the same time, it is possible to apply for one of the two types of accreditation, or for both at the same time.

After filling out the "Basic Information" form, you must fill out the "Accreditation as a customer / applicant" tab and attach the relevant documents.

If you want to get accreditation as a customer, then on the "Accreditation as a customer" tab, select the type of account - "Customer", that is, the organization conducts procurement procedures exclusively for itself. Or select "Specialized organization", that is, the main activity of the organization is the conduct of procurement procedures in electronic form.

In any case, to obtain this type of accreditation, it is necessary to attach electronic copies of the following documents to the application:

• A copy of the extract from the Unified State Register of Legal Entities (with the exception of customers of the Rosatom State Corporation section)

It is necessary to attach an extract from the Unified State Register of Legal Entities received no earlier than six months before the date of application. A copy of the extract is notarized. The original statement must be stamped by the tax office. The document must be readable. To do this, it must be scanned with a resolution of 75-100dpi. All scanned documents are recommended to be placed in one file in doc or docx (Word) format.

• Copies of documents confirming the authority of the person to register on behalf of the customer - the authorized body:

It is required to attach a document confirming the person's right to accreditation at the site. If the head of the organization (owner of the ES) is being accredited, a decision on the appointment or election of the head to the position must be attached, according to which such a person has the right to act on behalf of the participant in the order placement without a power of attorney. It can be either a decision or a protocol or an extract from the protocol.

Attention! If, on behalf of the organizer of the auction, another person registers on the site (the contractor is the owner of the electronic signature), then the document on the appointment of the head must also be accompanied by a power of attorney for the contractor indicating his right to be accredited on the electronic site. The power of attorney must be certified by the seal of the organization and signed by the head. Also, the date of issue must be indicated in the power of attorney. If the power of attorney for the contractor was issued not by the head, but by an authorized person, then a copy of the document confirming the authority of the person who issued the power of attorney (order, decision on appointment to a position, power of attorney) must be provided with the two above documents.

All pages of documents must be legible. To do this, the document must be scanned at a resolution of 75-100dpi. All scanned documents are recommended to be placed in one file in doc or docx (Word) format.

• Copies of documents confirming the authority of the head:

It is necessary to attach an order or decision on the appointment or election of a manager to a position, according to which such a person has the right to act on behalf of the organization without a power of attorney. It can be a decision, a protocol or an extract from the protocol. If another person acts on behalf of the organizer, powers of attorney issued to the ES holder indicating the right to publish information about placing an order for the supply of goods, performance of work, provision of services for the needs of the organization on behalf of the customer are also presented. Powers of attorney must be certified by the seal of the organization and signed by the head or a person authorized by him. If such a power of attorney is signed by a person authorized by the head, a copy of the document confirming the authority of this person must be provided. The copy must be certified by the seal of the organization and signed by the head of the organization.

All sheets of documents must be legible. To do this, they must be scanned with a resolution of 75-100dpi. All scanned documents are recommended to be placed in one file in doc or docx (Word) format. Files up to 10 MB in size are accepted in the following formats: .doc, .docx, .xls, .xlsx, .txt, .rtf, .zip, .rar, .7z, .jpg, .gif, .png, .pdf, . jpeg, .pdf, .bmp, .gif, .djvu.

After filling in all the required fields and selecting the type of accreditation, click the button "Sign and send." A confirmation form will open. Read the information in the text box carefully. If you need to make corrections, return to the previous step by clicking on the "Back" button. If the information provided is correct, click the button. "Sign". Confirm your decision by clicking "Yes" in the Confirmation pop-up window.

Select the required certificate (if you have more than one) and click the button "OK". A message appears indicating that the documents and information were successfully sent. At the same time, a notification about the application for accreditation will be sent to the specified e-mail address. Within the next three business days, you will be notified of the outcome of your application. Upon successful accreditation, you will have access to on-site procurement procedures.

The operator may refuse to accredit the organization if the above documents are not provided. And also in case of non-compliance of documents with the requirements of the legislation of the Russian Federation. At the same time, in the notice of refusal, the operator indicates the grounds for the refusal. After the grounds are eliminated, the organization can re-accredit.

Accreditation is carried out indefinitely, for the section of the State Corporation "Rosatom" - for a period of two years.

Please note that it is necessary to immediately notify the operator in case of changes in the documents and information provided during accreditation.

If you are accredited on the RTS-tender electronic site under 44-FZ or 223-FZ, then go through a separate registration in the E-shop"Small volume purchases"not required. It is enough on the authorization page in the section "Authorization through third-party services" to click on the button "Login by 44-FZ RTS-tender" or "Login by 223-FZ RTS-tender".

If you are not accredited on the RTS-tender electronic site under 44-FZ or 223-FZ, then in order to gain access to your Personal Account, you must register in the E-shop"Small volume purchases".

On the site you can register without an electronic signature. If the user has registered using a login/password, then in this case he is given the opportunity to submit proposals for the purchase of Customers, but there is no possibility of signing contracts in electronic form, unless the Supplier selects an electronic signature certificate at the stage of signing the contract. If the certificate is not selected, then the conclusion of the contract can only take place off-site in paper form.

To register:

2. The registration page will open.Fill in required fields;

Not so long ago, we analyzed, and in today's article we will touch on a similar issue, only for customers operating under 223-FZ. For experienced professionals, this article is unlikely to be useful, but for beginners, it is simply necessary to know the registration procedure.

Analyzing the process of registering a customer according to 223-FZ, we will be guided by two main documents - and Instructions for registering organizations and users in the Unified Information System. The whole process from start to finish, for ease of perception, we will divide into stages: obtaining an electronic digital signature (EDS), preparing a workplace and directly registering.

Stage 1. Obtaining an electronic digital signature.

To work with the closed part of the EIS in section 223-FZ, we need to obtain an electronic digital signature (EDS). Unlike customers working with 44-FZ, customers working under 223-FZ have the opportunity to use both a certificate issued by a certification center of the Federal Treasury and certificates issued by accredited certification centers.

According to the above instructions, customers under 223-FZ must use a qualified electronic signature, details of this and other types of signatures are written in Article 5 of the Federal Law of 04/06/2011 No. 63-FZ "On Electronic Signature".

Thus, to summarize, a qualified electronic signature corresponds to the following set of features:

• obtained as a result of cryptographic transformation of information using an electronic signature key;
• allows you to identify the person who signed the electronic document;
• allows you to detect the fact of making changes to an electronic document after the moment of its signing;
• created using electronic signature means;
• the electronic signature verification key is specified in the qualified certificate;
• to create and verify an electronic signature, electronic signature tools are used that have confirmation of compliance with the requirements established in accordance with this Federal Law (No. 63-FZ).

Since authentication and identification of users in the EIS in part 223-FZ is carried out using the Unified Identification and Authentication System (ESIA), you must first go through the registration procedure in this system. In order not to describe this process in the article, we will give a link to the instructions for registering a user in the ESIA.

The information placed in the EIS is confirmed by the use of an electronic digital signature (ES). In the UIS, in part 223-FZ, it is allowed to use both certificates issued by the certification center of the Federal Treasury, and certificates issued by accredited certification centers. The certificate must contain the following information: user's full name, user's SNILS.

After receiving and installing the ES certificate, the user must go through the registration procedure.

Stage 2. Preparation of the workplace.

In the unified information system, in the subsection "Files for setting up the workplace", the section "Training materials", there is a detailed instruction on setting up your working machine to work in the UIS.

The developer of the instruction, in addition to describing the sequence of steps for setting up, also indicated the minimum requirements for the PC hardware and requirements for the installed software.

Hardware Requirements:

• processor with a clock frequency of at least 1.3 GHz;
• RAM - at least 1 GB;
• Internet channel bandwidth - at least 256 kbps

Requirements for the installed software to work with the EIS Official Website:

• Installed internet browser Internet Explorer (version 10.0 and higher), or any other browser that supports Transport Layer Security (TLS v.1.1 and higher RFC 5246), using Russian cryptographic standards;
• CryptoPro CSP software.

Note that, in essence, the most correct work in the UIS is possible only through the Internet Explorer browser, work through other browsers does not guarantee the desired results.

Setting up a browser and installing specialized CryptoPro CSP software is unlikely to raise questions that are not answered in the instructions, but there is one caveat, if you are using Windows 8.1 and Internet Explorer has been updated to version 11 in it, you must use this browser in compatibility mode in Internet Explorer 10. The fact is that in Windows 8.1, the browser is part of the operating system and its separate installation or removal and subsequent reinstallation of a younger version of the browser are not possible, you have to use a "crutch" in the form of compatibility mode. Detailed instructions for setting this mode are described in the instructions indicated above.

Stage 3. Registration in the EIS.

After successfully setting up the working machine, we can finally proceed to the most important part of our article - registration in the Unified Information System in the field of procurement (EIS).

To register an organization that was not previously registered in the EIS in part 223-FZ, it is necessary to register through the ESIA (the registration procedure in the ESIA is carried out by the head of the organization, or by a person authorized to act on behalf of the head of the organization).

A transition is made to the ESIA page to perform identification and authentication of the user and to select a user certificate. Select a certificate and confirm your choice.

The user is identified and authenticated in the ESIA with the selected certificate.

Upon completion of the user identification and authentication process, the organization registration form appears on the screen on the Organization Registration tab, where some of the data has already been filled in, and the remaining fields must be filled in yourself.

Filling out the form is completely simple, it is designed in the same way as the Windows installation and removal wizard, that is, by filling in the necessary data in one form and clicking "Next", we move to the next one, thus reaching the message about successful registration in the system.

In essence, all stages are not difficult and can be done by any user. We hope that the material we have collected will be useful to you, and knowing the sequence of actions, you can easily register an organization in the Unified Information System and get to work.

Material prepared: Skulbin Georgy, Baltic Tender Center LLC.