Integration Environment Set‐up Guidance

GP Connect – Integration Environment Set-up Guidance

Details on the Integration environment can be found here:

https://digital.nhs.uk/services/path-to-live-environments/integration-environment

However, not all steps in the above guide apply to GP Connect. This document provides tailored guidance specifically for GP Connect onboarding. Follow the steps below to establish a successful connection to the Integration (INT) environment.

Important Notes

• You do not need to request test data from testdata@nhs.net.
  • Test data is included within your Digital Onboarding Service Application.
• You do not need to request smartcards for GP Connect.
• You will require a Health and Social Care Network (HSCN) connection to access the GP Connect Integration environment.

---

Step 1 – Manufacturer, Product and Version (MPV) Registration

Register your messaging product with Spine using the MPV registration form - https://digital.nhs.uk/services/path-to-live-environments/path-to-live-forms/manufacturer-product-version-registration-request

Complete the Form as Follows:

Section 1: Your Details

• Name
• Organisation
• Telephone Number
• Email Address

Section 2: Environments

• Select Integration

Section 3: New MPV Details

• Manufacturing/Deployer Organisation
• Manufacturer/Developer Organisation ODS Code
• Product Name
• Version Name

Sections 4 & 5: Message Sets

Select the message sets applicable to the GP Connect capability being assured.

Capability	Message Sets
Access Record: HTML	GPConnect-AccessRecordHTML-0 GPConnect-Foundations-1
Access Document	GPConnect-Documents-1 GPConnect-Foundations-1
Access Record: Structured	GPConnect-Foundations-1 GPConnect-StructuredRecord-1

Once completed, submit the request.

The request will be sent to Platform Support who will register your product. After confirmation, proceed to endpoint registration.

---

Step 2 – Requesting an Endpoint

Use the Combined Endpoint and Service Registration Request form - https://digital.nhs.uk/services/path-to-live-environments/path-to-live-forms/combined-endpoint-and-service-registration-request

Section 1: Contact Details

Provide the same:

• Name
• Organisation
• Contact details

used in the MPV registration.

Section 2: What Do You Want To Do?

Select:

• Create an Endpoint

Section 3: Path to Live Environments

• Select Integration
• Enter a Fully Qualified Domain Name (FQDN) using the format:

gpc-int-<ods-code>.<suppliername>.thirdparty.nhs.uk

Section 4: Request a New Certificate

Provide a certificate request with:

Field	Requirement
Common Name (CN)	Must match the FQDN
Key Length	Minimum 2048 bits
Country Code	GB
Other Fields	Leave blank or default

---

Creating a CSR File

Before generating a Certificate Signing Request (CSR):

1. Install the latest Root CA and Sub CA certificates.
2. Download them from:

https://digital.nhs.uk/services/path-to-live-environments/integration-environment

3. Ensure OpenSSL is installed.

---

1. Open Command Prompt

Open Command Prompt and navigate to the desired folder:

Example:

cd C:\Users\johnsmith\Desktop

---

2. Generate the CSR and Private Key

Replace <FQDN> with your domain name:

openssl req -out <FQDN>.csr -new -newkey rsa:2048 -nodes -keyout <FQDN>.key

Example:

openssl req -out client.ncrs.nhs.uk.csr -new -newkey rsa:2048 -nodes -keyout client.ncrs.nhs.uk.key

Example output:

Generating a 2048 bit RSA private key
......................................................+++
..........+++
writing new private key to 'client.ncrs.nhs.uk.key'
-----

---

3. Complete the Certificate Request Details

You will be prompted for certificate information.

Example:

Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []: <FQDN>
Email Address []:

Important

For Common Name, enter the FQDN that the certificate will be issued for:

Example:

client.ncrs.nhs.uk

---

4. Leave Additional Attributes Blank

Press Enter when prompted:

A challenge password []:

An optional company name []:

---

Output Files

File	Description
<FQDN>.csr	CSR file to submit with registration forms
<FQDN>.key	Private key (keep secure)

Example

client.ncrs.nhs.uk.csr
client.ncrs.nhs.uk.key

Important: Never share the private key externally.

---

Section 5: Create New Endpoint

Select:

• CMA Endpoint

Provide:

• Recipient ODS Code
• Recipient ODS Organisation Name
• Manufacturer/Deployer ODS Code
• Manufacturer Product
• Manufacturer Product Version

Note

For INT testing, the recipient ODS code can be:

• The manufacturer ODS code, or
• An ODS code of a future deployment site.

---

Section 6: Additional ASIDs

Not applicable. Leave blank.

Section 7: Party Keys and MHS URL Bindings

Not applicable. Leave blank.

After submission, endpoint details are typically provided within 3–5 working days.

---

Step 3 – Certificates, IP Addresses and Port Numbers

The Authority Service Names (ASN) document provides current URLs, IP addresses and ports:

https://digital.nhs.uk/services/path-to-live-environments/integration-environment

GP Connect Services

Description	URL	IP Address	Port
GP Connect SSP Proxy	https://proxy.int.spine2.ncrs.nhs.uk/[provider service root url]/[fhir request]	10.239.14.31	TCP 443
SDS FHIR API	https://int.api.service.nhs.uk/spine-directory/FHIR/R4	See ASN document	See ASN document
PDS FHIR API	https://int.api.service.nhs.uk/personal-demographics/FHIR/R4/	See ASN document	See ASN document

---

Firewall Configuration

In addition to ASN requirements, allow access to:

Setting	Value
Subnet	10.239.14.0/24
Ports	443, 636
Direction	Inbound and Outbound

---

Installing Root CA and Sub CA Certificates

To establish trust with the Integration environment:

1. Copy the required Root CA or Sub CA certificate.
2. Paste into a text file.
3. Save locally.
4. Rename the extension from .txt to .der.
5. Import into the local certificate store.

Certificate Store Locations

Certificate	Store
Root CA	Trusted Root Certification Authorities
Sub CA	Intermediate Certification Authorities

Refer to your software supplier documentation for application-specific certificate installation steps.

---

Creating a PKCS#12 (.pkcs12) or PFX (.pfx) Certificate Bundle

Required Files

You will need:

1. end_point_certificate.crt
2. subCA.crt
3. rootCA.crt
4. private_key.txt

Important: All certificates must be G2 certificates.

---

Step 1 – Create the Certificate Chain File

Option A – Text Editor

Combine certificates in the following order:

1. end_point_certificate.crt
2. subCA.crt
3. rootCA.crt

Save as:

my_cert_chain.txt

Option B – Command Line

cat end_point_certificate.crt subCA.crt rootCA.crt > my_cert_chain.txt

---

Step 2 – Create the PKCS#12 or PFX File

Using OpenSSL and:

• my_cert_chain.txt
• private_key.txt

You will be prompted to create an export password.

Create a PKCS#12 File

openssl pkcs12 -export -inkey private_key.txt -in my_cert_chain.txt -out my_pkcs12.pkcs12

Output:

my_pkcs12.pkcs12

Create a PFX File

openssl pkcs12 -export -inkey private_key.txt -in my_cert_chain.txt -out my_pfx.pfx

Output:

my_pfx.pfx

Output Files

File	Description
my_pkcs12.pkcs12	PKCS#12 certificate bundle
my_pfx.pfx	PFX certificate bundle

---

Spine Testing

As part of GP Connect testing, your solution must demonstrate interaction with:

• PDS
• SDS
• SSP

Existing PDS Onboarding

If onboarding for:

• Spine Mini Service Provider (SMSP)
• PDS
• PDS FHIR API

then your endpoint may already be registered.

If:

• Using a third-party provider, or
• PDS assurance has not yet been completed,

contact the Assurance Team to request PDS interactions in INT.

---

Additional Instructions – Enabling SDS FHIR API in INT

1. Navigate to Environment Access in the Environment Access & Onboarding section.
2. Select Add New Application.
3. Choose Integration Test as the environment.
4. Assign an Application Owner.
5. Enter an Application Name.
6. Review all details and select Create Application.
7. Open the application.
8. Select Add APIs.
9. Enable:

Spine Directory Service (Integration Testing)

This enables SDS FHIR API access for integration testing.