EPP

About

The 2022 registry platform has standardised on the globally adopted Extensible Provisioning Protocol (EPP).

EPP communication between the Registrar and the Registry allows the Registrar to manage domain, host and contact objects without using the web portal.

EPP is a protected service, to access the service Registrars require both an EPP account (see Portal Accounts) and TLS Client Certificate.

Registrars must ensure that EPP requests meet EPP standards as defined by the following:

The registry parses all incoming requests using a validating XML parser that reads the XML and validates XML syntax before processing the request.

Transport Security

Communication to the EPP server is only possible via an authenticated encrypted mTLS connection over TCP/IP port 700.

To connect to each IRS environment you will need a single TLS Client Certificate signed by the related Intermediate Issuing CA.

  • NZRS Root CA (2012)

    • InternetNZ IRS Production Issuing CA

    • InternetNZ IRS OTE Issuing CA

The EPP servers currently support connections via the following protocols.

  • TLSv1.2

Note

Only one certificate will be issued per IRS environment

Client Certificates

To obtain a client certificate you will need to generate a Private key and CSR (Certificate signing request) and email registry support with only the CSR attached.

Private Key

The private key must be generated within the following constraints.

  • Key Size: 4096 to 8192 bits.

  • Algorithm: RSA

Warning

Your private key is your own, do not send it to registry support

CSR

The Certificate Request must be generated within the folling constraints.

  • Signature: SHA256 Signature.

  • Certificate Common Name (CN): environment.regid.registrarname.epp.

Note

The regid in the request is the primary registrar id, not secondary id’s

Tip

Example CN format for prod and ote for registrar id 1234 with the name yourtradingname

prod.1234.yourtradingname.epp
ote.1234.yourtradingname.epp

  • The name can contain the . character

  • The name cannot contain a space

  • The entire CN string cannot exceed 64 characters

  • The trading name can be abbreviated version of the full trading name

  • The filename of the request should be the CN string with the extension .crt

InternetNZ will return a signed client certificate which you will need to use to establish an SSL connection to the respective EPP server.

IP Allowlisting

EPP has a dedicated IP Allowlist, these can only be configured by the portal.

Servers and Ports

Interface

Server/URL

IP

Port

TCP/UDP:

Description

Portal

https://irs.net.nz

103.70.24.0

443

TCP

HTTP over TLS

EPP

epp.irs.net.nz

103.70.24.1

700

TCP

EPP over mTLS

TBR

tbr.irs.net.nz

103.70.24.2

700

TCP

TBR over mTLS

WHOIS

whois.irs.net.nz

103.70.24.3

43

TCP

WHOIS

Namespaces and Schemas

Namespace

Scheme

XSD extensions supported by IRS:

EPP

urn:ietf:params:xml:ns:epp-1.0

epp-1.0, eppall-1.0, and eppcom-1.0 - RFC 5730

Domain

urn:ietf:params:xml:ns:domain-1.0

domain-1.0 - RFC 5731

Host

urn:ietf:params:xml:ns:host-1.0

host-1.0 - RFC 5732

Contact

urn:ietf:params:xml:ns:contact-1.0

contact-1.0 - RFC 5733

Registry Fee Extension 0.9

urn:ietf:params:xml:ns:fee-0.9

#fee-0.9 - RFC Draft: brown-epp-fees

Registry Fee Extension 0.11

urn:ietf:params:xml:ns:fee-0.11

fee-0.11 - RFC Draft: regext-epp-fees

IDN

urn:ietf:params:xml:ns:idn-1.0

idn-1.0 - RFC Draft: eppext-idnmap

Launch Phase Mapping

urn:ietf:params:xml:ns:launch-1.0

launch-1.0 - RFC Draft: regext-launchphase

Domain Registry Grace Period

urn:ietf:params:xml:ns:rgp-1.0

rgp-1.0 - RFC 3915

DNSSEC

urn:ietf:params:xml:ns:fee-0.11

secDNS-1.1 - RFC 5910

Note

Fee 0.9 is an earlier version of the Fee extension and 0.11 is the latest version

The following are the Fury-specific custom extensions:

Namespace

Scheme

Fury extensions supported by IRS:

Fury Generic properties

urn:ietf:params:xml:ns:fury-2.0

fury 2.0 - Generic properties

Fury Registry Fee Extension

fury-rgp-1.0 - RGP