Getting ready at URA

Smart Business Book cannot do this part for you. Four things happen in URA's portal, and three of them are separate records that look alike. Getting one wrong produces an error much later that points somewhere else entirely.

This page is written from doing it, including the wrong turns.

What you need before you start

A TIN	Yours, from URA
An EFRIS portal login	efristest.ura.go.ug for testing, the live portal for production
Java installed	For keytool, to generate your keypair. Any recent JDK

The four steps, in order

1. Device application        → a DSN, e.g. 1058699282_01
2. Software provider         → "Self", separately approved
3. Device public key         → what URA encrypts for you with
4. Thumbprint registration   → binds your certificate to the device

These are four records, not one process

An approved device application says nothing about whether a public key was uploaded. A registered thumbprint says nothing either. Each is approved on its own, and each has its own screen.

1 — Apply for the device

Device Management → Device Application → Add

Field	What to choose
Order Type	Taxpayer Side — your own software, not a physical EFD
Device Type	Virtual Device
Device Model	V-EFD
Quantity	One is enough

You get a reference number and, once approved, a DSN shaped like <your TIN>_01. That is what goes in the Device number box in Smart Business Book.

The supplier's TIN is not your TIN

The record names an accredited supplier and shows their TIN. Yours is in Section A. Using the supplier's is a mistake nothing refuses until your thumbprint is rejected days later.

2 — Appoint the software provider

Section C of the same record. Integrating yourself means appointing Self.

It gets its own reference number and its own approval. Until it reads Approved, the device is not usable no matter what Section B says.

3 — Upload your device public key

Device Management → Device Public Key Management → Upload

This is the one that decides whether anything works, and the easiest to miss because the screen beside it looks like the same job.

First generate your keypair, using your TIN as the common name:

keytool -genkeypair -alias efris -keyalg RSA -keysize 2048 -validity 3650 \
  -keystore efris.jks -storepass CHANGE_ME -keypass CHANGE_ME \
  -dname "CN=YOUR_TIN, O=Your Company Ltd, L=Kampala, C=UG"

Upload that file on the EFRIS page in Smart Business Book. It reads out the private key, and shows you the device public key to paste into the portal — 392 characters, no headers, no line breaks.

Your device starts with somebody else's key

Look at the Public Key ID column. A new device carries one reading Default — URA's placeholder, not yours.

Everything URA encrypts for your device uses whatever is in that row. Until it is yours, the connection test fails on the key exchange with a message that looks exactly like a wrong key file. This cost a full day to find.

A file named .jks is usually not a JKS

From Java 9 onwards keytool writes PKCS#12 even when the file is named .jks. Upload what keytool gave you and it will almost certainly open.

4 — Register the thumbprint

Device Management → Device Public Key Management → Thumbprint Configure List → Add

Field	Value
Type of Certificate	Self Signed
Thumbprint	Copy it from the EFRIS page — no spaces, no colons
Valid Period from / to	Shown beside the thumbprint
Digital Certificate Form	Upload your .cer file

"Remove any spaces" means the colons too

keytool -list prints 03:46:A6:…. The portal wants the bare forty characters. The Copy button on the EFRIS page gives you that form.

Approval takes up to four business hours.

Then, in Smart Business Book

Settings → EFRIS, switch it on, and fill in:

• TIN — yours
• Device number (DSN) — from step 1
• Upload the keystore
• Press Test connection

Four checks should pass. If the key exchange fails while everything else passes, go back to step 3 — it is almost always the Default public key.

Related

• EFRIS setup — the rest of it, inside Smart Business Book
• When URA refuses — every error and what it means
• Commodity codes — coding your catalogue