The BA interface uses mTLS (mutual TLS) — you need a client certificate from the labor agency. How to request and install it:

  1. Request the cert from BA: Arbeitgeberbereich → JOBBÖRSE interface → Zertifikat anfordern. Processing time: 1-3 business days.
  2. Receive the cert — BA sends a .p12 file plus a password.
  3. Upload to BAconn: Connector → BA settings → enter .p12 and password → Test connection. The response should arrive within 5 seconds.
  4. Supplier ID + Customer ID from your BA contract. Allianz ID is optional, only for alliance partners.

BAconn encrypts both the .p12 file and the password with AES-256-CTR (see services/encryptService.js). The ENCRYPTION_KEY never leaves your server.

Common error: "TLS handshake failed" — usually a wrong or expired .p12. BA certs typically last 24 months — check the expiry date in the connector overview.