Authentication & TaxCore (S3-S4)

§3 — Authentication & token acquisition 
 Access to TaxCore.API requires a bearer token obtained by authenticating with the on-card PKI certificate . XPOS ESDC performs a mutual-TLS request to /api/v3/sdc/token in which the client certificate and private key are the SE's PKI key, exposed through OpenSC PKCS#11 . The private key never leaves the card — the TLS handshake's client-certificate signature is computed on the SE. 
 TLS renegotiation 
 The FRCS token endpoint requests the client certificate via TLS renegotiation (the initial handshake asks for no certificate; the server then issues a HelloRequest to demand the card certificate). XPOS ESDC performs this exchange over TLS 1.2 with client-initiated renegotiation supported, using the card key via PKCS#11 for the certificate-verify signature (PKCS#1 v1.5, SHA-256). The server certificate is pinned on first use. 
 The returned token is cached and refreshed before expiry, and presented as the TaxCoreAuthenticationToken header on all subsequent data calls (§4). 

 §4 — TaxCore.API & command processing 
 All communication with TaxCore uses the token from §3. XPOS ESDC receives and executes the full command set, in the order received, and reports the result of each command back to TaxCore. 
 
 Command Action 
 
 SetTaxRates Install/replace tax-rate groups, including future-dated groups (§6). 
 SetTimeServerUrl Set the NTP server used for time synchronisation (§13). 
 SetVerificationUrl Set the base verification URL used on receipts (§8). 
 SetTaxCoreConfiguration Apply TaxCore configuration parameters. 
 ForwardProofOfAudit Apply a proof-of-audit to the SE via End Audit (§9, §12). 
 ForwardSecureElementDirective Relay a directive to the SE. 
 
 
 Commands are processed consecutively (first to last); each result is reported so TaxCore has an accurate record of execution.