---
id: certificate-generator
title: Trust List Certificate Generator
description: Generate a test X.509 certificate from a CSR and your organisation details - a root CA for issuers and wallet providers, or an access certificate for relying parties - ready to register in the trust list.
keywords:
  - certificate generator
  - CSR to certificate
  - relying party certificate
  - root CA
  - trust anchor
  - access certificate
  - WRPAC
  - X.509 certificate generator
  - trust list onboarding
  - EUDI Wallet
  - European Business Wallet
hide_title: true
hide_table_of_contents: true
sidebar_label: Certificate Generator
slug: /devtools-certificate-generator/
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import CertificateGenerator from '@site/src/components/CertificateGenerator';
import NoteBox from '@site/src/components/NoteBox';

<NoteBox title="Note:" variant="caution">
The certificate produced here is a <strong>self-signed test certificate</strong>, signed by a throwaway key generated in your browser, because a CSR carries only the public key. It is not issued by a Certificate Authority. Use it to preview the trust-list entry, then replace it with one from your own PKI or a trusted authority before submitting to the registry.
</NoteBox>

<CertificateGenerator />

The Certificate Generator turns a certificate signing request (CSR) and your organisation details into the X.509 certificate your actor type submits to the trust list, and prepares a trust-list entry you can send in with your registration.

The certificate profile follows the service type you pick:

| Service type | Certificate generated | Profile |
|---|---|---|
| Wallet Provider | Trust anchor (root CA) | `CA=true`, key usage `keyCertSign`, `cRLSign`. Wallet unit attestation signing certificates chain to it. |
| PID / EBWOID / QEAA / EAA Issuer | Trust anchor (root CA) | `CA=true`, key usage `keyCertSign`, `cRLSign`. Credential signing certificates chain to it, or credentials are signed directly with this key. |
| Relying Party | Access certificate (WRPAC) | End-entity certificate per ETSI TS 119 411-8: key usage `digitalSignature`, extended key usage `clientAuth`, contact email and support URI in the subject alternative name, NCP-l-eudiwrp certificate policy. |

Provide the organisation details, choose the service type, and upload, drag and drop, or paste a CSR. The tool reads the public key from the CSR and builds a certificate that carries that key together with your organisation as the subject. It then prepares an `onboarding/<participant-id>.json` entry that matches the trust-list onboarding schema, with the certificate embedded.

Everything runs in your browser. Nothing you enter or upload leaves the page.