Note: The certificate produced here is a self-signed test certificate, signed by a throwaway key generated in your browser, because a CSR carries only the public key. It is not issued by a Certificate Authority. Use it to preview the trust-list entry, then replace it with one from your own PKI or a trusted authority before submitting to the registry.

Organisation details

Fill in the relying party details and provide a CSR

Organisation name (legal name) *Brand name

Registration number *Country *Select countryAustraliaAustriaBelgiumBrazilBulgariaCanadaCroatiaCyprusCzechiaDenmarkEstoniaFinlandFranceGermanyGreeceHungaryIcelandIndiaIrelandItalyJapanLatviaLiechtensteinLithuaniaLuxembourgMaltaMexicoNetherlandsNew ZealandNorwayPolandPortugalRomaniaSingaporeSlovakiaSloveniaSouth AfricaSouth KoreaSpainSwedenSwitzerlandTurkeyUkraineUnited Arab EmiratesUnited KingdomUnited States

Street address *

City / locality *Postal code

Support or contact email *Website (information URI) *Service type *Wallet ProviderPID IssuerEBWOID IssuerQEAA IssuerEAA IssuerRelying PartyGenerates a root CA certificate. Wallet unit attestations are signed with this key, or with certificates issued under it.

x509 CSR (certificate signing request) *

Drag and drop a .csr file here, or browse

Generated certificate

Self-signed test certificate for your service type, and trust-list entry

Complete the form and provide a CSR, then choose Generate certificate. The certificate for your service type and a ready-to-edit trust-list entry appear here.

How to generate a CSR

A certificate signing request (CSR) proves you hold a private key and carries the matching public key. You create it with a key pair that stays on your machine. Only the CSR is uploaded here; your private key never leaves your computer.

1. Generate a key and CSR with OpenSSL

Elliptic curve P-256 is recommended:

openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem

openssl req -new -key private-key.pem -out request.csr \
  -subj "/CN=Your Organisation/O=Your Organisation/C=SE"

Or RSA 2048 if you need it:

openssl genrsa -out private-key.pem 2048

openssl req -new -key private-key.pem -out request.csr \
  -subj "/CN=Your Organisation/O=Your Organisation/C=SE"

2. Check the CSR (optional)

openssl req -in request.csr -noout -text -verify

3. Upload it here

Choose browse, or drag and drop request.csr onto the upload area. You can also paste the CSR text directly.

Keep private-key.pem safe and never share or upload it. You need it later to use the certificate.

The Certificate Generator turns a certificate signing request (CSR) and your organisation details into the X.509 certificate your actor type submits to the trust list, and prepares a trust-list entry you can send in with your registration.

The certificate profile follows the service type you pick:

Service type	Certificate generated	Profile
Wallet Provider	Trust anchor (root CA)	CA=true, key usage keyCertSign, cRLSign. Wallet unit attestation signing certificates chain to it.
PID / EBWOID / QEAA / EAA Issuer	Trust anchor (root CA)	CA=true, key usage keyCertSign, cRLSign. Credential signing certificates chain to it, or credentials are signed directly with this key.
Relying Party	Access certificate (WRPAC)	End-entity certificate per ETSI TS 119 411-8: key usage digitalSignature, extended key usage clientAuth, contact email and support URI in the subject alternative name, NCP-l-eudiwrp certificate policy.

Provide the organisation details, choose the service type, and upload, drag and drop, or paste a CSR. The tool reads the public key from the CSR and builds a certificate that carries that key together with your organisation as the subject. It then prepares an onboarding/<participant-id>.json entry that matches the trust-list onboarding schema, with the certificate embedded.

Everything runs in your browser. Nothing you enter or upload leaves the page.