Create test CA

POST 
/v2/config/digital-wallet/openid/key-management/test-ca

Makes the test root CA of the organisation for one trust domain, with a country. For development and testing only. The organisation has one test root for each trust domain (mdoc-iaca, provider and access, see TestCa), and a second create for the same domain gives 409. The first test certificate of a domain also makes its root, so use this operation to choose the country before the first test certificate of the domain.

The country of the root:

• mdoc-iaca: country is required. ISO/IEC 18013-5 needs the same country (C) in the Document Signer, in the root (IACA) and in the mdoc issuing_country, and the root is valid for 9 years.
• provider and access: country is optional. Without it, the root gets the country of the newest leaf certificate that a CA issued for a key of the organisation, else EU.

A sandbox organisation cannot make a test CA.

Request

application/json

Body

required

The trust domain and the country of the root.

domain stringnullable

Possible values: [mdoc-iaca, provider, access, null]

The trust domain of the root. Without a value, mdoc-iaca.

country stringnullable

The country (C) of the root, an ISO 3166-1 alpha-2 code in upper case. Required for mdoc-iaca (the issuing_country of the mdoc credentials), optional for provider and access.

Responses

201

The wallet made the test CA, and the service returned it.

Response Headers

application/json

Schema

Schema

testCa objectrequired

A test root CA of the organisation, for development and testing only. The organisation has one test root for each trust domain (domain). Every root has key usage keyCertSign and cRLSign (critical), basic constraints CA with path length 0 (critical), a subject key identifier, a validity of 9 years and a P-256 key. The mdoc-iaca root has the profile of an ISO/IEC 18013-5 IACA (Table B.1): C, O, CN <organisation> Test CA (NOT FOR PRODUCTION) and an issuer alternative name (the contact). The provider and access roots have C, O, the organisation identifier when it is known, and CN <organisation> Test Provider CA (NOT FOR PRODUCTION) or <organisation> Test Access CA (NOT FOR PRODUCTION). The key of a root is in the local key store of the installation. It cannot be exported, it is not a signing key of the organisation (it is not in the list keys operation), and the organisation cannot use it for other purposes.

id stringrequired

Unique identifier of the test CA.

domain stringrequired

Possible values: [mdoc-iaca, provider, access]

The trust domain of the root, and the presets whose test certificates it issues (testCaDomain of the preset). mdoc-iaca, the IACA of the mdoc Document Signers, readers and status list signers. provider, the CA of the PID, wallet, EAA and QEAA providers, the status list signers of the SD-JWT VC and W3C VC credentials, the credential issuers and custom. access, in place of the Access CA of the access certificates (WRPAC) and of the request signers.

certificate stringrequired

The root certificate, in PEM format. To trust the test certificates of this root in a verifier of this platform, add it as a trust authority.

subject stringrequired

The subject of the root, in the text form of RFC 4514.

notBefore date-timenullablerequired

Start of the validity of the root, in UTC.

notAfter date-timenullablerequired

End of the validity of the root, in UTC.

crlUrl stringrequired

The URL of the certificate revocation list (CRL) of this root. It is a public route of the wallet, without authentication. The answer is the CRL in DER format (application/pkix-crl), signed by the root. Each test certificate of the root has this URL as its CRL distribution point. The route stays available when the installation switches the test CA off.

certificateUrl stringrequired

The URL of the root certificate. It is a public route of the wallet, without authentication. The answer is the certificate in DER format (application/pkix-cert). The test certificates of the provider and access roots have this URL in their authority information access extension (caIssuers). The route stays available when the installation switches the test CA off.

warnings object[]required
The test-certificate warning.
Array [
code stringrequired
Possible values: [test-certificate, preset-override, profile-mismatch, purpose-reuse]
The kind of warning. test-certificate, the answer issues or shows a certificate of the built-in test CA: the text is always the text of the example. preset-override, a value of the request is not the fixed value of the preset; the request value applies. profile-mismatch, the certificate does not agree with the preset of the key. purpose-reuse, the certificate chain of the key has a preset, and the new CSR, test certificate or chain upload has another preset: use one key for each purpose.
message stringrequired
The text of the warning, for a person.
]

Example (from schema)

{
  "testCa": {
    "id": "0b6f8e2a-3c1d-4e5f-9a7b-1c2d3e4f5a6b",
    "domain": "mdoc-iaca",
    "certificate": "-----BEGIN CERTIFICATE-----\n<base64-certificate-content>\n-----END CERTIFICATE-----\n",
    "subject": "CN=Example AB Test CA (NOT FOR PRODUCTION),O=Example AB,C=SE",
    "notBefore": "2026-10-21T10:00:00Z",
    "notAfter": "2035-10-21T10:00:00Z",
    "crlUrl": "https://wallet.example.com/organisation/<organisationId>/service/test-ca/<testCaId>/crl",
    "certificateUrl": "https://wallet.example.com/organisation/<organisationId>/service/test-ca/<testCaId>/certificate"
  },
  "warnings": [
    {
      "code": "test-certificate",
      "message": "Development and testing only. The built-in test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it. Do not use it in production."
    }
  ]
}

400

domain is not a trust domain (domain: one of mdoc-iaca, provider, access), the domain is mdoc-iaca and the body has no country (country: required for the domain mdoc-iaca (the issuing_country of the mdoc document signers)), country is not a string (country: invalid type) or not an ISO 3166-1 alpha-2 code (country: not an ISO 3166-1 alpha-2 country code (two upper-case letters, for example SE)), or the organisation is a sandbox organisation (Subwallets are not allowed to create a test CA.). The body checks come before the test CA check, so an invalid body gives 400 also when the root of the domain exists.

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

401

Unauthorized

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

403

The installation switched the test CA off (The built-in test CA is switched off in this installation.).

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

409

The organisation already has the root of this domain (The organisation already has a test CA for the domain <domain>.).

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

500

Internal server error

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

503

The local key store of the installation does not answer (Failed to make the test CA: Key management service is not available).

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

507

Insufficient Storage: the HSM partition of the key store has no room for a new key. This is the partition of the installation HSM (the local key store in a hardware security module), or the DPoD partition of a key store of your organisation. The text is The HSM partition has no room for a new key. Remove unused key pairs (kms signer orphans list) or give the partition more room. A new try fails the same way: the answer has no Retry-After, so do not send the request again before room is free. For the installation HSM, the operator of the installation removes the unused key pairs or gives the partition more room. For a DPoD partition of your organisation, delete unused key pairs in the partition or give it more room. Some operations put the text after their own text: the test CA (Failed to make the test CA: The HSM partition has no room ...), the deploy of the organisation wallet (Failed to deploy the OpenID digital wallet for organisation ID <id>: ...) and the create of a sandbox organisation (Failed to deploy sandbox organisation: ...). A route that signs can also give this answer for an organisation that has no default key yet, because the wallet makes the default key the first time that it needs it.

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

Example

{
  "errorCode": 507,
  "errorDescription": "The HSM partition has no room for a new key. Remove unused key pairs (kms signer orphans list) or give the partition more room."
}

Loading...