Skip to main content

Create test certificate

POST 
/v2/config/digital-wallet/openid/key-management/keys/:keyId/test-certificate

Gives a key a certificate of the built-in test CA of the organisation, in one call. For development and testing only: the test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it.

The body is a CsrRequest (the generate CSR operation), with the optional validityDays. The test root of the trust domain of the preset (testCaDomain of the list certificate presets operation) issues the certificate: mdoc-iaca for the mdoc presets, access for the WRPAC presets and request-signer-san-dns, and provider for the other presets. When the organisation has no root of that domain, the wallet first makes it, with this country:

  • mdoc-iaca: the subject.country of the request, else the country of the newest leaf certificate that a CA issued for a key of the organisation, else EU.
  • provider and access: the country of the newest leaf certificate that a CA issued for a key of the organisation, else the subject.country of the request, else EU.

The wallet makes the CSR with the key, and the root issues the leaf with the values of the request: the profile of the preset exactly. The root adds the authority key identifier, the subject key identifier and the CRL distribution point (crlUrl of the root). An mdoc-iaca leaf also has an issuer alternative name (the contact of the root, ISO/IEC 18013-5 Annex B). A provider or access leaf also has the authority information access extension with caIssuers, the certificateUrl of the root (ETSI EN 319 412-2 GEN-4.4.1-2). The serial number has at least 64 random bits, and the leaf is valid from 1 minute before the issue. The leaf is never valid after the root.

The wallet stores the chain (the leaf and the test root) on the key: certificateSource is test-ca and testCertificate is true. The key can then sign with the x509 format. The x5c header and the mdoc x5chain of a signature have the leaf only, without the trust anchor. A key that has a test certificate gets a new one, also from the root of another domain, and the test CA revokes the old test leaf (CRL). A key with a certificate chain from another CA (certificateSource uploaded, imported or qtsp) is refused: delete that chain first.

ISO/IEC 18013-5 needs the same country in the Document Signer, in the root (IACA) and in the mdoc issuing_country. For mdoc-document-signer and mdoc-reader, a subject.country that is not the country of the mdoc-iaca root gives the warning profile-mismatch. To choose the country of a root before the first test certificate of its domain, use the create test CA operation.

This operation is for keys in a key store with the capabilities csr and certificateChain: local, vault, gcp-kms, aws-kms, azure-key-vault and dpod. A sandbox organisation cannot issue a test certificate.

Request​

Path Parameters

    keyId stringrequired

    Unique identifier of the key

Body

required

The preset and the values of the certificate (CsrRequest), and the optional validity.

    preset stringnullable

    Possible values: [wrpac-legal, wrpac-natural, pid-provider, wallet-provider, wallet-status-list-signer, eaa-provider, qeaa-provider, pub-eaa-provider, mdoc-document-signer, mdoc-reader, mdoc-status-list-signer, status-list-signer, credential-issuer, request-signer-san-dns, custom, null]

    The id of a preset of the list certificate presets operation. An unknown id gives 400 (preset: unknown preset; use one of <the preset ids>).

    subject object

    The subject of the certificate. Each attribute has one value. An attribute that the request does not give takes the prefill of the preset. null is no value. The wallet encodes the subject in X.500 order, from the country to the common name. The subject has no emailAddress: put the email address in subjectAltName.email.

    country stringnullable

    Country (C), an ISO 3166-1 alpha-2 code in upper case. In an identifier, Greece is EL. For an mdoc Document Signer, the country of the issuing authority (the mdoc issuing_country) and the country of the IACA root.

    stateOrProvince stringnullable

    State or province (ST), at most 128 characters. For an mdoc Document Signer, the issuing_jurisdiction when the IACA root has one.

    locality stringnullable

    Locality (L), at most 128 characters.

    organization stringnullable

    Organisation (O), the registered name of the organisation, at most 256 characters.

    organizationalUnit stringnullable

    Organisational unit (OU), at most 64 characters. Some Certificate Authorities put the identifier that they gave the organisation here.

    commonName stringnullable

    Common name (CN), at most 64 characters. Use the name of the organisation or of the service. Every preset requires it.

    organizationIdentifier stringnullable

    Organisation identifier, at most 128 characters. For a preset with etsiSyntax true, it has the syntax of ETSI EN 319 412-1 clause 5.1.4, for example VATSE-556677889901 (the type VAT, NTR, PSD, LEI, EOR or EXC, the country code, - and the identifier).

    serialNumber stringnullable

    Serial number of a natural person, at most 64 characters of an ASN.1 PrintableString. For a preset with etsiSyntax true, it has the syntax of ETSI EN 319 412-1 clause 5.1.3, for example TINSE-1234567890 (the type PAS, IDC, PNO, TIN or EID, the country code, - and the identifier).

    givenName stringnullable

    Given name of a natural person, at most 128 characters.

    surname stringnullable

    Surname of a natural person, at most 128 characters.

    subjectAltName object

    The subject alternative names of the certificate, at most 50 values of each type. A type that the request does not give takes the prefill of the preset. The wallet checks the format of each value and refuses a repeated value.

    dns string[]nullable

    DNS names (dNSName). A host name, without an IP address. The first label can be *. Give an international name in the A-label form. The x509_san_dns client identifier prefix of OpenID4VP needs the host of the verifier here.

    uri string[]nullable

    URIs (uniformResourceIdentifier). An absolute URI with a scheme, at most 2048 characters, for example the support website of a relying party access certificate.

    email string[]nullable

    Email addresses (rfc822Name), in the form local-part@domain.

    phone string[]nullable

    Telephone numbers in the international form of ITU-T E.123, for example +46 8 123 456 78.

    keyUsage objectnullable

    The key usage extension. null is no key usage extension.

    values string[]required

    Possible values: [digitalSignature, nonRepudiation, keyAgreement], >= 1

    The key usages, each one time.

    critical booleannullable

    true: the extension is critical. Without a value, the criticality of the preset applies (true when the preset fixes none).

    extendedKeyUsage objectnullable

    The extended key usage extension. null is no extended key usage extension.

    values string[]required

    Possible values: >= 1

    The key purposes as OIDs in dotted form, at most 20, each one time. For example 1.0.18013.5.1.2 (ISO/IEC 18013-5 mdoc Document Signer), 1.0.18013.5.1.6 (ISO/IEC 18013-5 reader authentication) or 1.3.6.1.5.5.7.3.45 (Token Status List signer).

    critical booleannullable

    true: the extension is critical. Without a value, the criticality of the preset applies (false when the preset fixes none).

    certificatePolicies string[]nullable

    The certificate policies as OIDs in dotted form, at most 20, each one time. For example 0.4.0.194118.1.2 (NCP-l-eudiwrp, ETSI TS 119 411-8).

    qcStatements objectnullable

    The QC statements of ETSI EN 319 412-5 and the QcPSB statement of ETSI TS 119 412-6. null is no QC statement.

    qcType stringnullable

    The QcType, one OID in dotted form (QcType has one value). For example 0.4.0.194126.1.1 (PID provider), 0.4.0.194126.1.2 (wallet provider) or 0.4.0.1862.1.6.2 (electronic seal).

    qcCompliance booleannullable

    true: the QcCompliance statement (0.4.0.1862.1.1), an EU qualified certificate.

    qcSscd booleannullable

    true: the QcSSCD statement (0.4.0.1862.1.4), the private key is in a qualified signature or seal creation device (QSCD).

    qcPsb objectnullable

    The QcPSB statement (0.4.0.194126.1.3) of a PuB-EAA provider, with all three values. null is no QcPSB statement; with the preset pub-eaa-provider, null gives the warning preset-override.

    countryOfLegislation stringrequired

    The country of the law, an ISO 3166-1 alpha-2 code, or EU for European Union law (ETSI TS 119 412-6 PSB-8.3-05). A PrintableString of two characters in the certificate.

    authSourceIdentification stringrequired

    The unambiguous identification of the authentic source (PSB-8.3-04), for example a list of relative distinguished names. At most 2048 characters, no control character.

    legislationIdentification stringrequired

    The identification of the law under which the public sector body is responsible for the authentic source (PSB-8.3-02). Use a URI (RFC 3986) when one exists (PSB-8.3-03). At most 2048 characters, no control character.

    validityDays integernullable

    Possible values: >= 1 and <= 3650

    The validity of the test certificate in days, at most the maxValidityDays of the preset. Without a value, the validity is the testCertificateValidityDays of the preset (the list certificate presets operation).

Responses​

The test CA issued the certificate, and the wallet stored the chain on the key.

Response Headers
    Schema
      key objectrequired

      One signing key of the organisation, with the key store that holds it and the DIDs that come from it. The answer has public key material only. It never has the private part of the key, the reference of the key in the provider or a secret.

      keyId stringrequired

      Unique identifier of the key. The wallet makes it, and it cannot change. The value is the same as jwk.kid.

      name stringnullablerequired

      Possible values: <= 100 characters

      Name of the key, given by an administrator when the key is created or with the update key operation. null when the key has no name.

      keyStore objectrequired

      The key store that holds the key.

      id stringrequired

      Unique identifier of the key store.

      type stringrequired

      Possible values: [local, vault, gcp-kms, aws-kms, azure-key-vault, dpod, csc]

      Type of the key store.

      name stringrequired

      Name of the key store.

      origin stringnullablerequired

      Possible values: [created, imported, referenced]

      How the key came to the organisation. created, the wallet created the key in the key store (also in a cloud KMS or a DPoD partition of the organisation). imported, the import key operation imported the key, with or without a certificate chain. referenced, the key was already in the key store of the provider, and the wallet signs with it there.

      algorithm stringnullablerequired

      Signature algorithm of the key.

      status stringrequired

      Status of the key. The wallet signs with a key that has the status active.

      isDefault booleanrequired

      Shows true when the wallet signs with this key by default.

      jwk objectrequired

      Public key in JSON Web Key (JWK) format. The service sends only public members. It never sends the private key member d.

      kty stringrequired

      Key type. The service always sends this member. The keys are elliptic curve keys, so the value is EC.

      crv string

      Elliptic curve identifier. The keys are P-256 keys, so the value is P-256.

      x string

      X coordinate of the elliptic curve point, in base64url format.

      y string

      Y coordinate of the elliptic curve point, in base64url format.

      kid string

      Key identifier. The value is the same as keyId.

      alg string

      Signature algorithm for the key, for example ES256 for a P-256 key.

      x5c string[]

      Certificate chain of the key as it is stored, in leaf to root order (for a test certificate, the leaf and the test root). Each item is a base64 encoded DER certificate. The service adds this member only when the key has a certificate chain. The x5c header of a signature and the mdoc x5chain have the leaf and the intermediate certificates, without the trust anchor.

      x5t string

      SHA-1 thumbprint of the leaf certificate. The service adds this member only when the key has a certificate chain.

      x5t#S256 string

      SHA-256 thumbprint of the leaf certificate. Note the # in the member name. The upload certificate chain operation gives the same value as x5t_s256.

      x5c_expiry string

      Expiry time of the leaf certificate, in UTC. The service adds this member only when the key has a certificate chain.

      dids string[]required

      DIDs that come from this key.

      hasCertificateChain booleanrequired

      Shows true when the key has an X.509 certificate chain. Then the key can sign with the x509 format.

      certificateSource stringnullablerequired

      Possible values: [uploaded, imported, test-ca, qtsp, null]

      Where the certificate chain of the key comes from. uploaded, the upload certificate chain operation. imported, the import key operation with a certificate. test-ca, the built-in test CA (the create test certificate operation), for development and testing only. qtsp, the certificate of the QTSP credential. null when the key has no certificate chain.

      testCertificate booleanrequired

      Shows true only when certificateSource is test-ca. The built-in test CA issued the certificate, which is for development and testing only. Wallets and verifiers outside this platform do not trust it.

      certificatePreset stringnullablerequired

      The preset of the certificate chain of the key (the list certificate presets operation). For a test certificate, the preset of its request. For an uploaded chain, the preset of the newest CSR of the key. null when there is none.

      certificateAssessment object

      What the leaf certificate of the key allows: its key usage type, the credential categories that it fits, the mDL Document Signer profile, its QcPSB statement, and the texts of the save check for each category. The wallet reads the certificate chain of the key. A key without a certificate chain, or with a leaf that the wallet cannot read, gives keyUsageType null, empty lists, mdlDocumentSigner false, qcPsb null and texts such as An EAA needs a seal certificate of a legal person. This key has no certificate. Request a certificate with the preset EAA provider (eaa-provider). The texts do not count the trusted-list exemption of the key: an exempt key is never refused.

      keyUsageType stringnullablerequired

      Possible values: [A, B, C, D, E, F, null]

      The key usage type of the leaf certificate (ETSI EN 319 412-2 clause 4.3.2, table 1). A: nonRepudiation. B: nonRepudiation and digitalSignature. C: digitalSignature. D: digitalSignature and keyEncipherment or keyAgreement. E: keyEncipherment or keyAgreement. F: nonRepudiation, digitalSignature and keyEncipherment or keyAgreement. null when the certificate has another key usage (for example with keyCertSign) or no key usage.

      fitsCredentialCategories CredentialCategoryId[]required

      Possible values: [none, pid, eaa, qeaa, pub-eaa]

      The credential categories that the certificate fits (the list credential categories operation), without none. A PID certificate fits only pid, and a PID certificate with another key usage type fits no category.

      fitsCredentialCategoriesForMdl CredentialCategoryId[]required

      Possible values: [none, pid, eaa, qeaa, pub-eaa]

      The credential categories that the certificate fits for an mDL configuration, without none. The rules are the same as for fitsCredentialCategories, but eaa, qeaa and pub-eaa also accept key usage Type C. A key signs an mDL configuration only when mdlDocumentSigner is true and the category of the configuration is in this list.

      mdlDocumentSigner booleanrequired

      Shows true when the certificate has the Document Signer profile of ISO/IEC 18013-5 Table B.3 (key usage digitalSignature and extended key usage 1.0.18013.5.1.2, both critical). A key signs an mDL (doctype org.iso.18013.5.1.mDL) only with this profile.

      qcPsb objectnullablerequired

      The QcPSB statement (0.4.0.194126.1.3) of a PuB-EAA provider, with all three values. null when the certificate has no QcPSB statement. A key with this statement signs only the attestations under its law (legislationIdentification, countryOfLegislation) and from its authentic source (authSourceIdentification), ETSI TS 119 412-6 clause 8.3.

      countryOfLegislation stringrequired

      The country of the law, an ISO 3166-1 alpha-2 code, or EU for European Union law (ETSI TS 119 412-6 PSB-8.3-05). A PrintableString of two characters in the certificate.

      authSourceIdentification stringrequired

      The unambiguous identification of the authentic source (PSB-8.3-04), for example a list of relative distinguished names. At most 2048 characters, no control character.

      legislationIdentification stringrequired

      The identification of the law under which the public sector body is responsible for the authentic source (PSB-8.3-02). Use a URI (RFC 3986) when one exists (PSB-8.3-03). At most 2048 characters, no control character.

      categoryMessages objectrequired

      For each credential category, the texts of the save check for a configuration that is not an mDL. none is always an empty list.

      none string[]required
      pid string[]required
      eaa string[]required
      qeaa string[]required
      pub-eaa string[]required
      mdlConfigurationMessages objectrequired

      For each credential category, the texts of the save check for an mDL configuration (mso_mdoc with doctype org.iso.18013.5.1.mDL) of that category. First the category rule (with key usage Type C also allowed for eaa, qeaa and pub-eaa), then the ISO/IEC 18013-5 Document Signer rule. none has only the Document Signer rule.

      none string[]required
      pid string[]required
      eaa string[]required
      qeaa string[]required
      pub-eaa string[]required
      trustedListExemption objectnullable

      The trusted-list exemption of a key: the certificate of the key is in a trusted list, or chains to a listed CA. While the exemption applies, a rule of the signing key check that the key does not fit gives the check result exempt and no refusal. The exemption is bound to the leaf certificate that the key had when the exemption was set (leafSha256): with another leaf, applies is false and reason says why and what to do (null while it applies). listUri is the source of the exemption: the URL of the trusted list, or a text, for example a recorded decision. Only the platform operator sets or removes it; the API cannot change it. The other members: listUri (the trusted list), service (the service of the list), certificateSha256 (the SHA-256 fingerprint of the certificate of the list), match (how the certificate of the key matched the list), setAt (the time, in UTC) and setBy (who set it). Each of them can be null.

      listUri stringnullable
      service stringnullable
      certificateSha256 stringnullable
      leafSha256 stringnullable
      match stringnullable
      setAt date-timenullable
      setBy stringnullable
      applies booleanrequired
      reason stringnullable
      qscd required

      Shows if the key store keeps the key in a qualified signature creation device (QSCD). false, or provider for a key of a qualified trust service provider (key store type csc): the provider decides. The value comes from the key store.

      trust objectnullable

      The qualified status of a key of a key store of a qualified trust service provider: its leaf certificate against the EU trusted lists. The wallet checks it when the key is referenced and when the connection of the key store is tested.

      status stringrequired

      Possible values: [qualified, not-qualified, unknown]

      qualified: the certificate chains to a qualified certificate authority (service type CA/QC with the status granted) on the EU trusted list, and it is a qualified certificate for electronic signatures or electronic seals whose private key is in a qualified signature or seal creation device (QSCD). not-qualified: the trusted lists say no. unknown: the installation has no EU trusted list source, a list cannot be read, or the key was not checked yet.

      checkedAt stringnullablerequired

      Time of the check, in UTC. null when the key was not checked yet.

      detail stringnullablerequired

      The facts that gave the result, for example the certificate authority and the trusted list, and whether the trusted list or the certificate says that the key is in a QSCD.

      usage object

      The number of credential definitions and presentation definitions that sign with the key. Only the list keys operation returns this member. A credential definition counts once, also when several of its configurations or its status lists use the key. The read key usage operation gives the details.

      credentialDefinitions integerrequired

      Number of credential definitions that sign with the key.

      presentationDefinitions integerrequired

      Number of presentation definitions that sign with the key.

      createdAt date-timenullablerequired

      Creation time of the key, in UTC.

      updatedAt date-timenullablerequired

      Time of the last change of the key, in UTC.

      warnings object[]required

      The warnings. The first one is always test-certificate. Others can follow (preset-override, purpose-reuse, profile-mismatch).

    • Array [
      • code stringrequired

      Possible values: [test-certificate, preset-override, profile-mismatch, purpose-reuse]

      The kind of warning. test-certificate, the answer issues or shows a certificate of the built-in test CA: the text is always the text of the example. preset-override, a value of the request is not the fixed value of the preset; the request value applies. profile-mismatch, the certificate does not agree with the preset of the key. purpose-reuse, the certificate chain of the key has a preset, and the new CSR, test certificate or chain upload has another preset: use one key for each purpose.

      message stringrequired

      The text of the warning, for a person.

    • ]
      • affectedCredentialConfigurations object[]required

      The credential configurations that sign with the key, whose signing key check fitted with the old chain and gives does-not-fit with the test certificate. An empty list when there is none.

    • Array [
      • credentialDefinitionId stringrequired

      The credential definition of the configuration.

      credentialConfigurationId stringrequired

      The credential configuration id, as in the OID4VCI Credential Issuer Metadata.

      name stringrequired

      The label of the configuration, else its display.name, else the label of the credential definition.

      credentialCategory object

      The id of a credential category (the list credential categories operation): the eIDAS category of a credential configuration. none (no certificate rule), pid (person identification data), eaa (non-qualified attestation), qeaa (qualified attestation) or pub-eaa (attestation issued by or for a public sector body).

      messages string[]required

      The rules that the new certificate does not fit, with the fix, as in signingKeyCheck.messages.

    • ]
    Loading...
    Last updated on