Test certificates

Create test certificate

POST/v4/config/ows/key-management/keys/{keyId}/test-certificate

Gives a key a test certificate of the built-in test CA of the organisation in one call: the wallet makes the CSR with the key, the test root issues the leaf, and the wallet stores the chain (the leaf and the root) on the key. For development and testing only: the test CA is on no trusted list, and wallets and verifiers outside this platform do not trust it. The answer always has the warning test-certificate.

The body is a CsrRequest (see Generate CSR) with an optional validityDays. The leaf has exactly the values of the request and the certificate preset. The test root of the trust domain of the preset (testCaDomain in List certificate presets) issues it. When the organisation has no root of that domain yet, the wallet makes it first, with this country:

mdoc-iaca: subject.country of the request, else the country of the newest CA-issued leaf of a key of the organisation, else EU.
provider and access: the country of the newest CA-issued leaf of a key of the organisation, else subject.country, else EU.

To choose the country of a root before its first test certificate, use Create test CA. ISO/IEC 18013-5 needs the same country in the Document Signer, the IACA and the mdoc issuing_country: for mdoc-document-signer, mdoc-reader and the *-mdoc presets, another subject.country than the root gives the warning profile-mismatch.

After the call, certificateSource is test-ca and testCertificate is true, and the key can sign with cryptographicKeyFormat x509; a signature carries the leaf only. A key that already has a test certificate gets a new one, and the old leaf goes into the CRL. A key with a chain from another CA is refused: Delete certificate chain first. The key store must have the capabilities csr and certificateChain.

Create test certificate

Language of the request sample

ExampleExample request

curl -X POST 'https://demo-api.igrant.io/v4/config/ows/key-management/keys/{keyId}/test-certificate' \
  -H 'Authorization: ApiKey <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "preset": "eaa-provider",
  "subject": {
    "commonName": "Example Bank EAA signer",
    "organization": "Example Bank AB",
    "organizationIdentifier": "VATSE-556677889901",
    "country": "SE"
  },
  "validityDays": 30
}'

{
  "key": {
    "keyId": "cc9ea8a5e46a45768e197cfafb3cfcd7",
    "name": "EAA signing key",
    "keyStore": {
      "id": "local-openbao",
      "type": "local",
      "name": "Local vault"
    },
    "origin": "created",
    "algorithm": "ES256",
    "status": "active",
    "jwk": {
      "kid": "cc9ea8a5e46a45768e197cfafb3cfcd7",
      "kty": "EC",
      "crv": "P-256",
      "x": "DlsfFV5XHrCUGozkUB9Kk7KNIGrbLom7w_eADn5e8xQ",
      "y": "1Dnd_bH_ID02fHpMvmxFaUZ4hpSds9JONSWikNfc7g4",
      "alg": "ES256",
      "x5t": "R5aNBocxgx5EshVldhgKPbtpfEA",
      "x5t#S256": "qS40Bw2m9GehVG9R-iOK9bCYjGsRvnlsEExDcggSVvs",
      "x5c": [
        "MIIDgTCCAyagAwIBAgIQcavPGUuTy3gOaLXPgl9bRTAKBggqhkjOPQQDAjBlMQswCQYDVQQGEwJTRTEXMBUGA1UECgwOT3JnYW5pemF0aW9uIDExPTA7BgNVBAMMNE9yZ2FuaXphdGlvbiAxIFRlc3QgUHJvdmlkZXIgQ0EgKE5PVCBGT1IgUFJPRFVDVElPTikwHhcNMjYxMTA4MTQ0NjExWhcNMjYxMjA4MTQ0NzExWjBmMQswCQYDVQQGEwJTRTEYMBYGA1UECgwPRXhhbXBsZSBCYW5rIEFCMRswGQYDVQRhDBJWQVRTRS01NTY2Nzc4ODk5MDExIDAeBgNVBAMMF0V4YW1wbGUgQmFuayBFQUEgc2lnbmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDlsfFV5XHrCUGozkUB9Kk7KNIGrbLom7w/eADn5e8xTUOd39sf8gPTZ8eky+bEVpRniGlJ2z0k41JaKQ19zuDqOCAbUwggGxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBTrP7taA4RCRoafhKUX+ayf+oV9EzAdBgNVHQ4EFgQUP+HL2A1PdSRQHLmnIGAaNNAqBIswgbYGCCsGAQUFBwEBBIGpMIGmMIGjBggrBgEFBQcwAoaBlmh0dHBzOi8vZXVkaXdhbGxldC1zZXJ2aWNlLmV1YncuZGV2L29yZ2FuaXNhdGlvbi82MDkwNTI3Ny1kOTUzLTRlZjctYWE0Yy1jZWM0MTNkMDBkOTMvc2VydmljZS90ZXN0LWNhLzQ1NmYzOGU3LTZkMTMtNDI1Zi04Y2I5LTI1Y2MwNzYxODQyYS9jZXJ0aWZpY2F0ZTCBpQYDVR0fBIGdMIGaMIGXoIGUoIGRhoGOaHR0cHM6Ly9ldWRpd2FsbGV0LXNlcnZpY2UuZXVidy5kZXYvb3JnYW5pc2F0aW9uLzYwOTA1Mjc3LWQ5NTMtNGVmNy1hYTRjLWNlYzQxM2QwMGQ5My9zZXJ2aWNlL3Rlc3QtY2EvNDU2ZjM4ZTctNmQxMy00MjVmLThjYjktMjVjYzA3NjE4NDJhL2NybDAKBggqhkjOPQQDAgNJADBGAiEAsZfNUYmEjxbbAymjy7r8HTEWj01QDPv/9aoeHnMCRW0CIQCAeuc87Bj8NxT8rsCcebSt2RxhDN/C0ZAgLYYaum26tg==",
        "MIICDjCCAbOgAwIBAgIQUZwLcqhrd2hejESOFWFLOzAKBggqhkjOPQQDAjBlMQswCQYDVQQGEwJTRTEXMBUGA1UECgwOT3JnYW5pemF0aW9uIDExPTA7BgNVBAMMNE9yZ2FuaXphdGlvbiAxIFRlc3QgUHJvdmlkZXIgQ0EgKE5PVCBGT1IgUFJPRFVDVElPTikwHhcNMjYxMDI5MDMzNjM1WhcNMzUxMDI5MDMzNjM1WjBlMQswCQYDVQQGEwJTRTEXMBUGA1UECgwOT3JnYW5pemF0aW9uIDExPTA7BgNVBAMMNE9yZ2FuaXphdGlvbiAxIFRlc3QgUHJvdmlkZXIgQ0EgKE5PVCBGT1IgUFJPRFVDVElPTikwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQEOiQ6kMJ2zWARYT07sUP0Y9iq5JQCZ+rEomPqUQsfsU/ZwVfN5IN5a6CajwRnwxpAlPx3Vcc7yVVnZt21FN/Zo0UwQzASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU6z+7WgOEQkaGn4SlF/msn/qFfRMwCgYIKoZIzj0EAwIDSQAwRgIhAMM5xzqXnCz4+932zNB/H4tCcSnFcCr3lkEEfRk5PIWHAiEAivDfARxgmzXgrXcY6A0ISbgXXv7hZIB+Aw4Vfw4zjbQ="
      ],
      "x5c_expiry": "2026-12-08T14:47:11Z"
    },
    "hasCertificateChain": true,
    "certificateSource": "test-ca",
    "testCertificate": true,
    "certificatePreset": "eaa-provider",
    "certificateAssessment": {
      "keyUsageType": "B",
      "fitsCredentialCategories": [
        "eaa"
      ],
      "qcPsb": null,
      "categoryMessages": {
        "eaa": [],
        "qeaa": [
          "A QEAA needs a qualified seal certificate. This key has an EAA certificate (no QcCompliance statement; no QcSSCD statement; no QcType eseal). Request a certificate with the preset QEAA provider (qeaa-provider)."
        ],
        "pub-eaa": [
          "A PuB-EAA needs a qualified seal certificate with the QcPSB statement. This key has an EAA certificate (no QcPSB statement with its three values; no QcCompliance statement; no QcSSCD statement; no QcType eseal or eidaspsbeaa). Request a certificate with the preset PuB-EAA provider (pub-eaa-provider)."
        ],
        "mdl": [
          "An mDL needs an ISO/IEC 18013-5 document signer certificate. This key has an EAA certificate (no extendedKeyUsage 1.0.18013.5.1.2). Request a certificate with the preset mdoc Document Signer (mdoc-document-signer)."
        ],
        "pid": [
          "A PID needs a PID provider certificate. This key has an EAA certificate (no QcType pid). Request a certificate with the preset PID provider (pid-provider)."
        ]
      },
      "fitsMdocCredentialCategories": [],
      "mdocCategoryMessages": {
        "eaa": [
          "An EAA needs a seal certificate of a legal person. This key has an EAA certificate (keyUsage type B, not C; no extendedKeyUsage 1.0.18013.5.1.2). Request a certificate with the preset EAA provider (mdoc) (eaa-provider-mdoc)."
        ],
        "qeaa": [
          "A QEAA needs a qualified seal certificate. This key has an EAA certificate (no QcCompliance statement; no QcSSCD statement; no QcType eseal; keyUsage type B, not C; no extendedKeyUsage 1.0.18013.5.1.2). Request a certificate with the preset QEAA provider (mdoc) (qeaa-provider-mdoc)."
        ],
        "pub-eaa": [
          "A PuB-EAA needs a qualified seal certificate with the QcPSB statement. This key has an EAA certificate (no QcPSB statement with its three values; no QcCompliance statement; no QcSSCD statement; no QcType eseal or eidaspsbeaa; keyUsage type B, not C; no extendedKeyUsage 1.0.18013.5.1.2). Request a certificate with the preset PuB-EAA provider (mdoc) (pub-eaa-provider-mdoc)."
        ],
        "pid": [
          "A PID needs a PID provider certificate. This key has an EAA certificate (no QcType pid; keyUsage type B, not C; no extendedKeyUsage 1.0.18013.5.1.2). Request a certificate with the preset PID provider (mdoc) (pid-provider-mdoc)."
        ]
      }
    },
    "qscd": false,
    "trust": null,
    "createdAt": "2026-11-08T14:46:47Z",
    "updatedAt": "2026-11-08T14:47:12Z"
  },
  "warnings": [
    {
      "code": "test-certificate",
      "message": "Development and testing only. The built-in test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it. Do not use it in production."
    }
  ],
  "affectedCredentialConfigurations": []
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:keys:update

Path parameters

keyIdstringrequired
The keyId of a key of the organisation, from List keys or from the answer of Create key. It is also the kid of its JWK.

Body

application/json

The certificate preset and the values of the certificate (CsrRequest), and the optional validity.

presetenum<string> | null
The certificate preset. An unknown value gives 400 (preset: unknown preset; use one of <the preset ids>).
Available options:wrpac-legal,wrpac-natural,pid-provider,wallet-provider,wallet-status-list-signer,eaa-provider,qeaa-provider,pub-eaa-provider,mdoc-document-signer,pid-provider-mdoc,eaa-provider-mdoc,qeaa-provider-mdoc,pub-eaa-provider-mdoc,mdoc-reader,mdoc-status-list-signer,status-list-signer,request-signer-san-dns,custom
Example:"mdoc-document-signer"
subjectobject
The subject of the certificate, one value for each attribute. An attribute that the request does not give takes the prefill of the certificate preset; null means no value. The wallet encodes the subject in X.500 order, from the country to the common name. emailAddress is not allowed: put an email address in subjectAltName.email.
subjectAltNameobject
The subject alternative names of the certificate, at most 50 values of each kind. A kind that the request does not give takes the prefill of the certificate preset. The wallet checks the format of each value and refuses a repeated value.
keyUsageobject | null
The key usage extension. null means no key usage extension.
extendedKeyUsageobject | null
The extended key usage extension. null means no extended key usage extension.
certificatePoliciesstring[] | null
The certificate policies as OIDs in dotted form, at most 20, each once. For example 0.4.0.194118.1.2 (NCP-l-eudiwrp, ETSI TS 119 411-8).
qcStatementsobject | null
The QC statements. null means no QC statement.
validityDaysinteger | null
The validity of the test certificate in days, at most the maxValidityDays of the certificate preset. Default the testCertificateValidityDays of the preset.
From 1 to 3650.
Example:365

Response

application/json

The key with its new test certificate, the warnings and the affected credential configurations.

keyobject
A signing key of the organisation, with its key store, its public JWK and what its certificate allows. It has public values only, never the private key, the name of the key at the provider or a secret. The wallet key of the organisation (the automatic key that the wallet creates at the deployment, the holder identity of the organisation wallet) is not a signing key, and no key answer has it while it has no certificate chain.
warningsobject[]
The warnings, test-certificate first, then any of preset-override, purpose-reuse and profile-mismatch.
affectedCredentialConfigurationsobject[]
The credential configurations whose signing key check fitted with the old chain and gives does-not-fit with the test certificate. An empty list when there are none.