Certificates

List certificate presets

GET/v4/config/ows/key-management/certificate-presets

Lists the certificate presets. A certificate preset is a template of the platform for a CSR that targets one certificate profile: the values that the profile fixes (key usage, extended key usage, certificate policies, QC statements), the fields that a request must give, the longest validity, and a prefill from the data of the organisation. Give its id in preset of Generate CSR or Create test certificate.

The presets, in this order: wrpac-legal, wrpac-natural, pid-provider, wallet-provider, wallet-status-list-signer, eaa-provider, qeaa-provider, pub-eaa-provider, mdoc-document-signer, pid-provider-mdoc, eaa-provider-mdoc, qeaa-provider-mdoc, pub-eaa-provider-mdoc (the *-mdoc presets: the certificate of the category with the ISO/IEC 18013-5 Document Signer profile, for an mso_mdoc configuration), mdoc-reader, mdoc-status-list-signer, status-list-signer, request-signer-san-dns and custom (no fixed values, always last). sources names the standards and clauses of each preset. signingPurposes names the uses of a signing key that accept a key with the preset: a key picker shows these keys as the suggested keys of a use (purpose of List keys). A save does not refuse a key because of its preset.

testCaEnabled tells whether the built-in test CA of the installation is on. When it is false, Create test certificate and the test CA operations answer 403, so do not offer a test certificate. A sandbox organisation gets the presets of its main organisation.

Language of the request sample

curl 'https://demo-api.igrant.io/v4/config/ows/key-management/certificate-presets' \
  -H 'Authorization: ApiKey <your-api-key>'

{
  "presets": [
    {
      "id": "wrpac-legal",
      "name": "WRPAC, legal person",
      "description": "Wallet-relying party access certificate of a legal person, issued by an Access CA (ETSI TS 119 411-8).",
      "purpose": "Authenticates the organisation to wallet units: signs OpenID4VP request objects, ISO/IEC 18013-5 readerAuth and the signed issuer metadata.",
      "signingPurposes": [
        "verifier-x509-hash",
        "verifier-x509-san-dns",
        "verifier-attestation",
        "annex-c-reader",
        "issuer-metadata"
      ],
      "fixed": {
        "keyUsage": {
          "values": [
            "digitalSignature"
          ],
          "critical": true
        },
        "extendedKeyUsage": null,
        "certificatePolicies": [
          "0.4.0.194118.1.2"
        ],
        "qcStatements": {
          "qcType": null,
          "qcCompliance": null,
          "qcSscd": null,
          "qcPsb": null
        }
      },
      "required": [
        "subject.country",
        "subject.organization",
        "subject.organizationIdentifier",
        "subject.commonName",
        "subjectAltName.uri|subjectAltName.email|subjectAltName.phone"
      ],
      "prefill": {
        "preset": "wrpac-legal",
        "subject": {
          "country": null,
          "stateOrProvince": null,
          "locality": null,
          "organization": "Example Bank AB",
          "organizationalUnit": null,
          "commonName": "Example Bank AB",
          "organizationIdentifier": null,
          "serialNumber": null,
          "givenName": null,
          "surname": null
        },
        "subjectAltName": {
          "dns": [],
          "uri": [],
          "email": [],
          "phone": []
        },
        "keyUsage": {
          "values": [
            "digitalSignature"
          ],
          "critical": true
        },
        "extendedKeyUsage": null,
        "certificatePolicies": [
          "0.4.0.194118.1.2"
        ],
        "qcStatements": {
          "qcType": null,
          "qcCompliance": null,
          "qcSscd": null,
          "qcPsb": null
        }
      },
      "maxValidityDays": null,
      "testCertificateValidityDays": 365,
      "etsiSyntax": true,
      "testCaDomain": "access",
      "sources": [
        {
          "document": "ETSI TS 119 411-8 V1.1.1",
          "clause": "5.3 (policy NCP-l-eudiwrp 0.4.0.194118.1.2, a hint: the Access CA can use its own policy)"
        },
        {
          "document": "ETSI TS 119 411-8 V1.1.1",
          "clause": "GEN-6.6.1-05 (organizationIdentifier), GEN-6.6.1-07 (at least one SAN contact: URI, email or phone), GEN-6.1.1-04 (commonName: trade name or service name)"
        },
        {
          "document": "ETSI EN 319 412-3 V1.4.1",
          "clause": "LEG-4.2.1-2 (subject C, O, organizationIdentifier, CN)"
        },
        {
          "document": "ETSI EN 319 412-2 V2.5.1",
          "clause": "4.3.2 and Table 1 (keyUsage Type C: digitalSignature)"
        },
        {
          "document": "ETSI EN 319 412-1 V1.7.1",
          "clause": "5.1.4 (organizationIdentifier syntax)"
        },
        {
          "document": "CIR (EU) 2025/848",
          "clause": "Annex IV"
        },
        {
          "document": "ETSI TS 119 472-3 V1.1.1",
          "clause": "ISS-MDATA-4.2.1-02 and ISS-MDATA-ACC_CERT-4.2.2-01 to -03 (the access certificate signs the issuer metadata; x5c without the trust anchor)"
        },
        {
          "document": "EUDI Wallet ARF",
          "clause": "ISSU_22 and ISSU_32"
        }
      ]
    },
    {
      "id": "wrpac-natural",
      "name": "WRPAC, natural person",
      "description": "Wallet-relying party access certificate of a natural person, issued by an Access CA (ETSI TS 119 411-8).",
      "purpose": "Authenticates a natural person relying party to wallet units: signs OpenID4VP request objects and ISO/IEC 18013-5 readerAuth.",
      "signingPurposes": [
        "verifier-x509-hash",
        "verifier-x509-san-dns",
        "verifier-attestation",
        "annex-c-reader"
      ],
      "fixed": {
        "keyUsage": {
          "values": [
            "digitalSignature"
          ],
          "critical": true
        },
        "extendedKeyUsage": null,
        "certificatePolicies": [
          "0.4.0.194118.1.1"
        ],
        "qcStatements": {
          "qcType": null,
          "qcCompliance": null,
          "qcSscd": null,
          "qcPsb": null
        }
      },
      "required": [
        "subject.country",
        "subject.givenName",
        "subject.surname",
        "subject.serialNumber",
        "subject.commonName",
        "subjectAltName.uri|subjectAltName.email|subjectAltName.phone"
      ],
      "prefill": {
        "preset": "wrpac-natural",
        "subject": {
          "country": null,
          "stateOrProvince": null,
          "locality": null,
          "organization": null,
          "organizationalUnit": null,
          "commonName": "Example Bank AB",
          "organizationIdentifier": null,
          "serialNumber": null,
          "givenName": null,
          "surname": null
        },
        "subjectAltName": {
          "dns": [],
          "uri": [],
          "email": [],
          "phone": []
        },
        "keyUsage": {
          "values": [
            "digitalSignature"
          ],
          "critical": true
        },
        "extendedKeyUsage": null,
        "certificatePolicies": [
          "0.4.0.194118.1.1"
        ],
        "qcStatements": {
          "qcType": null,
          "qcCompliance": null,
          "qcSscd": null,
          "qcPsb": null
        }
      },
      "maxValidityDays": null,
      "testCertificateValidityDays": 365,
      "etsiSyntax": true,
      "testCaDomain": "access",
      "sources": [
        {
          "document": "ETSI TS 119 411-8 V1.1.1",
          "clause": "5.3 (policy NCP-n-eudiwrp 0.4.0.194118.1.1, a hint), GEN-6.6.1-07 (at least one SAN contact)"
        },
        {
          "document": "ETSI TS 119 475 V1.2.1",
          "clause": "5.1.4 and 5.1.5 (subject of a natural person)"
        },
        {
          "document": "ETSI EN 319 412-2 V2.5.1",
          "clause": "NAT-4.2.4-1 (subject C, givenName, surname, serialNumber, CN), Table 1 (keyUsage Type C)"
        },
        {
          "document": "ETSI EN 319 412-1 V1.7.1",
          "clause": "5.1.3 (serialNumber syntax)"
        }
      ]
    },
    {
      "id": "pid-provider",
      "name": "PID provider signing certificate",
      "description": "Sign or seal certificate of a PID provider (ETSI TS 119 412-6 clause 4), with the QcType id-etsi-qct-pid.",
      "purpose": "Signs the PID credentials (SD-JWT VC and mdoc).",
      "signingPurposes": [
        "credential-pid"
      ],
      "fixed": {
        "keyUsage": {
          "values": [
            "digitalSignature"
          ],
          "critical": true
        },
        "extendedKeyUsage": null,
        "certificatePolicies": [
          "0.4.0.2042.1.2"
        ],
        "qcStatements": {
          "qcType": "0.4.0.194126.1.1",
          "qcCompliance": null,
          "qcSscd": null,
          "qcPsb": null
        }
      },
      "required": [
        "subject.country",
        "subject.organization",
        "subject.organizationIdentifier",
        "subject.commonName"
      ],
      "prefill": {
        "preset": "pid-provider",
        "subject": {
          "country": null,
          "stateOrProvince": null,
          "locality": null,
          "organization": "Example Bank AB",
          "organizationalUnit": null,
          "commonName": "Example Bank AB PID Provider",
          "organizationIdentifier": null,
          "serialNumber": null,
          "givenName": null,
          "surname": null
        },
        "subjectAltName": {
          "dns": [],
          "uri": [],
          "email": [],
          "phone": []
        },
        "keyUsage": {
          "values": [
            "digitalSignature"
          ],
          "critical": true
        },
        "extendedKeyUsage": null,
        "certificatePolicies": [
          "0.4.0.2042.1.2"
        ],
        "qcStatements": {
          "qcType": "0.4.0.194126.1.1",
          "qcCompliance": null,
          "qcSscd": null,
          "qcPsb": null
        }
      },
      "maxValidityDays": null,
      "testCertificateValidityDays": 365,
      "etsiSyntax": true,
      "testCaDomain": "provider",
      "sources": [
        {
          "document": "ETSI TS 119 412-6 V1.2.1",
          "clause": "PID-4.4.1-01 (keyUsage Type C, for ISO/IEC 18013-5), PID-4.5-01 and Annex A (QcType id-etsi-qct-pid 0.4.0.194126.1.1)"
        },
        {
          "document": "ETSI EN 319 412-5 V2.6.1",
          "clause": "4.2.3 (QcType, one value)"
        },
        {
          "document": "ETSI EN 319 411-1 V1.5.1",
          "clause": "5.3 (policy NCP+ 0.4.0.2042.1.2, a hint: the CA can use its own policy; EUDI Wallet ARF ISSU_67)"
        },
        {
          "document": "ETSI EN 319 412-3 V1.4.1",
          "clause": "LEG-4.2.1-2 (subject C, O, organizationIdentifier, CN)"
        },
        {
          "document": "ETSI EN 319 412-1 V1.7.1",
          "clause": "5.1.4 (organizationIdentifier syntax)"
        }
      ]
    }
  ],
  "testCaEnabled": true
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:keys:read

Response

application/json

The certificate presets and the test CA switch.

presetsobject[]
The certificate presets, custom last.
testCaEnabledboolean
true when the built-in test CA of the installation is on.
Example:true