List certificate presets

GET 
/v2/config/digital-wallet/openid/key-management/certificate-presets

Lists the certificate presets. A preset is a certificate profile of the ecosystem: the values that the profile fixes (key usage, extended key usage and their criticality, certificate policies, QC statements), the fields that a request must have, the longest validity, and the prefill from the data of the organisation. Give the preset in the generate CSR and the create test certificate operations.

The presets, in this order: wrpac-legal, wrpac-natural, pid-provider, wallet-provider, wallet-status-list-signer, eaa-provider, qeaa-provider, pub-eaa-provider, mdoc-document-signer, mdoc-reader, mdoc-status-list-signer, status-list-signer, credential-issuer, request-signer-san-dns and custom (no fixed values, always last). sources of each preset names the standards and the clauses of its fixed values, and testCaDomain names the test root that issues its test certificates.

testCaEnabled shows if the built-in test CA of the installation is on. When it is false, the create test certificate operation and the test CA operations answer 403, so do not offer a test certificate. A sandbox organisation gets the presets of its main organisation.

Responses

200

The service returned the presets.

Response Headers

application/json

Schema

Schema

presets object[]required
The presets, with custom last.
Array [
id stringrequired
Possible values: [wrpac-legal, wrpac-natural, pid-provider, wallet-provider, wallet-status-list-signer, eaa-provider, qeaa-provider, pub-eaa-provider, mdoc-document-signer, mdoc-reader, mdoc-status-list-signer, status-list-signer, credential-issuer, request-signer-san-dns, custom]
The preset id, the value of preset in a CsrRequest.
name stringrequired
The name of the preset, for a person.
description stringrequired
What the certificate is and who issues it, for a person.
purpose stringrequired
What a key with this certificate signs, for a person.
fixed objectrequired
The values that the profile fixes, in the form of a CsrRequest. A value of a request that is not the fixed value gives the warning preset-override.
keyUsage objectnullable
The key usage extension. The keys are EC keys, so keyEncipherment and dataEncipherment are not allowed (RFC 5480 section 3). A leaf certificate has no CA key usage (keyCertSign, cRLSign).
values string[]required
Possible values: [digitalSignature, nonRepudiation, keyAgreement], >= 1
The key usages, each one time.
critical booleannullable
true: the extension is critical. Without a value, the criticality of the preset applies (true when the preset fixes none).
extendedKeyUsage objectnullable
The extended key usage extension.
values string[]required
Possible values: >= 1
The key purposes as OIDs in dotted form, at most 20, each one time. For example 1.0.18013.5.1.2 (ISO/IEC 18013-5 mdoc Document Signer), 1.0.18013.5.1.6 (ISO/IEC 18013-5 reader authentication) or 1.3.6.1.5.5.7.3.45 (Token Status List signer).
critical booleannullable
true: the extension is critical. Without a value, the criticality of the preset applies (false when the preset fixes none).
certificatePolicies string[]required
The certificate policies. An empty list when the preset fixes none. The CA can add its own policy.
qcStatements objectrequired
The QC statements. null for a statement that the preset does not fix.
qcType stringnullablerequired
The QcType, one OID in dotted form. null when the preset fixes none.
qcCompliance booleannullablerequired
true: the profile needs the QcCompliance statement (0.4.0.1862.1.1). null when the preset does not fix it.
qcSscd booleannullablerequired
true: the profile needs the QcSSCD statement (0.4.0.1862.1.4). null when the preset does not fix it.
qcPsb booleannullablerequired
true: the profile needs the QcPSB statement (0.4.0.194126.1.3, ETSI TS 119 412-6 clause 8.3), and the request gives its values (qcStatements.qcPsb of the CsrRequest). null for the other presets.
required string[]required
The fields that a request with this preset must have, as paths (for example subject.commonName). An entry with | needs at least one of its paths, for example subjectAltName.uri|subjectAltName.email|subjectAltName.phone.
prefill object
The values of a certificate signing request (CSR). With a preset, a member that the request does not give takes the prefill and the fixed values of the preset (the list certificate presets operation). A value that is not the fixed value of the preset gives the warning preset-override, not an error, and the request value applies. Without a preset, the request is custom. The extensions of the CSR are a request: the Certificate Authority (CA) decides what goes into the certificate.
preset stringnullable
Possible values: [wrpac-legal, wrpac-natural, pid-provider, wallet-provider, wallet-status-list-signer, eaa-provider, qeaa-provider, pub-eaa-provider, mdoc-document-signer, mdoc-reader, mdoc-status-list-signer, status-list-signer, credential-issuer, request-signer-san-dns, custom, null]
The id of a preset of the list certificate presets operation. An unknown id gives 400 (preset: unknown preset; use one of <the preset ids>).
subject object
The subject of the certificate. Each attribute has one value. An attribute that the request does not give takes the prefill of the preset. null is no value. The wallet encodes the subject in X.500 order, from the country to the common name. The subject has no emailAddress: put the email address in subjectAltName.email.
country stringnullable
Country (C), an ISO 3166-1 alpha-2 code in upper case. In an identifier, Greece is EL. For an mdoc Document Signer, the country of the issuing authority (the mdoc issuing_country) and the country of the IACA root.
stateOrProvince stringnullable
State or province (ST), at most 128 characters. For an mdoc Document Signer, the issuing_jurisdiction when the IACA root has one.
locality stringnullable
Locality (L), at most 128 characters.
organization stringnullable
Organisation (O), the registered name of the organisation, at most 256 characters.
organizationalUnit stringnullable
Organisational unit (OU), at most 64 characters. Some Certificate Authorities put the identifier that they gave the organisation here.
commonName stringnullable
Common name (CN), at most 64 characters. Use the name of the organisation or of the service. Every preset requires it.
organizationIdentifier stringnullable
Organisation identifier, at most 128 characters. For a preset with etsiSyntax true, it has the syntax of ETSI EN 319 412-1 clause 5.1.4, for example VATSE-556677889901 (the type VAT, NTR, PSD, LEI, EOR or EXC, the country code, - and the identifier).
serialNumber stringnullable
Serial number of a natural person, at most 64 characters of an ASN.1 PrintableString. For a preset with etsiSyntax true, it has the syntax of ETSI EN 319 412-1 clause 5.1.3, for example TINSE-1234567890 (the type PAS, IDC, PNO, TIN or EID, the country code, - and the identifier).
givenName stringnullable
Given name of a natural person, at most 128 characters.
surname stringnullable
Surname of a natural person, at most 128 characters.
subjectAltName object
The subject alternative names of the certificate, at most 50 values of each type. A type that the request does not give takes the prefill of the preset. The wallet checks the format of each value and refuses a repeated value.
dns string[]nullable
DNS names (dNSName). A host name, without an IP address. The first label can be *. Give an international name in the A-label form. The x509_san_dns client identifier prefix of OpenID4VP needs the host of the verifier here.
uri string[]nullable
URIs (uniformResourceIdentifier). An absolute URI with a scheme, at most 2048 characters, for example the support website of a relying party access certificate.
email string[]nullable
Email addresses (rfc822Name), in the form local-part@domain.
phone string[]nullable
Telephone numbers in the international form of ITU-T E.123, for example +46 8 123 456 78.
keyUsage objectnullable
The key usage extension. null is no key usage extension.
values string[]required
Possible values: [digitalSignature, nonRepudiation, keyAgreement], >= 1
The key usages, each one time.
critical booleannullable
true: the extension is critical. Without a value, the criticality of the preset applies (true when the preset fixes none).
extendedKeyUsage objectnullable
The extended key usage extension. null is no extended key usage extension.
values string[]required
Possible values: >= 1
The key purposes as OIDs in dotted form, at most 20, each one time. For example 1.0.18013.5.1.2 (ISO/IEC 18013-5 mdoc Document Signer), 1.0.18013.5.1.6 (ISO/IEC 18013-5 reader authentication) or 1.3.6.1.5.5.7.3.45 (Token Status List signer).
critical booleannullable
true: the extension is critical. Without a value, the criticality of the preset applies (false when the preset fixes none).
certificatePolicies string[]nullable
The certificate policies as OIDs in dotted form, at most 20, each one time. For example 0.4.0.194118.1.2 (NCP-l-eudiwrp, ETSI TS 119 411-8).
qcStatements objectnullable
The QC statements of ETSI EN 319 412-5 and the QcPSB statement of ETSI TS 119 412-6. null is no QC statement.
qcType stringnullable
The QcType, one OID in dotted form (QcType has one value). For example 0.4.0.194126.1.1 (PID provider), 0.4.0.194126.1.2 (wallet provider) or 0.4.0.1862.1.6.2 (electronic seal).
qcCompliance booleannullable
true: the QcCompliance statement (0.4.0.1862.1.1), an EU qualified certificate.
qcSscd booleannullable
true: the QcSSCD statement (0.4.0.1862.1.4), the private key is in a qualified signature or seal creation device (QSCD).
qcPsb objectnullable
The QcPSB statement (0.4.0.194126.1.3) of a PuB-EAA provider, with all three values. null is no QcPSB statement; with the preset pub-eaa-provider, null gives the warning preset-override.
countryOfLegislation stringrequired
The country of the law, an ISO 3166-1 alpha-2 code, or EU for European Union law (ETSI TS 119 412-6 PSB-8.3-05). A PrintableString of two characters in the certificate.
authSourceIdentification stringrequired
The unambiguous identification of the authentic source (PSB-8.3-04), for example a list of relative distinguished names. At most 2048 characters, no control character.
legislationIdentification stringrequired
The identification of the law under which the public sector body is responsible for the authentic source (PSB-8.3-02). Use a URI (RFC 3986) when one exists (PSB-8.3-03). At most 2048 characters, no control character.
maxValidityDays integernullablerequired
The longest validity of a certificate of the profile, in days. null when the profile sets no limit.
testCertificateValidityDays integerrequired
The validity in days of a test certificate with this preset when the request has no validityDays (the create test certificate operation). It is the setting of the installation (default 365 days), at most maxValidityDays.
testCaDomain stringrequired
Possible values: [mdoc-iaca, provider, access]
The trust domain of the test root that issues a test certificate with this preset (the create test certificate operation). mdoc-iaca, the IACA of mdoc-document-signer, mdoc-reader and mdoc-status-list-signer. access, in place of the Access CA, for wrpac-legal, wrpac-natural and request-signer-san-dns. provider for the other presets.
etsiSyntax booleanrequired
Shows true when the wallet checks subject.serialNumber and subject.organizationIdentifier of a request with this preset against the syntax of ETSI EN 319 412-1 (clauses 5.1.3 and 5.1.4).
sources object[]required
The documents and the clauses of the fixed values.
Array [
document stringrequired
The standard or the specification.
clause stringrequired
The clause, and what it says.
]
]
testCaEnabled booleanrequired

Shows true when the built-in test CA of the installation is on. The installation can switch it off.

Example (from schema)

{
  "presets": [
    {
      "id": "mdoc-document-signer",
      "name": "mdoc Document Signer (ISO/IEC 18013-5)",
      "description": "Document signer certificate of ISO/IEC 18013-5 Table B.3, issued by an IACA. The C is the issuing_country of the mdoc and the C of the IACA; the ST, if the IACA has one, is the issuing_jurisdiction. ISO/IEC 23220-4 recommends the EKU 1.0.23220.4.1.2 in addition.",
      "purpose": "Signs the mdoc MSO (issuerAuth).",
      "fixed": {
        "keyUsage": {
          "values": [
            "digitalSignature"
          ],
          "critical": true
        },
        "extendedKeyUsage": {
          "values": [
            "1.0.18013.5.1.2"
          ],
          "critical": true
        },
        "certificatePolicies": [],
        "qcStatements": {
          "qcType": "0.4.0.1862.1.6.2",
          "qcCompliance": true,
          "qcSscd": true,
          "qcPsb": null
        }
      },
      "required": [
        "subject.country",
        "subject.commonName"
      ],
      "prefill": {
        "preset": "mdoc-document-signer",
        "subject": {
          "country": "SE",
          "organization": "Example AB",
          "commonName": "Example AB Document Signer"
        },
        "subjectAltName": {
          "dns": [
            "wallet.example.com"
          ]
        }
      },
      "maxValidityDays": 457,
      "testCertificateValidityDays": 365,
      "testCaDomain": "mdoc-iaca",
      "etsiSyntax": false,
      "sources": [
        {
          "document": "ISO/IEC 18013-5",
          "clause": "Table B.3 (keyUsage digitalSignature critical, EKU 1.0.18013.5.1.2 critical, at most 457 days, C and ST as the IACA, issuer = the IACA subject)"
        }
      ]
    }
  ],
  "testCaEnabled": true
}

401

Unauthorized

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

500

Internal server error

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

Loading...