Read test CA

GET 
/v2/config/digital-wallet/openid/key-management/test-ca

Lists the test root CAs of the organisation: for each root, its trust domain, the root certificate (PEM), its subject and validity, the URL of its CRL and the URL of the root certificate. For development and testing only.

The organisation has one test root for each trust domain: mdoc-iaca (the IACA of the mdoc presets), provider (the provider presets, status-list-signer, credential-issuer and custom) and access (the WRPAC presets and request-signer-san-dns). The list has only the roots that exist, in the order mdoc-iaca, provider, access. This read makes no root: the create test CA operation, or the first test certificate of a domain, makes the root of that domain.

A verifier of this platform trusts a test certificate only when the organisation of the verifier adds its root as a trust authority, or when a trust list that the verifier uses has the root. A test root is never on an EU trusted list, so it is never qualified.

A sandbox organisation reads the test CAs of its main organisation.

Responses

200

The service returned the test CAs.

Response Headers

application/json

Schema

Schema

testCas object[]required
The test root CAs of the organisation, in the order mdoc-iaca, provider, access. An empty list when the organisation has none.
Array [
id stringrequired
Unique identifier of the test CA.
domain stringrequired
Possible values: [mdoc-iaca, provider, access]
The trust domain of the root, and the presets whose test certificates it issues (testCaDomain of the preset). mdoc-iaca, the IACA of the mdoc Document Signers, readers and status list signers. provider, the CA of the PID, wallet, EAA and QEAA providers, the status list signers of the SD-JWT VC and W3C VC credentials, the credential issuers and custom. access, in place of the Access CA of the access certificates (WRPAC) and of the request signers.
certificate stringrequired
The root certificate, in PEM format. To trust the test certificates of this root in a verifier of this platform, add it as a trust authority.
subject stringrequired
The subject of the root, in the text form of RFC 4514.
notBefore date-timenullablerequired
Start of the validity of the root, in UTC.
notAfter date-timenullablerequired
End of the validity of the root, in UTC.
crlUrl stringrequired
The URL of the certificate revocation list (CRL) of this root. It is a public route of the wallet, without authentication. The answer is the CRL in DER format (application/pkix-crl), signed by the root. Each test certificate of the root has this URL as its CRL distribution point. The route stays available when the installation switches the test CA off.
certificateUrl stringrequired
The URL of the root certificate. It is a public route of the wallet, without authentication. The answer is the certificate in DER format (application/pkix-cert). The test certificates of the provider and access roots have this URL in their authority information access extension (caIssuers). The route stays available when the installation switches the test CA off.
]
warnings object[]required
The test-certificate warning. An empty list when testCas is empty.
Array [
code stringrequired
Possible values: [test-certificate, preset-override, profile-mismatch, purpose-reuse]
The kind of warning. test-certificate, the answer issues or shows a certificate of the built-in test CA: the text is always the text of the example. preset-override, a value of the request is not the fixed value of the preset; the request value applies. profile-mismatch, the certificate does not agree with the preset of the key. purpose-reuse, the certificate chain of the key has a preset, and the new CSR, test certificate or chain upload has another preset: use one key for each purpose.
message stringrequired
The text of the warning, for a person.
]

Example (from schema)

{
  "testCas": [
    {
      "id": "0b6f8e2a-3c1d-4e5f-9a7b-1c2d3e4f5a6b",
      "domain": "mdoc-iaca",
      "certificate": "-----BEGIN CERTIFICATE-----\n<base64-certificate-content>\n-----END CERTIFICATE-----\n",
      "subject": "CN=Example AB Test CA (NOT FOR PRODUCTION),O=Example AB,C=SE",
      "notBefore": "2026-10-21T10:00:00Z",
      "notAfter": "2035-10-21T10:00:00Z",
      "crlUrl": "https://wallet.example.com/organisation/<organisationId>/service/test-ca/<testCaId>/crl",
      "certificateUrl": "https://wallet.example.com/organisation/<organisationId>/service/test-ca/<testCaId>/certificate"
    }
  ],
  "warnings": [
    {
      "code": "test-certificate",
      "message": "Development and testing only. The built-in test CA is not on any trusted list, and wallets and verifiers outside this platform do not trust it. Do not use it in production."
    }
  ]
}

401

Unauthorized

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

403

The installation switched the test CA off (The built-in test CA is switched off in this installation.).

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

500

Internal server error

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

Loading...