Access Certificates

The Access Certificate signer issues Wallet-Relying Party Access Certificates (WRPAC) as defined in ETSI TS 119 475. A relying party presents its access certificate to EUDI wallets to authenticate itself.

tip

If you run the Wallet-Relying Party Registry service, use it to issue Access Certificates. It is the managed and preferred interface, and it calls this signer for you.

Before you begin

• A certificate authority identifier to sign with, registered on the trust lists that wallets use to validate Access Certificates. See Certificates.
• A CSR in PEM format from the relying party, for the key it will use with the certificate.
• The ACCESS_CERTIFICATE_SIGN permission, when Core runs in STS authentication mode.

Request

POST /api/signature/v1

A legal person:

{
  "issuer": "<certificate authority identifier ID>",
  "signer": "ACCESS_CERTIFICATE",
  "data": {
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIBSTCB8AIBADBK...\n-----END CERTIFICATE REQUEST-----",
    "policy": "LEGAL_PERSON",
    "organizationIdentifier": "VATCH-CHE123456789",
    "organizationName": "Example AG",
    "countryName": "CH",
    "commonName": "Example AG Verifier",
    "sanUri": "https://verifier.example.com",
    "rfc822Name": "support@example.com",
    "nationalRegistryUrl": "https://registry.example.ch/rp/example-ag"
  }
}

A natural person:

{
  "issuer": "<certificate authority identifier ID>",
  "signer": "ACCESS_CERTIFICATE",
  "data": {
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIBSTCB8AIBADBK...\n-----END CERTIFICATE REQUEST-----",
    "policy": "NATURAL_PERSON",
    "organizationIdentifier": "TINCH-756.1234.5678.97",
    "givenName": "Anna",
    "familyName": "Muster",
    "countryName": "CH",
    "sanUri": "https://anna-muster.example.com",
    "nationalRegistryUrl": "https://registry.example.ch/rp/anna-muster"
  }
}

data fields

Field	Type	Description
csr	string	Required. The relying party's CSR in PEM format. Used to verify that the relying party holds the private key, and to take the public key for the certificate. See What the CSR contributes.
policy	LEGAL_PERSON | NATURAL_PERSON	Required. The certificate policy the certificate is issued under. Determines which name fields are required.
organizationIdentifier	string	Required. The relying party's identifier as listed in the national register. For a legal person, set in the subject's organizationIdentifier; for a natural person, in its serialNumber.
organizationName	string	Legal person: required. Natural person: not allowed.
givenName	string	Natural person: required. Legal person: not allowed.
familyName	string	Natural person: required. Legal person: not allowed.
countryName	string	Required. Country code, set in the subject's C.
commonName	string	Optional. Set in the subject's CN.
sanUri	string	Required. URI of the relying party, added as a subject alternative name.
rfc822Name	string	Optional. Email address, added as a subject alternative name.
otherNamePhoneNr	string	Optional. Telephone number, added as a subject alternative name.
nationalRegistryUrl	string	Required. URL of the relying party's entry in the national register, added to the subject.

Unknown fields are rejected.

For the other request fields, see Creating a signature.

What the CSR contributes

Core verifies the CSR's signature to confirm that the relying party holds the private key, then takes only the public key from it. The CSR's subject and any extensions it requests are ignored: the certificate's content comes entirely from data and from the access certificate profile below.

What Core adds

Every Access Certificate is issued with the same profile:

• Key usage: digitalSignature, keyAgreement. The certificate is not a CA.
• Extended key usage: client authentication, ISO 18013-5 mDL reader authentication, and ISO 23220-4 mdoc reader authentication.
• Certificate policies: the ETSI policy for the chosen policy.
• Authority information access: a URL where relying parties can fetch the issuing CA certificate, served by Core at {coreBaseUrl}/ssi/ca/{certificateId}.
• Authority key identifier, from the issuing CA's key.
• Issuer alternative name, if the issuing CA is a self-signed root with one.
• CRL distribution point, if the signer has a revocation method.

Response

{
  "id": "4f1c2b7e-...",
  "result": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n"
}

result is a PEM certificate chain: the Access Certificate first, followed by the issuing CA's chain. Return it to the relying party.

Store id to revoke the certificate or check its status later. See Revocation and status.