Signer configuration

Signers are set in the signer object of the Core configuration. This page covers what to configure for each signer and why.

Signer entries

Each entry under signer is one signer. The entry's key is the name that signature requests use in the signer field:

signer:
  X509_CERTIFICATE:          # requests use "signer": "X509_CERTIFICATE"
    type: X509_CERTIFICATE
    display:
      en: X.509 Certificate Issuer
    params:
      # ...

You can define more than one signer of the same type under different names, for example one X.509 signer configured for mdoc CAs and another for more generic use.

A signer set to enabled: false remains listed in the configuration, but requests to it are rejected.

Revocation methods

revocationMethod references an entry in the revocation object of the configuration by its key. The referenced entry must be enabled and of a type the signer supports, or Core does not start:

Signer type	Supported revocation type	Required
X509_CERTIFICATE	CRL	No
ACCESS_CERTIFICATE	CRL	No
REGISTRATION_CERTIFICATE	TOKENSTATUSLIST	Yes

Without a revocation method, signatures from an X.509 or Access Certificate signer cannot be revoked or checked for status.

X.509 certificates

The X.509 signer signs CSRs with a certificate authority identifier. By default it only issues leaf certificates. Set allowCaSigning to also issue CA certificates and to create self-signed certificate authorities through the identifiers API.

signer:
  X509_CERTIFICATE:
    type: X509_CERTIFICATE
    display:
      en: X.509 Certificate Issuer
    params:
      public:
        maxValidityDurationSeconds: 157680000   # 5 years
      private:
        payload:
          allowCaSigning: true
          pathLenConstraint: 0
          keyIdDerivation: sha-1
        revocationMethod: CRL

For mdoc certificate authorities, set pathLenConstraint to 0 and keyIdDerivation to sha-1.

The issuing certificate authority's certificate must allow signing certificates (the keyCertSign key usage) and, if the signer has a revocation method, signing revocation lists (cRLSign). Self-signed certificate authorities created through the identifiers API always have both. If your CA certificate was issued by an external certificate authority, check its key usages before you sign with it.

Access Certificates

The Access Certificate signer has no signer-specific parameters.

signer:
  ACCESS_CERTIFICATE:
    type: ACCESS_CERTIFICATE
    display:
      en: Wallet-Relying Party Access Certificate
    params:
      public:
        maxValidityDurationSeconds: 157680000   # 5 years
      private:
        revocationMethod: CRL

Access Certificates point relying parties to the issuing CA certificate, which Core serves at {coreBaseUrl}/ssi/ca/{certificateId}. The Core base URL must be configured, or Core does not start.

Registration Certificates

The Registration Certificate signer requires a Token Status List revocation method. Its maximum validity cannot exceed 31536000 seconds (365 days).

signer:
  REGISTRATION_CERTIFICATE:
    type: REGISTRATION_CERTIFICATE
    display:
      en: Wallet-Relying Party Registration Certificate
    params:
      public:
        maxValidityDurationSeconds: 2592000     # 30 days
      private:
        payload: {}
        revocationMethod: TOKENSTATUSLIST

The payload object is required, even when empty. Without it, Core does not start.