Skip to main content

Certificates

EUDIPLO manages certificates for signing credentials, authorizing wallet access, and establishing trust. Certificates are always bound to key chains and can be self-signed, CA-issued, or imported from external systems.

Certificate Types​

Self-Signed Certificates​

Generated by EUDIPLO for development and testing. These certificates are not trusted by production wallets but are useful for:

  • Local development
  • Integration testing
  • Sandbox environments

Self-signed certificates are created automatically when generating a new key chain.

CA-Issued Certificates​

Signed by a trusted Certificate Authority (CA). Required for production deployments where credentials must be accepted by production wallets.

To use CA-issued certificates:

  1. Generate a key chain in EUDIPLO
  2. Export the Certificate Signing Request (CSR)
  3. Submit the CSR to your CA
  4. Import the CA-signed certificate back into the key chain

Imported Certificates​

Bring existing certificates from external PKI systems. Useful when:

  • Migrating from another credential system
  • Using certificates from corporate PKI
  • Integrating with existing key management infrastructure

Imported certificates must include both the certificate and private key material (for database-backed keys) or reference existing keys (for Vault/AWS KMS).

Access Certificates vs Attestation Certificates​

EUDIPLO uses certificates for different purposes:

TypePurposeObtained From
Access CertificateGrants access to EUDI WalletRegistrar
Attestation CertificateSigns verifiable credentialsSelf-signed or CA
Status CertificateSigns credential status listsSelf-signed or CA
Trust List CertificateSigns trust list publicationsSelf-signed or CA

Certificate Chains​

For CA-issued certificates, EUDIPLO supports certificate chains:

  • Leaf certificate — The end-entity certificate used for signing
  • Intermediate certificates — CA certificates in the chain
  • Root CA certificate — The trust anchor

When importing or creating certificates, EUDIPLO validates the entire chain to ensure proper trust establishment.

Certificate Lifecycle​

  1. Creation — Generate a new key chain with self-signed cert or import existing
  2. Active Use — Certificate is used for signing operations
  3. Near Expiry — Rotation policy triggers new certificate generation
  4. Grace Period — Both old and new certificates are valid
  5. Retirement — Old certificate expires and is archived

Working with Registrar Certificates​

Access certificates for EUDI Wallets are obtained from a registrar service. See Registrar for the complete workflow.

Registration certificates authorize credential requests and are managed separately. See Registration Certificates for details.

Certificate Storage​

Certificates are stored within key chains in the database. Private key material is stored according to the selected KMS provider:

  • Database provider — Encrypted private keys in database
  • Vault/AWS KMS — Private keys never leave the KMS
  • PKCS#11 (HSM) — Private keys protected by hardware

See KMS Configuration for detailed security considerations.

  • Key Chains — Unified key and certificate management
  • Registrar — Obtaining access certificates
  • Trust Lists — Publishing trusted issuer certificates