Learn how to set up a VICAL

Create an Ecosystem

Perform the following steps to create an Ecosystem:

1. Log in to the Portal.
2. Navigate to the Ecosystem page under the Digital Trust Service section.
3. Enter a name for your Ecosystem, such as "My Digital Trust Service".
4. Select the Create button.

Create participants

Participants are entities that represent issuers that will be included in the VICAL. For each participant, you will need to upload an IACA certificate that will be used as the trust anchor when signing mDocs, and define what credential types they are allowed to issue.

Perform the following steps to create a participant:

1. Select the Participants page under the Digital Trust Service section (this page is only visible if you have an existing ecosystem. If you don't have an ecosystem, you will need to return to step 1 above and create it first).
2. Select the Create new button.
   The Create participant form appears, starting from Step 1 (Details).
3. Insert a meaningful Name for the participant (e.g. "Montcliff DMV").
4. Use the Country dropdown list to select the Participant’s country (optional). Note that when selected, this value must match the Country value in the IACA certificate associated with this participant.
5. If you select a country, a State or Province dropdown list is displayed. You can use it to select the Participant’s state or province (optional). Note that when selected, this value must match the StateOrProvinceName value in the IACA certificate associated with this participant.
6. Insert the participant’s Address (optional).
7. Insert the participant’s Phone number (optional).
8. Use the Status radio button to set the participant as Active.
9. Click the Next button.
   You are directed to Step 2 (Certificates).
10. Select the Add new button.
11. Upload the PEM file you want to use as this participant’s identifier for issuing mDocs (this must be a valid IACA certificate and match any values set for Country and State or Province above).
    You should now see the certificate summary and details.
12. Use the Credential types valid for text box to insert the credential types that this participant will be allowed to issue.

• You can insert as many credential types as you want.
• You can use the pre-populated options (org.iso.18013.5.1.mDL and/or org.iso.23220.photoid.1) or insert custom credential types that are relevant to your ecosystem.
• The credential type is just a string value and does not need to match any values in the certificate. It is only used to link the participant to the credential types they are allowed to issue.

13. Scroll down and use the Certificate status dropdown list to set the certificate as Active.
14. Click the Add button.
15. Click Create.

Repeat the above steps for each participant you want to include in your VICAL.

Manually Publish a VICAL

After you have created your participants, you can publish a VICAL that includes these participants and their associated credential types. When you publish the VICAL, the MATTR VII platform will sign a VICAL that includes the information you provided for each participant, along with the PEM-encoded IACA certificate.

Perform the following steps to publish your DTS policy as a VICAL:

Create a DTS root CA

Each VICAL must be linked to a trusted root CA via a chain of trust. This is what will be used by consuming relying parties as the trust anchor to validate the authenticity and integrity of the VICAL.

Perform the following steps to create a DTS root CA:

1. Navigate to the Certificates page under the Platform Management section.
2. Select the Create new button.
   The New certificate form appears.
3. Use the Type dropdown list to select DTS CA.
4. Use the Management method radio button to select MATTR managed.
5. Enter a meaningful name in the Organisation field to identify the organization that will be signing the policy.
6. Use the Country dropdown list to select the country where the organization is located.
7. Select the Create button.
8. Scroll down and use the Status radio button to select Active.
9. Select the Update button.

Your new DTS root CA is now ready and can be used to establish trust in your VICAL.

Publish a VICAL

1. Navigate to the Trust lists page under the Digital Trust Service section.
2. Select the VICAL (Trusted issuers) tab.
3. Enter a meaningful Provider name to identify the provider of the VICAL. This will be included in the VICAL metadata and used by relying parties to identify the source of the VICAL.
4. Select the Create button.
5. Review the preview area where you can see all participants and credential types included in the VICAL.
6. Select Generate & Publish when you are ready.
   The VICAL is now generated and published, and a modal is displayed where you can:
   • Use the Download button to download the VICAL policy file.
   • Use the Copy button to copy a link to the public endpoint where relying parties can access the policy.

Configure VICAL auto-generation and publishing (optional)

You can optionally set up auto-generation of your VICAL by performing the following steps:

1. Return to the Trust lists page under the Digital Trust Service section.
2. Select the VICAL (Trusted issuers) tab.
3. Expand the VICAL configuration panel.
4. Use the Generation method radio button to select Auto generate.
5. Use the Auto generate frequency dropdown list to select how often you want the VICAL to be automatically generated and published (daily/weekly).
6. Select the Update button.
7. Review the preview area where you can see all participants and credential types included in the VICAL.
   Note that the VICAL is not generated and published yet. It will only be generated and published automatically based on the frequency you selected in step 5 above. If you want to generate and publish the VICAL immediately, you can select the Generate & Publish button.

View Previously Published VICALs (optional)

1. Return to the Trust lists page under the Digital Trust Service section.
2. Select the VICAL (Trusted issuers) tab.
3. Scroll down and select the View Previously Published button to see all previously published VICALs.
   You can use the Download button to download the policy file for any previously published VICAL displayed.