How to configure holder certificates
Holder applications use Wallet Attestation to prove their authenticity to credential issuers. This attestation is verified using a chain of trust model, where wallet attestation JWTs are linked to the holder application operator via a series of certificates. MATTR VII supports both managed and unmanaged (external) holder certificates, allowing you to choose how you manage your certificate infrastructure.
- With managed holder certificates, you create a Holder root CA certificate and MATTR VII manages the rest. Wallet attestation signers (and their certificates) are automatically provisioned when needed to sign wallet attestation JWTs.
- With unmanaged holder certificates, you manage the entire lifecycle. You generate the Holder root CA certificate, create wallet attestation signers, use the returned CSR to obtain signed certificates from your root CA, and upload them to MATTR VII. See unmanaged certificates for more details.
Creating a Holder root CA certificate
You can configure holder certificates as either MATTR-managed or externally managed (unmanaged), and you can complete either workflow in the MATTR Portal or via the MATTR VII API.
Create a managed Holder root CA
- Log in to the MATTR Portal and expand the Platform management section in the left-hand navigation panel.
- Select Certificates, then select the Create new button to open the New certificate form.
- Use the Type field to select Holder CA ("for credential holding").
- Use the Management method radio button to select MATTR managed.
- Optionally use the Common name text box to insert a common name for the Holder root CA. If left
empty, the value defaults to
{tenantDomain} Wallet Attestation. - Optionally use the Country field to select the holder country.
- Select the Create button. The Holder root CA is always created as inactive. You will activate it in the next step.
Activate the Holder root CA
- Open the Holder root CA from the Certificates list to display the Holder CA certificate detail screen.
- Use the Status radio button to select Active.
- Select the Update button to apply the change.
Only one Holder CA can be active per tenant, so activating this one automatically deactivates any other Holder CA on the same tenant.
Once a managed Holder root CA is active, MATTR VII automatically provisions wallet attestation signers on demand when the first wallet attestation request is made. No additional configuration is required.
How would you rate this page?
Last updated on