How to configure holder certificates
Holder applications use Wallet Attestation to prove their authenticity to credential issuers. This attestation is verified using a chain of trust model, where wallet attestation JWTs are linked to the holder application operator via a series of certificates. MATTR VII supports both managed and unmanaged (external) holder certificates, allowing you to choose how you manage your certificate infrastructure.
- With managed holder certificates, you create a Holder root CA certificate and MATTR VII manages the rest. Wallet attestation signers (and their certificates) are automatically provisioned when needed to sign wallet attestation JWTs.
- With unmanaged holder certificates, you manage the entire lifecycle. You generate the Holder root CA certificate, create wallet attestation signers, use the returned CSR to obtain signed certificates from your root CA, and upload them to MATTR VII. See unmanaged certificates for more details.
Creating a Holder root CA certificate
Create a managed Holder root CA
Make a request of the following structure to create a managed Holder root CA:
POST /v1/holder/certificates/ca{
"commonName": "Example Holder root CA",
"country": "NZ"
}commonName: This optional parameter indicates the common name of the Holder root CA certificate. When specified, the value must be a validPrintableStringand cannot be an empty string. If not provided, the value defaults to{tenantDomain} Wallet Attestation.country: This optional parameter indicates the holder country. When specified, the value must be a valid country code as per ISO 3166-1.
The response will include an id property, which is a unique identifier for the Holder root CA. This identifier is used in subsequent operations to reference this Holder root CA.
The Holder root CA is always created as inactive. You will activate it in the next step.
Activate the Holder root CA
Make a request of the following structure to update the Holder root CA and activate it:
PUT /v1/holder/certificates/ca/{certificateId}certificateId: Replace with theidvalue obtained when you created the Holder root CA.
{
"active": true
}Setting active: true deactivates any previously active Holder root CA for the tenant (only one can
be active at a time).
Once a managed Holder root CA is activated, MATTR VII automatically provisions wallet attestation signers on demand when the first wallet attestation request is made. No additional configuration is required.
How would you rate this page?
Last updated on