How to create issuer certificates
Overview
An IACA (Issuing Authority Certificate Authority) is a X.509 based certificate used to identify an mDoc issuer and verify the mDocs they issue.
MATTR VII supports both managed and unmanaged issuer certificates, allowing issuers to choose how they want to manage their certificate infrastructure:
- Managed IACAs : MATTR VII automatically creates, stores, and manages the lifecycle of the IACA, including the private key, as well as signing and managing any Document Signer Certificates (DSCs) that are required to sign mDocs.
- Unmanaged (external) IACAs : The customer creates and manages their own IACA, including the private key, and registers it with MATTR VII. They are then responsible for signing and managing any Document Signer Certificates (DSCs) and Status List Signer Certificates (SLSCs) that are required to sign mDocs and Status lists.
Creating an IACA
- Log into the MATTR Portal.
- In the navigation panel on the left-hand side, expand the Platform Management menu.
- Select Certificates.
- Select the Create new button.
- Use the Type radio button to select IACA - Issuing Authority Certificate Authority.
- Use the Management method radio button to select MATTR managed.
- Use the Country dropdown list to select an issuing country.
- Select the Create button to create the IACA certificate.
The IACA is created as inactive by default. - Use the Status radio button to select Active.
- Select the Update button to activate the IACA certificate.
Usage
Signing the mDoc
Once the IACA is activated, it can be used to sign mDocs. MATTR VII will automatically select a valid Document Signer based on the certificate selection logic.
If there is no Document Signer that meets the selection criteria, MATTR VII will automatically create a suitable one. For example, if you attempt to sign an mDoc with an expiry date later than the notAfter date of all available Document Signers, MATTR VII will create a new Document Signer that can accommodate the requested expiry date.
Signing the Status List Token
If the issued mDoc is configured as revocable, it will be associated with a Status List. MATTR VII will then automatically attempt to sign a Status List Token for that Status List using an appropriate Status List Signer. The Status List Signer is selected according to the following criteria:
- The Status List Signer must be active.
- The Status List Signer must reference the same IACA as the Document Signer used to sign the mDoc.
If there is no Status List Signer that meets the selection criteria, MATTR VII will automatically create a suitable one. For example, if you attempt to sign an mDoc using a Document Signer that was created with an IACA that does not have an active Status List Signer, MATTR VII will create a new Status List Signer that meets the criteria.
IACA Distribution
IACAs can be distributed via different mechanisms, for example using a Verified Issuer Certificate Authority List (VICAL).
Alternatively, all active IACAs on a given tenant can be retrieved by:
- Making a GET request to the issuer's
/.well-known/openid-credential-issuerendpoint. - Inspecting the
mdoc_iacas_uriproperty in the response and obtaining the IACA distribution URL. It will be structured as follows:https://{tenant-subdomain}/core/v1/openid/iacas. - Making a GET request to the IACA distribution URL. This would return a list of all active IACAs for that tenant.
How would you rate this page?
Last updated on