Trusted issuers

Before your verifier accepts a credential, it needs to know that the credential comes from an issuer it trusts. For mDocs, trust in an issuer is established by validating the issuer's Issuing Authority Certificate Authority (IACA) certificate. This page explains why defining your trusted issuers matters for in-person verification, and how the Verifier Mobile SDK manages the list of issuers your application trusts.

Why defining trusted issuers matters

Every mDoc is signed using a certificate chain, also known as a chain of trust. To verify a presented mDoc, your application must confirm that this chain leads back to a trusted root certificate, called an IACA. If the chain does not resolve to an issuer you trust, verification fails.

In-person verification makes this decision especially important because it can run offline. The SDK validates presented credentials against the trusted issuer certificates stored on the device, with no call to a backend at verification time. This means the set of issuers you configure directly determines which credentials your application can accept in the field. Configure it based on the jurisdictions and credential types your use case supports (for example, the states or territories whose mDLs you need to verify).

You obtain each issuer's IACA certificate from the issuer as part of onboarding. MATTR maintains managed trust lists of verified IACA certificates for mDL issuers across multiple jurisdictions, which reduces the burden of tracking and rotating these certificates yourself. For background on IACA certificates and where they sit in the issuance trust model, see Issuing Authority Certificate Authority (IACA).

How the Verifier Mobile SDK manages trusted issuers

The Verifier Mobile SDK maintains a local trusted issuer list on the device. Only credentials whose IACA certificates are in this list pass validation. Credentials from any other issuer are rejected. The SDK persists this list between launches, so a common pattern is to register your certificates once on first launch and then let the SDK reuse them.

The SDK exposes two methods for managing this list:

• addTrustedIssuerCertificates adds one or more IACA certificates to the trusted issuer list.
• getTrustedIssuerCertificates returns the certificates currently trusted, which lets you check whether your certificates are already registered before adding them.

Add trusted issuer certificates

Add the IACA certificates of the issuers you want your application to trust. Pass the IACA certificate of each issuer you want to accept credentials from.

try await mobileCredentialVerifier.addTrustedIssuerCertificates(certificates: [certificate])

Register certificates on first launch

Because the SDK persists trusted certificates between launches, check the existing list before adding, so you only register your certificates once. This example registers a single issuer certificate the first time the application runs:

const certificates = await getTrustedIssuerCertificates();
if (certificates.length === 0) {
  await addTrustedIssuerCertificates([issuerCertificate]);
}

SDK reference

For the exact method signatures on each platform, see the Verifier Mobile SDK reference:

• iOS SDK reference
• Android SDK reference
• React Native SDK reference

Next steps

• Follow the in-person tutorial to see trusted issuer configuration in the context of a complete verifier application.
• Learn how to handle verification results, including trust-related result states.