Trusted issuers

Before your tenant accepts a credential presented remotely, it needs to know that the credential comes from an issuer it trusts. For mDocs, trust in an issuer is established by validating the issuer's Issuing Authority Certificate Authority (IACA) certificate. This page explains why defining your trusted issuers matters for remote verification, and how MATTR VII manages the list of issuers your tenant trusts.

Why defining trusted issuers matters

Every mDoc is signed using a certificate chain, also known as a chain of trust. During remote verification, MATTR VII validates that a presented credential's signature chains back to a trusted root certificate, called an IACA. If the chain does not resolve to an issuer your tenant trusts, verification fails.

The set of issuers you configure directly determines which credentials your application can accept. Configure it based on the jurisdictions and credential types your use case supports (for example, the states or territories whose mDLs you need to verify). The underlying chain-of-trust model is the same across mDoc credential types, though the terminology differs by credential family.

For the broader picture of how trust lists work across a network (trusted issuers, trusted readers, and trusted wallets), see Trusted Lists in the Digital Trust Service section.

How trust works

1. Each issuer publishes root certificates. For mDLs, these are Issuing Authority Certificate Authority (IACA) roots, published at the state, territory, or national level depending on the jurisdiction. Other mDoc credential types follow the same chain-of-trust model with their own issuer certificate authorities.
2. Your tenant is configured with a list of trusted issuer certificates.
3. During verification, MATTR VII validates that the credential's signature chains back to a trusted root.
4. If the chain is valid, the credential is trusted. If not, verification fails.

Configuring trusted issuers on MATTR VII

For remote verification, trusted issuers are managed centrally on your MATTR VII tenant rather than on a device. You register each issuer's IACA certificate on your tenant, and MATTR VII applies that trust list to every remote verification request your applications make.

You obtain each issuer's IACA certificate from the issuer as part of onboarding. For background on IACA certificates and where they sit in the issuance trust model, see Issuing Authority Certificate Authority (IACA).

Register the issuer's IACA certificate using either the MATTR Portal or the Trusted Issuers API.

Managed trust lists from MATTR

Maintaining an up-to-date list of issuer certificates across multiple jurisdictions and credential types is operationally complex. Certificates rotate, new issuers come online, and different authorities may publish certificates independently.

MATTR provides managed trust lists that include verified IACA certificates for mDL issuers:

• Australia: all state and territory issuers.
• United States: state-level issuers participating in mDL programs.
• Additional jurisdictions as they come online.

These managed lists are kept current by MATTR, reducing your operational burden and ensuring your application stays compatible as new issuers join the ecosystem. For non-mDL mDoc credentials, you configure the issuer's certificates directly through the same trust APIs. You can also consume an external trust registry through the Digital Trust Service rather than maintaining the list yourself.

Next steps

• Configure how wallets trust your requests in Signing verification requests.
• Learn how to handle verification results for your channel: web app or mobile app.