Skip to main content

Generate CSR

POST 
/v2/config/digital-wallet/openid/key-management/keys/:keyId/csr

Generates a Certificate Signing Request (CSR) for a key. Send the CSR to a Certificate Authority (CA), then upload the signed certificate chain with the upload certificate chain operation. For development and testing, the create test certificate operation gives the key a certificate of the built-in test CA in one call.

This operation is for keys in a key store with the capability csr: local, vault, gcp-kms, aws-kms, azure-key-vault and dpod. The key store signs the CSR. A key of a QTSP (csc) gets its certificate from the QTSP.

The body is a CsrRequest. Give the preset of the purpose of the key (the list certificate presets operation): a member that the request does not give takes the prefill and the fixed values of the preset. A value that is not the fixed value of the preset gives the warning preset-override, not an error. Without a preset, the request is custom. Use one key for each purpose: a CSR with another preset than the certificate chain of the key gives the warning purpose-reuse.

The wallet checks the request before it makes the CSR, and an invalid value gives 400 with <field>: <problem>. <field> is the path of the member, with the index of a list item (for example subjectAltName.dns.0). The checks:

  • subject.country is an ISO 3166-1 alpha-2 code. In an identifier, Greece is EL.
  • For a preset with etsiSyntax true: subject.organizationIdentifier has the syntax of ETSI EN 319 412-1 clause 5.1.4 (for example VATSE-556677889901), and subject.serialNumber the syntax of clause 5.1.3 (for example TINSE-1234567890).
  • The format of each DNS name, URI, email address and telephone number of subjectAltName.
  • One value for each attribute of the subject, and no emailAddress in the subject.
  • keyUsage.values has no keyEncipherment and no dataEncipherment (an EC key, RFC 5480 section 3), and no CA key usage.
  • qcStatements.qcPsb: countryOfLegislation is an ISO 3166-1 alpha-2 code, or EU for European Union law (ETSI TS 119 412-6 PSB-8.3-05). authSourceIdentification and legislationIdentification have at most 2048 characters and no control character. A QcPSB statement has all three values, also without a preset.
  • The fields that the preset requires (required of the preset).

Examples of the error texts: keyUsage.values: keyEncipherment is not allowed for an EC key (RFC 5480 section 3), subject.country: not an ISO 3166-1 alpha-2 country code (two upper-case letters, for example SE), subject.commonName: required by the preset custom, subjectAltName: one of uri, email, phone is required by the preset wrpac-legal, subject.emailAddress: not allowed in the subject; put the email address in subjectAltName.email, qcStatements.qcPsb.authSourceIdentification: required by the preset pub-eaa-provider.

The subject is encoded in X.500 order, from the country to the common name. The extensions of the CSR are a request: the CA decides what goes into the certificate. The wallet stores each CSR with its preset and its request (csrId). The upload certificate chain operation checks the issued certificate against the preset of the newest CSR of the key.

The operation also accepts the flat form (CsrFlatRequest): the subject fields at the top level, without a preset. A body with members of the two forms gives 400 (The body has members of the CsrRequest form and of the old flat CSR fields: use one form.).

Request​

Path Parameters

    keyId stringrequired

    Unique identifier of the key

Body

required

The preset and the values of the CSR (CsrRequest), or the flat form (CsrFlatRequest). Give the subject values that your Certificate Authority registered for your organisation.

    oneOf
    preset stringnullable

    Possible values: [wrpac-legal, wrpac-natural, pid-provider, wallet-provider, wallet-status-list-signer, eaa-provider, qeaa-provider, pub-eaa-provider, mdoc-document-signer, mdoc-reader, mdoc-status-list-signer, status-list-signer, credential-issuer, request-signer-san-dns, custom, null]

    The id of a preset of the list certificate presets operation. An unknown id gives 400 (preset: unknown preset; use one of <the preset ids>).

    subject object

    The subject of the certificate. Each attribute has one value. An attribute that the request does not give takes the prefill of the preset. null is no value. The wallet encodes the subject in X.500 order, from the country to the common name. The subject has no emailAddress: put the email address in subjectAltName.email.

    country stringnullable

    Country (C), an ISO 3166-1 alpha-2 code in upper case. In an identifier, Greece is EL. For an mdoc Document Signer, the country of the issuing authority (the mdoc issuing_country) and the country of the IACA root.

    stateOrProvince stringnullable

    State or province (ST), at most 128 characters. For an mdoc Document Signer, the issuing_jurisdiction when the IACA root has one.

    locality stringnullable

    Locality (L), at most 128 characters.

    organization stringnullable

    Organisation (O), the registered name of the organisation, at most 256 characters.

    organizationalUnit stringnullable

    Organisational unit (OU), at most 64 characters. Some Certificate Authorities put the identifier that they gave the organisation here.

    commonName stringnullable

    Common name (CN), at most 64 characters. Use the name of the organisation or of the service. Every preset requires it.

    organizationIdentifier stringnullable

    Organisation identifier, at most 128 characters. For a preset with etsiSyntax true, it has the syntax of ETSI EN 319 412-1 clause 5.1.4, for example VATSE-556677889901 (the type VAT, NTR, PSD, LEI, EOR or EXC, the country code, - and the identifier).

    serialNumber stringnullable

    Serial number of a natural person, at most 64 characters of an ASN.1 PrintableString. For a preset with etsiSyntax true, it has the syntax of ETSI EN 319 412-1 clause 5.1.3, for example TINSE-1234567890 (the type PAS, IDC, PNO, TIN or EID, the country code, - and the identifier).

    givenName stringnullable

    Given name of a natural person, at most 128 characters.

    surname stringnullable

    Surname of a natural person, at most 128 characters.

    subjectAltName object

    The subject alternative names of the certificate, at most 50 values of each type. A type that the request does not give takes the prefill of the preset. The wallet checks the format of each value and refuses a repeated value.

    dns string[]nullable

    DNS names (dNSName). A host name, without an IP address. The first label can be *. Give an international name in the A-label form. The x509_san_dns client identifier prefix of OpenID4VP needs the host of the verifier here.

    uri string[]nullable

    URIs (uniformResourceIdentifier). An absolute URI with a scheme, at most 2048 characters, for example the support website of a relying party access certificate.

    email string[]nullable

    Email addresses (rfc822Name), in the form local-part@domain.

    phone string[]nullable

    Telephone numbers in the international form of ITU-T E.123, for example +46 8 123 456 78.

    keyUsage objectnullable

    The key usage extension. The keys are EC keys, so keyEncipherment and dataEncipherment are not allowed (RFC 5480 section 3). A leaf certificate has no CA key usage (keyCertSign, cRLSign).

    values string[]required

    Possible values: [digitalSignature, nonRepudiation, keyAgreement], >= 1

    The key usages, each one time.

    critical booleannullable

    true: the extension is critical. Without a value, the criticality of the preset applies (true when the preset fixes none).

    extendedKeyUsage objectnullable

    The extended key usage extension.

    values string[]required

    Possible values: >= 1

    The key purposes as OIDs in dotted form, at most 20, each one time. For example 1.0.18013.5.1.2 (ISO/IEC 18013-5 mdoc Document Signer), 1.0.18013.5.1.6 (ISO/IEC 18013-5 reader authentication) or 1.3.6.1.5.5.7.3.45 (Token Status List signer).

    critical booleannullable

    true: the extension is critical. Without a value, the criticality of the preset applies (false when the preset fixes none).

    certificatePolicies string[]nullable

    The certificate policies as OIDs in dotted form, at most 20, each one time. For example 0.4.0.194118.1.2 (NCP-l-eudiwrp, ETSI TS 119 411-8).

    qcStatements objectnullable

    The QC statements of ETSI EN 319 412-5 and the QcPSB statement of ETSI TS 119 412-6. A member that the request does not give takes the value of the preset. null or false is no statement.

    qcType stringnullable

    The QcType, one OID in dotted form (QcType has one value). For example 0.4.0.194126.1.1 (PID provider), 0.4.0.194126.1.2 (wallet provider) or 0.4.0.1862.1.6.2 (electronic seal).

    qcCompliance booleannullable

    true: the QcCompliance statement (0.4.0.1862.1.1), an EU qualified certificate.

    qcSscd booleannullable

    true: the QcSSCD statement (0.4.0.1862.1.4), the private key is in a qualified signature or seal creation device (QSCD).

    qcPsb objectnullable

    The QcPSB statement (0.4.0.194126.1.3) of a PuB-EAA provider, with all three values. null is no QcPSB statement; with the preset pub-eaa-provider, null gives the warning preset-override.

    countryOfLegislation stringrequired

    The country of the law, an ISO 3166-1 alpha-2 code, or EU for European Union law (ETSI TS 119 412-6 PSB-8.3-05). A PrintableString of two characters in the certificate.

    authSourceIdentification stringrequired

    The unambiguous identification of the authentic source (PSB-8.3-04), for example a list of relative distinguished names. At most 2048 characters, no control character.

    legislationIdentification stringrequired

    The identification of the law under which the public sector body is responsible for the authentic source (PSB-8.3-02). Use a URI (RFC 3986) when one exists (PSB-8.3-03). At most 2048 characters, no control character.

Responses​

The wallet generated and stored the CSR.

Response Headers
    Schema
      csr string

      Certificate Signing Request in PEM format.

      csrId string

      Unique identifier of the stored CSR.

      preset stringnullable

      The preset of the request. null when the request has no preset (also for the flat form).

      warnings object[]required

      The warnings of the request (preset-override, purpose-reuse). An empty list when there is none.

    • Array [
      • code string

      Possible values: [test-certificate, preset-override, profile-mismatch, purpose-reuse]

      The kind of warning. test-certificate, the answer issues or shows a certificate of the built-in test CA: the text is always the text of the example. preset-override, a value of the request is not the fixed value of the preset; the request value applies. profile-mismatch, the certificate does not agree with the preset of the key. purpose-reuse, the certificate chain of the key has a preset, and the new CSR, test certificate or chain upload has another preset: use one key for each purpose.

      message string

      The text of the warning, for a person.

    • ]
    Loading...
    Last updated on