Query from the certification team: SD-JWT VC + VCI + HAIP - iss / vct claim validation

[jogu]

To confirm that we are implementing tests correctly, can the WG please confirm:

1. The iss claim in an SD-JWT VC is completely optional
2. If the iss claim is present in an SD-JWT VC, it must be a https url, but there is no requirement that the url provided returns any kind of valid document, it's not even required to have a DNS entry?
3. The vct claim is mandatory in an SD-JWT VC
4. The vct claim can have any string value, which may or may not be a https url. If it is a https url, there is no requirement that url provided returns any kind of valid document, it's not even required to have a DNS entry?

Thank you!

[jogu]

Additional for '2', if we are correct, I don't actually understand the reason why we require it to be a https url if we don't define any situation where the iss claim is actually processed by the verifier/wallet.

[awoie]

Additional for '2', if we are correct, I don't actually understand the reason why we require it to be a https url if we don't define any situation where the iss claim is actually processed by the verifier/wallet.

It shouldn't be required to be an HTTPS URL.

[jogu]

some discussion here about '2': #165 (comment)

[jogu]

Discussed on this morning's WG call: Agreed we don't need the https url requirement and can remove it from the spec. The iss claim is close to meaningless when using x5c so perhaps we should say that x5c is the same to establish the issuer and trust.