Skip to content

add note on verifier x509 certificate profiles #262

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 11, 2025
Merged

add note on verifier x509 certificate profiles #262

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
704da85
add note on verifier x509 certificate profiles
c2bo Sep 8, 2025
b36e329
Apply suggestions from Oliver's review
c2bo Sep 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions openid4vc-high-assurance-interoperability-profile-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,8 @@ The following requirements apply to OpenID4VP, irrespective of the flow and Cred

Additional requirements for OpenID4VP are defined in (#oid4vp-redirects), (#oid4vp-dc-api) and (#oid4vp-credential-formats).

Note that while this document does not define profiles for X.509 certificates used in Verifier authentication (e.g., with the `x509_hash` Client Identifier Prefix), ecosystems are encouraged to define their own certificate issuing policies and certificate profiles. Such policies and profiles MAY specify how information in the certificate corresponds to information in the presentation flows. For example, an ecosystem might require that the Wallet verifies that the `redirect_uri`, `response_uri`, `origin`, or `expected_origin` request parameters match with information contained in the Verifier's end-entity certificate (e.g., its DNS name).

## OpenID for Verifiable Presentations via Redirects {#oid4vp-redirects}

The following requirements apply to OpenID4VP via redirects, unless specified otherwise:
Expand Down Expand Up @@ -463,6 +465,7 @@ The technology described in this specification was made available from contribut

-04

* Add note on verifier certificate profiling
* Added support for credentials without cryptographic holder binding
* mandate support for aki trusted_authorities method
* remove presentation exchange reference since it was removed in openid4vp
Expand Down