Add X.509 thumbprint client identifier scheme #430
Conversation
Add x509_x5t, copied text from other client identifier schemes where applicable.
There was a problem hiding this comment.
If the Wallet can establish trust in the Client Identifier authenticated through the certificate, e.g. because the leaf X.509 certificate is signed by a trusted X.509 certificate.
is missing the latter part of the typical 'If [condition], then [result]' construction.
x509_x5t is probably not a good name #320 (comment)
and I had thought we had "agreed to drop x509_san_uri" #320 (comment)
Changed to x509_hash and removed x509_san_uri and updated relevant examples to x509_san_dns (hopefully correctly) |
Sakurann
requested review from
Sakurann,
awoie,
bc-pi,
c2bo,
danielfett,
hlozi,
jogu,
leecam,
paulbastian,
tlodderstedt and
tplooker
clarify x509_hash definition Co-authored-by: Christian Bormann <8774236+c2bo@users.noreply.github.com>
Remove unnecessary sentence
did you search for all occurrences of |
|
examples/response/jwt_vp.json contains x509_san_uri in the example (and is used in the spec) -> would need to change that |
yes, that's one one would find when search for all occurrences of x509_san_dns in the repo |
Clarify that it's the hash of the certificate. Co-authored-by: Christian Bormann <8774236+c2bo@users.noreply.github.com>
Clarify it's the hash of the cert and don't use thumbprint as a descriptor.
Change example to not use san_uri
Clarify the language of trust chain validation Co-authored-by: Paul Bastian <paul.bastian@posteo.de>
Implements #320 : add x509_x5t, copied text from other client identifier schemes where applicable.