Trust
Nothing is trusted by default. You decide, with two lists.
Who can issue: the issuer list
Section titled “Who can issue: the issuer list”A verifier accepts a credential only if it was signed under an issuer certificate it trusts (an IACA, the issuer’s root certificate). You give the SDK either the certificates themselves or a signed list of them, a VICAL, which also says which document types each issuer may sign.
- A driving licence signed by an issuer you trust for driving licences: accepted.
- The same issuer signing an Emirates ID when the list only allows driving licences: rejected.
For pilots the demo issuer certificate is enough. For production you load the real authority’s certificate or list.
Who can ask: the reader list
Section titled “Who can ask: the reader list”A wallet checks who is asking before it shows the consent screen. Verifiers sign their requests with a reader certificate; a wallet that trusts it (through a signed RICAL list or the certificate itself) names the verifier: “DriveNow”, “Hello Mobile”, “Verify”. Unknown verifiers are shown as unknown, and the holder can still decline.
To have your name appear in the demo wallet, send us your reader certificate; production wallets have their own procedure.
Where trust lives
Section titled “Where trust lives”| Issuer list | Reader list | |
|---|---|---|
| Held by | the verifier | the wallet |
| Answers | “is this credential genuine?” | “who is asking me?” |
| Native SDK | TrustConfig.issuerVical / issuerRootsPem |
TrustConfig.readerRical / readerRootsPem |
| Web (Verify API) | configured on your tenant | the API’s certificate, or your own if you send us one |
Revocation
Section titled “Revocation”Issuers can publish a status list. When a credential points at one, the verifier checks it and, when offline, uses the last known answer and says how old it is. Credentials without a status reference are reported as such, so you can decide what to do.