Improve consistency checks and warning messages for certificates

[ndegendogo]

Avoid duplicates

• [ ] This enhancement request has not already been raised before
• [ ] Enhancement request is specific for iOS only, for general issues / questions that apply to iOS and Android please raise them in CWA-Wishlist
• [ ] If you are proposing a new feature, please do so in CWA-Wishlist

Current Implementation

If the date of issuance of the 3rd certificate for a person is before the second cert, this is unexpected. However, cwa ignores that silently, and sets the latest cert of a group as current. See here for an example.

Suggested Enhancement

Implement more consistency checks on the grouped certificates, and show a warning message to the user (please only a warning, not an error).

some kind of message like "date of 3rd vacc. cannnot be before the date of 2nd cert." would have helped

Expected Benefits

• more transparency of the grouping of certificates for the user
• make it easier for the user to detect typos and similar issues in their certificates

Note: the described behavior was seen on iOS. Not sure about the Android implementation. Feel free to move this ticket if appropriate.

---

Internal Tracking ID: EXPOSUREAPP-11740

[dsarkar]

@ndegendogo Although the idea is nice I am not sure if that is the right approach. Maybe it's trying to fix things on the wrong end. Maybe some consistency check should be implemented rather at the issuer. Anyway, of course, your suggestion will be forwarded!

Best wishes, DS

[svengabr]

Internal Tracking ID: EXPOSUREAPP-11740

[ndegendogo]

Maybe some consistency check should be implemented rather at the issuer

Who is the issuer then?

• A central instance like the RKI server that signs the certificates? This is a very good idea - but does it even see the other certificates when it signs a new one? Moreover: does the server even see the full payload of a certificate, or is (for reasons of privacy) only a hash-to-be-signed transmitted?
• The decentral issuers like pharmacies or vaccination centers? Well - of course it is desirable that they issue good and consistent certificates - but reality shows that this is not so easy to achieve. The idea of this wishlist item is to support them. Maybe an alternative could be to implement and provide a central "checking service"?
• and, in any case - checks across certificates of a group can only be performed where all these certificates are available at the same time - that is cwa and CovPass