How to get access to Document Signing Certificates ?

lovasoa commented 3 years ago

Hello,

I wrote an opensource privacy-preserving verification application for the certificates that are currently being emitted in France (in the 2D-DOC format): https://sanipasse.fr

I would like to add support for digital green certificates, but there is one point in the implementation that is still not clear to me: where do I get access to the public keys needed to check the certificates ? Are they to be retrieved from my national backend ? I am interested by the french national backend in particular. @adelourme, maybe you can point me to resources about it ? Or should I get them from the secretariat mentioned in Volume 1 ?

The specification states that

there are no confidentiality requirements for the lists of CSCAs and DSCs.

However, I cannot seem to get a hold on the these lists.

If this is not the right place for this kind of question, or if there is something I misunderstood, I'm sorry (and I would love if you could point me in the right direction).

@M3kH, @AlexConnat, I'm tagging you so that you can follow the discussion.

M3kH commented 3 years ago

For my understanding, each nation should have dgc-gateway and they should be sync trough an European one, would be interesting to know if the European one can be public accessible.

I did find some location that currently seems to point to a temporary test gateway:

jbx1 commented 3 years ago

Did you discover which is the right official URL for the central European one?

I am also interested in getting the verification KIDs and certificates. The one at https://dgca-verifier-service.cfapps.eu10.hana.ondemand.com seems to have missing ones.

lovasoa commented 3 years ago

Yes, https://sanipasse.fr does now support DGC certificate verification. And I set up a github action that automatically updates the certificates by connecting to the french gateway and publishes it.

The automatically updated list of certificates: https://github.com/lovasoa/sanipasse/blob/master/src/assets/Digital_Green_Certificate_Signing_Keys.json
The script that connects to the french gateway: https://github.com/lovasoa/sanipasse/blob/master/fetch_certificates.js (you can get the TACV_TOKEN by decompiling the french tousanticovid-verif app)
The austrian gateway, from which data is freely available without an authentication token: https://greencheck.gv.at/api/masterdata
Discussion (in french), including links to connect to connect to and get certificates from the austrian gateway: https://github.com/lovasoa/sanipasse/pull/10#issuecomment-869241159

jbx1 commented 3 years ago

Thanks for all the details. So there is no official central DGCG yet as far as you know? Only the national backend ones.

dslmeinte commented 3 years ago

Have a look at this doc: https://github.com/eu-digital-green-certificates/dgc-participating-countries/blob/main/gateway/OnboardingChecklist.md (@SchulzeStTSI : that's the correct one, right?)

jbx1 commented 3 years ago

@dslmeinte Thanks for that. However, it seems that info is for national backends to connect and be able to upload their own certificates etc. (and the links don't seem to point to anywhere).

I am only interested in having the up to date KID-certificate pairs of all countries to be able to verify digital certificates offline (irrespective of country).

daniel-eder commented 3 years ago

This issue slipped my notice - the DGCG only acts as an "exchange" for the national backends, there is no direct access of validation services to the DGCG. Similarly, there is no global or eu-wide list of certificates, rather each member state as sovereignty over the trustlist their national backend publishes.

To validate a DCC, you need to get access to your member state's trustlist.

See https://github.com/eu-digital-green-certificates/dgc-participating-countries/issues/10 for a related discussion.

lovasoa commented 3 years ago

For anyone who would stumble on this issue now: automatic fetching of the certificates from the french backend is now implemented in sanipasse:

philios33 commented 3 years ago

Perhaps a silly question but...

I'm wondering about the sovereignty thing. Doesn't this architecture open the door for, (e.g.) Romania to dis-trust France if it wanted to and remove all FR certificates from its backend? They would of course be well within their sovereign rights to do so, but this kind of thing makes a big difference to how developers of validating software are programming the synchronization of their apps trust stores.

From a developers perspective, we want to know where should we get the public keys from to validate the VCCs? (Not where can we)

lovasoa commented 3 years ago

You should get it from the state from which your application will be used. If you want your application to work everywhere, you will have to connect to all backends individually.