search

eu-digital-green-certificates / dgca-verifier-service

Repository for the dgca verifier service.
Apache License 2.0
17 stars 21 forks source link

Is there a currently publically available app / tool to verify real certificates issued by effectively connected participating countries? #54

Open kristijx opened 3 years ago

kristijx commented 3 years ago

Is there a currently publically available app/tool to verify real certificates issued by effectively connected participating countries?

I was issued a vaccination EUDCC by the Republic of Lithuania a few days ago (generated as a PDF on the Lithuanian eHealth). Since we don't have an app yet here in Lithuania, and out of pure curiosity, I decided to look for ways to verify my EUDCC.

  1. I've built dgca-verifier-app-android and dgca-wallet-app-android (https://github.com/eu-digital-green-certificates/dgca-wallet-app-android) with Android Studio (Bumblebee 2021.1.1 Canary 2) and tried to run the app on a hardware device: my Android phone Samsung Galaxy S9:

Screenshot_20210611-055607_Settings Screenshot_20210611-055620_Settings

The Verifier App returns: "Invalid. Reason for invalidity: Verification failed." Additional run information from Android Studio here

The Wallet App asked for a TAN code which is not presented to me in a PDF certificate. If I enter a random one and then try to save the certificate, it returns: Not found.

  1. I also tried to scan the certificate with Android Demo App published here (of course, after first downloading the trust list):

Screenshot_20210611-062335_Health Cert Verification

(COSE verified: failed)

  1. I also tried verifying my certificate with the Swiss COVID Certificate and COVID Certificate checks apps. Switzerland’s COVID certificate seems to be implemented to be compatible with the EU Digital COVID Certificate (source):

3.1. COVID Certificate shows an error: "Certificate with invalid signature; Validity in Switzerland -" 3.2. COVID Certificate Check: "COVID Certificate Invalid -- the certificate does not have a valid signature; does not meet Switzerland's validity criteria"

Is it how things are supposed to work at the current stage even if Lithuania claims to be effectively connected to the gateway? I just want to make sure I have a valid certificate issued to me. And apologies in advance, if I'm missing something about the timeline of the system(s) going live across Europe.

Thanks!