Test eIDAS Certificate Chain

June 12, 2024 ยท View on GitHub

Script to create a certificate chain with self-signed CA where the client certificate is compliant with the standard.

How to use

Run the container and mount an existing local output folder

   docker run --mount type=bind,source="$(pwd)"/output,target=/out quay.io/fiware/eidas:latest

The subject of the client certificate can be configured by mounting a config file as followed

    docker run --mount type=bind,source="$(pwd)"/config,target=/config/config quay.io/fiware/eidas:latest

Requirements

Subject

The subject must contain at least

  • countryName (the country in which the subject (legal person) is established)
  • organizationName (the full registered name of the subject (legal person))
  • organizationIdentifier
  • commonName (name commonly used by the subject to represent itself)

The organizationIdentifier must be generated using the following schema based on ETSI EN 319 412-1:

When the legal person semantics identifier is included, any present organizationIdentifier attribute in the subject field shall contain information using the following structure in the presented order:

    3 character legal person identity type reference
    2 character ISO 3166 [2] country code
    hyphen-minus "-" (0x2D (ASCII), U+002D (UTF-8)) and
    identifier (according to country and identity type reference)

The three initial characters shall have one of the following defined values:

    VAT for identification based on a national value added tax identification number.
    NTR for identification based on an identifier from a national trade register.
    PSD for identification based on the national authorization number of a payment service provider under Payments Services Directive (EU) 2015/2366 [i.13]. This shall use the extended structure as defined in ETSI TS 119 495 [3], clause 5.2.1.
    LEI for a global Legal Entity Identifier as specified in ISO 17442 [4]. The 2 character ISO 3166 [2] country code shall be set to 'XG'.
    Two characters according to local definition within the specified country and name registration authority, identifying a national scheme that is considered appropriate for national and European level, followed by the character ":" (colon).

Other initial character sequences are reserved for future amendments of the present document. In case "VAT" legal person identity type reference is used in combination with the "EU" transnational country code, the identifier value should comply with Council Directive 2006/112/EC [i.12], article 215.

CRL Distribution Points

As defined in chapter 4.3.11 of etsi if CRL is supported by the issuing CA, the CRL distribution point extension shall be present in certificates. This url can be configured via the CRL_URI config parameter.

QcStatement

Certificates require fields defined in etsi to claim compliance with the EU legislation. The standard is based on RFC3739.

Two statements are mandatory:

  • esi4-qcStatement-1 ( OID 0.4.0.1862.1.1 )

    This statement is a statement by the issuer that this certificate is issued as a Qualified Certificate according Annex I and II of the Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures, as implemented in the law of the country specified in the issuer field of this certificate.

  • esi4-qcStatement-5 ( OID 0.4.0.1862.1.5 )

    This statement holds URLs to PKI Disclosure Statements (PDS) in accordance with Annex A of ETSI EN 319 411-1.

Additionally esi4-qcStatement-6 ( OID 0.4.0.1862.1.6 ) is used to define the role/usage of the certificate (signatures, seals, web auth).

The values can be configured in the config file

Alternatives considered