Managing trust
Building a digital credentials ecosystem requires identifying the points at which trust must be established. Two core areas of trust are:
- Credential status trust: It is a credential that is validly issued and within its validity dates. For more information, see Enabling status information.
- Entity trust: It is an entity trusted to perform a specific role or action. For example, is it a trusted issuer of mobile driver’s licenses? For more information, see the subsequent sections.
Entity trust is currently supported for the following configurations:
|
Credential format |
Entity types |
Identification method |
|---|---|---|
|
SD-JWT |
Issuer and credential status provider |
iss and x5c claims, scoped by the vct claim |
|
mdoc |
Issuer |
x5c header, scoped by doctype |
When you configure certificates, they must be the root certificates that is used to verify credentials. These certificates must have signed the certificate chain that appears in the x5c section of the presented credential.
If you specify a credential document type, the entity is trusted only for that document type (such as
docType for an mdoc or vct for an SD-JWT).
Note: If you do not specify a document type, the entity is trusted for all document types, and this is not recommended for production use.
To verify SD-JWT or mdoc credentials, you must explicitly configure trusted entities. If you use OID4VP, you may bypass trusted issuer and credential status provider checks. For more information, see API Specification.