You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Test issuance and usage of X509Credential backed by a G4 certificate #4589
Status of testing X509Credential on a G4 certificate. Real CIBG G4 test server certificates require a request (form UZ39.05 plus a 4096-bit PKCS#10, sent to the UZI-register); that request is being prepared. Everything that can be verified without one is done.
Verified
Real production G4 chain and CRLs.Staat der Nederlanden - G4 Root Priv G-TLS - 2024 → G4 Intm Priv G-TLS SYS - 2024 → UZI Server - G4 PKIo Priv G-TLS SYS - 2024 and - 2025 (from cert.pkioverheid.nl, all RSASSA-PSS/SHA-512, salt 0x40, RSA 4096) verify with Go's crypto/x509. The PSS-signed root and intermediate CRLs from crl.pkioverheid.nl parse and verify with RevocationList.CheckSignatureFrom, which is what pki/validator.go uses. The end-entity CRL URL from the CIBG G4 profile document (csp.uzi-register.nl/cdp/uzi_server-g4_pkio_priv_g-tls_sys-2024.crl) still returns 404, so no end-entity certificates seem to have been issued yet.
Note: there are already two UZI server TSP CAs under G4. The 2025 one has organizationIdentifier=NTRNL-50000535 back in its subject. Trust policies need one fingerprint per TSP CA:
2024: did:x509:0:sha256:vzLz0CQ4GMpgjboDI2aaEDA9mrKoEGiv_jc1ANaUaHorevoked on 29 October 2025 (on the intermediate's CRL; the 2024 ZOVAR Server CA was revoked the same day). Do not pin it.
Issuance with go-didx509-toolkit (:main image) on a synthetic chain that follows the CIBG G4 server profile (RSA 4096, RSASSA-PSS/SHA-512, subject C/ST/L/O/serialNumber/CN, SAN dNSName + UZI otherName 2.5.5.5 + permanentIdentifier, EKU serverAuth+clientAuth, G4 policy OIDs): works, PS256 JWT with a 3-cert x5c and the expected san:otherName / subject:O,L policies.
Usage in nuts-node: the e2e oauth-flow/didx509 test now runs on that chain and passes end to end (wallet load, discovery, access token, introspection with organization_ura). Unit tests added for resolving a did:x509 over a PSS/4096 chain anchored on the issuing CA, and for verifying a PSS-signed CRL. PR test: cover did:x509 with PKIoverheid G4-style certificate chains #4595.
Conclusion so far
No code changes are needed in nuts-node or the toolkit for G4 UZI server certificates. What operators must do is add the G4 TSP CA fingerprints to their did:x509 trust policies next to the G1 one until November 2028.
Open
Repeat issuance and the e2e flow with a real CIBG G4 test server certificate once received.
Done with a real CIBG G4 test server certificate (issued 2026-10-02 under ACCEPTATIE UZI Server - G4 Priv G-TLS SYS - 2025).
Certificate: RSASSA-PSS/SHA-512 (salt 64), RSA 4096, subject C/ST/L/O/serialNumber/CN, SAN dNSName + otherName 2.5.5.5 + permanentIdentifier, serverAuth+clientAuth. Chains to the ACCEPTATIE G4 root and intermediate. Note: the test environment uses its own otherName CA OID 2.16.528.1.1007.99.2110 and test policy OIDs (2.16.528.1.1007.99.*), as documented in CIBG's acceptance naming document; production uses 2.16.528.1.1003.1.3.5.5.5. The URA regex in the definitions matches both.
Issuance (go-didx509-toolkit :main): works, PS256, 4-cert x5c, issuer did:x509:0:sha256:svKzNxhS07V1dKkekWOZV0d6Ao7_qvjqXegWB32YjZE::san:otherName:...::subject:L:...:O:..., i.e. the test fingerprint recorded in #4355. One usability catch: the CA must be passed as CN=...,O=CIBG,C=NL,2.5.4.97=#130e4e54524e4c2d3530303030353335 because of the organizationIdentifier in the subject; filed as nuts-foundation/go-didx509-toolkit#108. Not a node problem.
Usage (nuts-node built from #4595, e2e oauth-flow/didx509 with the real chain and key, test fingerprint pinned): credential loaded in the wallet, discovery registration found, access token issued and introspected with organization_ura 90000380, name and city from the certificate. The PKI validator downloaded and verified the PSS-signed CRL from www.uzi-register-test.nl (no CRL error or softfail bypass in the log).
Conclusion: no changes needed in nuts-node or the toolkits for G4. Remaining work is configuration and rollout, tracked in #4355's sub-issues.
Activity
reinkrul commentedon Sep 25, 2026
I ordered a G4 test certificate.
reinkrul commentedon Sep 29, 2026
Status of testing X509Credential on a G4 certificate. Real CIBG G4 test server certificates require a request (form UZ39.05 plus a 4096-bit PKCS#10, sent to the UZI-register); that request is being prepared. Everything that can be verified without one is done.
Verified
Staat der Nederlanden - G4 Root Priv G-TLS - 2024→G4 Intm Priv G-TLS SYS - 2024→UZI Server - G4 PKIo Priv G-TLS SYS - 2024and- 2025(from cert.pkioverheid.nl, all RSASSA-PSS/SHA-512, salt 0x40, RSA 4096) verify with Go'scrypto/x509. The PSS-signed root and intermediate CRLs from crl.pkioverheid.nl parse and verify withRevocationList.CheckSignatureFrom, which is whatpki/validator.gouses. The end-entity CRL URL from the CIBG G4 profile document (csp.uzi-register.nl/cdp/uzi_server-g4_pkio_priv_g-tls_sys-2024.crl) still returns 404, so no end-entity certificates seem to have been issued yet.Note: there are already two UZI server TSP CAs under G4. The 2025 one has
organizationIdentifier=NTRNL-50000535back in its subject. Trust policies need one fingerprint per TSP CA:did:x509:0:sha256:sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI2024:revoked on 29 October 2025 (on the intermediate's CRL; the 2024 ZOVAR Server CA was revoked the same day). Do not pin it.did:x509:0:sha256:vzLz0CQ4GMpgjboDI2aaEDA9mrKoEGiv_jc1ANaUaHo:mainimage) on a synthetic chain that follows the CIBG G4 server profile (RSA 4096, RSASSA-PSS/SHA-512, subject C/ST/L/O/serialNumber/CN, SAN dNSName + UZI otherName 2.5.5.5 + permanentIdentifier, EKU serverAuth+clientAuth, G4 policy OIDs): works, PS256 JWT with a 3-cert x5c and the expectedsan:otherName/subject:O,Lpolicies.oauth-flow/didx509test now runs on that chain and passes end to end (wallet load, discovery, access token, introspection withorganization_ura). Unit tests added for resolving a did:x509 over a PSS/4096 chain anchored on the issuing CA, and for verifying a PSS-signed CRL. PR test: cover did:x509 with PKIoverheid G4-style certificate chains #4595.Conclusion so far
No code changes are needed in nuts-node or the toolkit for G4 UZI server certificates. What operators must do is add the G4 TSP CA fingerprints to their did:x509 trust policies next to the G1 one until November 2028.
Open
reinkrul commentedon Oct 2, 2026
Done with a real CIBG G4 test server certificate (issued 2026-10-02 under
ACCEPTATIE UZI Server - G4 Priv G-TLS SYS - 2025).Certificate: RSASSA-PSS/SHA-512 (salt 64), RSA 4096, subject C/ST/L/O/serialNumber/CN, SAN dNSName + otherName 2.5.5.5 + permanentIdentifier, serverAuth+clientAuth. Chains to the ACCEPTATIE G4 root and intermediate. Note: the test environment uses its own otherName CA OID
2.16.528.1.1007.99.2110and test policy OIDs (2.16.528.1.1007.99.*), as documented in CIBG's acceptance naming document; production uses2.16.528.1.1003.1.3.5.5.5. The URA regex in the definitions matches both.Issuance (go-didx509-toolkit
:main): works, PS256, 4-cert x5c, issuerdid:x509:0:sha256:svKzNxhS07V1dKkekWOZV0d6Ao7_qvjqXegWB32YjZE::san:otherName:...::subject:L:...:O:..., i.e. the test fingerprint recorded in #4355. One usability catch: the CA must be passed asCN=...,O=CIBG,C=NL,2.5.4.97=#130e4e54524e4c2d3530303030353335because of the organizationIdentifier in the subject; filed as nuts-foundation/go-didx509-toolkit#108. Not a node problem.Usage (nuts-node built from #4595, e2e
oauth-flow/didx509with the real chain and key, test fingerprint pinned): credential loaded in the wallet, discovery registration found, access token issued and introspected withorganization_ura90000380, name and city from the certificate. The PKI validator downloaded and verified the PSS-signed CRL fromwww.uzi-register-test.nl(no CRL error or softfail bypass in the log).Conclusion: no changes needed in nuts-node or the toolkits for G4. Remaining work is configuration and rollout, tracked in #4355's sub-issues.
test: cover did:x509 with PKIoverheid G4-style certificate chains (#4595