[java-idp-plugin-vci] branch dev/REVISSFLOW updated: Credential signing template, X.509 example with its own bean and properties. Metadata signed with certificate chain

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/REVISSFLOW
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/b203203d302b178995b79c9933422147b90a8872

The following commit(s) were added to refs/heads/dev/REVISSFLOW by this push:
     new b203203  Credential signing template, X.509 example with its own bean and properties. Metadata signed with certificate chain
b203203 is described below

commit b203203d302b178995b79c9933422147b90a8872
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Fri Nov 6 15:25:55 2026 +0200

    Credential signing template, X.509 example with its own bean and properties. Metadata signed with certificate chain
---
 README.md                                             |  4 +++-
 .../plugin/openidvci/conf/openid-vci-credentials.xml  | 19 +++++++++----------
 .../plugin/openidvci/conf/openid-vci.properties       | 10 ++++++----
 3 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/README.md b/README.md
index 62cadc8..e87b75c 100644
--- a/README.md
+++ b/README.md
@@ -4996,7 +4996,9 @@ The file comes with the plugin and is loaded automatically.
 |---|---|---|---|
 | `openidvci.signing.es.key` | File pathname | `%{idp.home}/credentials/openid-vci-signing-es.jwk` | Credential signing key, when enabled in *conf/openid-vci-credentials.xml*. EC. |
 | `openidvci.signing.status-list.es.key` | File pathname | `%{idp.home}/credentials/openid-vci-status-list-signing-es.jwk` | Status List Token signing key, when enabled. EC. |
-| `openidvci.signing.issuerMetadata.es.key` | File pathname | `%{idp.home}/credentials/openid-vci-issuer-metadata-signing-es.jwk` | Metadata signing key, when enabled. EC. |
+| `openidvci.signing.x509.key` | File pathname | | Private key of **openidvci.X509ESSigningCredential**, PEM. EC. |
+| `openidvci.signing.x509.cert` | File pathname | | Its certificate, PEM. |
+| `openidvci.signing.x509.issuingCa` | File pathname | | Certificate of the CA that issued it, PEM. Sent in `x5c` after the leaf. Not the root the verifier trusts. |
 
 #### Status List
 
diff --git a/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/conf/openid-vci-credentials.xml b/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/conf/openid-vci-credentials.xml
index 4ef560a..97bef1a 100644
--- a/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/conf/openid-vci-credentials.xml
+++ b/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/conf/openid-vci-credentials.xml
@@ -26,12 +26,12 @@
     chain is not emitted for one.
     -->
     <!--
-    <bean id="openidvci.DefaultESSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
-        p:privateKey="%{openidvci.signing.es.key}">
+    <bean id="openidvci.X509ESSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
+        p:privateKey="%{openidvci.signing.x509.key}">
         <property name="certificates">
             <list>
-                <value>%{openidvci.signing.es.cert}</value>
-                <value>%{openidvci.signing.es.issuingCa}</value>
+                <value>%{openidvci.signing.x509.cert}</value>
+                <value>%{openidvci.signing.x509.issuingCa}</value>
             </list>
         </property>
     </bean>
@@ -61,15 +61,14 @@
     -->
 
     <!--
-    Signing key of Credential Issuer metadata. Must be EC key, signing action supports
-    nothing else. 
+    Signing key of Credential Issuer metadata. Must be an EC key given as a certificate and its
+    chain, the chain travels in the 'x5c' header and is how a wallet verifies the signer. A key
+    without a chain signs metadata that wallets cannot verify. Defining this list enables
+    signed metadata.
     -->
     <!--
-    <bean id="openidvci.issuerMetadata.DefaultESSigningCredential" parent="shibboleth.JWKCredential"
-        p:resource="%{openidvci.signing.issuerMetadata.es.key}" />
-
     <util:list id="openidvci.issuerMetadata.SigningCredentials">
-        <ref bean="openidvci.issuerMetadata.DefaultESSigningCredential" />
+        <ref bean="openidvci.X509ESSigningCredential" />
     </util:list>
     -->
 
diff --git a/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/conf/openid-vci.properties b/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/conf/openid-vci.properties
index 4a10705..1bd657c 100644
--- a/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/conf/openid-vci.properties
+++ b/openid-vci-impl/src/main/resources/org/geant/shibboleth/plugin/openidvci/conf/openid-vci.properties
@@ -62,14 +62,16 @@ openidvci.issuer =
 # OP's own signing credentials. Must be EC key.
 openidvci.signing.es.key = %{idp.home}/credentials/openid-vci-signing-es.jwk
 
+# Signing key given as a certificate and its chain, PEM files. Used only if you enable
+# openidvci.X509ESSigningCredential in conf/openid-vci-credentials.xml. Must be EC key.
+#openidvci.signing.x509.key = %{idp.home}/credentials/openid-vci-signing.key
+#openidvci.signing.x509.cert = %{idp.home}/credentials/openid-vci-signing.crt
+#openidvci.signing.x509.issuingCa = %{idp.home}/credentials/openid-vci-signing-ca.crt
+
 # Signing key of Status List Tokens. Used only if you enable the credential of the same name
 # in conf/openid-vci-credentials.xml. Must be EC key.
 openidvci.signing.status-list.es.key = %{idp.home}/credentials/openid-vci-status-list-signing-es.jwk
 
-# Signing key of Credential Issuer metadata. Used only if you enable the credential of the
-# same name in conf/openid-vci-credentials.xml. Must be EC key.
-openidvci.signing.issuerMetadata.es.key = %{idp.home}/credentials/openid-vci-issuer-metadata-signing-es.jwk
-
 # Settings for the status-list flows
 # The key used in permuting the status list indices
 # Do *NOT* share the key with other people, it's like divulging your private key.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.