Send a certificate signing request
You can only receive and consume verifiable credentials if you are certified and registered on the trust framework as a Digital Verification Service (DVS). You’ll need an intermediate CA certificate to authenticate requests for data from the GOV.UK Wallet Certificate Authority (CA). For the certificate, you’ll need to create and send a Certificate Signing Request (CSR) to your engagement manager. You need to send a separate CSR for the GOV.UK Wallet sandbox and production environments.
Format your CSR body correctly
Your CSR should start and end with the following header and footer lines:
-----BEGIN CERTIFICATE REQUEST-----\n....\n-----END CERTIFICATE REQUEST-----.
Your CSR body must:
- conform to PKCS #10
- be Privacy-Enhanced Mail (PEM) encoded
- contain a valid signature over
CertificationRequestInfo - contain a subject Distinguished Name (DN)
Your CSR body can contain basicConstraints. GOV.UK Wallet will accept a CSR with or without basicConstraints.
Your CSR must not contain:
keyUsageextendedKeyUsagecertificatePoliciesnameConstraintspolicyConstraints- any custom extensions
GOV.UK Wallet will reject any CSR containing extensions.
Specify your subject DN
Your CSR body must contain a subject DN that identifies the issuing authority with the following attributes:
| Attribute | Description | OID | Format |
|---|---|---|---|
C |
Two character country code, for example GB
|
2.5.4.6 | ISO 3166-1 alpha-2 country code |
O |
Legal organisation name, for example Example Verifier Org Ltd
|
2.5.4.10 | String |
OU |
Department or division, for example DVS PKI Operations
|
2.5.4.11 | String |
CN |
Common name, for example Example Verifier Org Reader Sub-CA
|
2.5.4.3 | Stable human-readable sub-CA name |
serialNumber |
Serial Number, for example 550e8400-e29b-41d4-a716-446655440000
|
2.5.4.5 | Universally Unique Identifier v4 (UUID) |
If your CSR does not contain these 5 attributes, we will reject it.
Below is an example of a completed subject DN:
C=GB
O=Example Verifier Org Ltd
OU=Reader Certification Authority
CN=Example Verifier Org Reader Sub-CA
serialNumber=550e8400-e29b-41d4-a716-446655440000
Common name
The Common Name in the subject DN must:
- be human-readable
- specify the sub-CA name
- not contain UUID
- not contain numbering suffix
- not contain environment markers
- remain stable across renewals
- be updated if your organisation’s legal name changes
Below is an example of a Common Name:
CN=Example Verifier Org Reader Sub-CA
Serial number
The serialNumber in the subject DN is the stable identity of your sub-CA. It must be:
- a UUID version 4
- globally unique
- immutable
Your serialNumber must never be reused by a different sub-CA or DVS.
Below is an example of a serial number in a CSR:
serialNumber=550e8400-e29b-41d4-a716-446655440000
Encrypt your CSR
You must protect your CSR with encryption. The private key algorithm for your CSR must meet all of the following requirements:
| Parameter | Required value |
|---|---|
| Key type | EC |
| Curve | P-256 |
| CSR signature algorithm | ecdsa-with-SHA256 |
| Hash function | SHA-256 |
Your CSR’s private key must:
- be generated inside a Hardware Security Module (HSM) or hardware-backed key management system
- be non-exportable
- log all key usage events
- be protected by MFA for administrative access
- comply with Federal Information Processing Standards (FIPS) 140-2 as a minimum
Get your intermediate certificate
Once we have checked your CSR, we’ll issue you with an intermediate sub-CA certificate. Your sub-CA has a NameConstraints extension so you cannot issue any verifier certificates outside of your own legal business name.
You can use your sub-CA to issue your own end-entity verifier certificates to your apps, devices and trusted clients. When a verifier starts proximity sharing, the verifier certificates will form a chain of trust landing on the root certificate. This chain will authenticate all your requests for credential data.
Renew your CSR
When your intermediate sub-CA certificate expires, you will need to renew it.