├── images
├── README.md
└── TrustListResult.PNG
├── gateway
├── images
│ ├── README.md
│ ├── WinSSL.PNG
│ └── OpenSSL.PNG
├── OnboardingChecklist.md
└── CertificatePreperation.md
├── NOTICE
├── CODEOWNERS
├── README.md
├── CONTRIBUTING.md
├── CODE_OF_CONDUCT.md
└── LICENSE
/images/README.md:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------
/gateway/images/README.md:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------
/gateway/images/WinSSL.PNG:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/eu-digital-green-certificates/dgc-participating-countries/HEAD/gateway/images/WinSSL.PNG
--------------------------------------------------------------------------------
/gateway/images/OpenSSL.PNG:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/eu-digital-green-certificates/dgc-participating-countries/HEAD/gateway/images/OpenSSL.PNG
--------------------------------------------------------------------------------
/images/TrustListResult.PNG:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/eu-digital-green-certificates/dgc-participating-countries/HEAD/images/TrustListResult.PNG
--------------------------------------------------------------------------------
/NOTICE:
--------------------------------------------------------------------------------
1 | Copyright (c) 2021 T-Systems International GmbH and all other contributors.
2 |
3 | This project is licensed under Apache License, Version 2.0;
4 | you may not use them except in compliance with the License.
5 |
6 | Contributors:
7 | -------------
8 |
9 | Daniel Eder [daniel-eder], T-Mobile International Austria GmbH
10 | Steffen Schulze [SchulzeStTSI], T-Systems International GmbH
--------------------------------------------------------------------------------
/CODEOWNERS:
--------------------------------------------------------------------------------
1 | # This file provides an overview of code owners in this repository.
2 |
3 | # Each line is a file pattern followed by one or more owners.
4 | # The last matching pattern has the most precedence.
5 | # For more details, read the following article on GitHub: https://help.github.com/articles/about-codeowners/.
6 |
7 | # These are the default owners for the whole content of this repository. The default owners are automatically added as reviewers when you open a pull request, unless different owners are specified in the file.
8 | * @daniel-eder @SchulzeStTSI
9 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 |
2 | EU Digital COVID Certificate: Information for Participating Countries
3 |
4 |
5 |
6 | About •
7 | How to Contribute •
8 | Licensing
9 |
10 |
11 | ## About
12 |
13 | This repository provides information for participating countries to ensure a successful onboarding and system integration.
14 |
15 | ## How to contribute
16 |
17 | Contribution and feedback is encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our [Contribution Guidelines](./CONTRIBUTING.md). By participating in this project, you agree to abide by its [Code of Conduct](./CODE_OF_CONDUCT.md) at all times.
18 |
19 | ## Licensing
20 |
21 | Copyright (C) 2021 T-Systems International GmbH and all other contributors
22 |
23 | Licensed under the **Apache License, Version 2.0** (the "License"); you may not use this file except in compliance with the License.
24 |
25 | You may obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0.
26 |
27 | Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the [LICENSE](./LICENSE) for the specific language governing permissions and limitations under the License.
28 |
--------------------------------------------------------------------------------
/gateway/OnboardingChecklist.md:
--------------------------------------------------------------------------------
1 | # Onboarding Checklist
2 |
3 | ## Common Hints
4 |
5 | Registration Process: [Process](https://github.com/eu-digital-green-certificates/dgc-overview/blob/main/guides/certificate-governance.md#31-registration-of-national-backends)
6 |
7 | It is highly recommended:
8 | - **to use certificates issued from a public CA which follows the CAB Forum Rules**
9 | - **not to reuse any certificates across the different staging environments**
10 |
11 | ## Links to the Environments
12 |
13 | - Test Environment: https://test-dgcg-ws.tech.ec.europa.eu
14 | - Acceptance Environment: https://acc-dgcg-ws.tech.ec.europa.eu
15 |
16 | ## Test Environment
17 |
18 | For a successfull connection to the gateway there are several steps to prepare:
19 |
20 | 1) Certificates must be prepared for Test Environment (self signed allowed)
21 | - Authentication: NBTLS
22 | - Upload: NBUP
23 | - CSCA(s): NBCSCA
24 | 2) Send the Public Keys in PEM Format to the contact of the Test Operator (functional mailbox)
25 | 3) After Onboarding in the Test Environment, check the connectivity with the following command:
26 | ```curl -vvv -H "Accept: */*" --resolve ****.ec.europa.eu:443 --cert "auth_de.pem" --key "key.pem" https://****.ec.europa.eu/trustList```
27 | You should see a output like:
28 | 
29 | 4) Test the other Truslist Routes in the same style (e.g. with DSC/CSCA/Upload/Authentication...)
30 | 5) Create an Document Signer Certificate and sign it by the CSCA
31 | 6) Create an CMS Package with the following Command:
32 | ```
33 | openssl x509 -outform der -in cert.pem -out cert.der
34 | openssl cms -sign -nodetach -in cert.der -signer signing.crt -inkey signing.key -out signed.der -outform DER -binary
35 | openssl base64 -in signed.der -out cms.b64 -e -A
36 | ```
37 | Note: cert.der is your DSC, signing.crt ist the Uploader Certificate)
38 |
39 | 7) Upload the CMS Package to the Gateway
40 | ```curl -v -X POST -H "Content-Type: application/cms" --cert auth_de.pem --key key.pem --data @cms.b64 https://****.ec.europa.eu/signerCertificate```
41 | 8) Download the Trustlist again, and check if your DSC is available.
42 |
43 |
44 | **Note**: Some versions of curl don't attach the client certificates automatically. This can be checked via
45 | ``` curl --version ```
46 | Ensure that the used version is linked to OpenSSL. Especially under Windows (https://curl.se/windows/):
47 |
48 | OpenSSL Test Example (working)
49 |
50 | 
51 |
52 | WinSSL Test Example (Not working)
53 |
54 | 
55 |
56 |
57 |
58 | ## Acceptance Environment
59 |
60 | 1) Order/Generate your certificates according the defined requirements in [Certificate Governance](https://github.com/eu-digital-green-certificates/dgc-participating-countries/blob/main/gateway/OnboardingChecklist.md):
61 | - Authentication: NBTLS (TLS [Template](https://github.com/eu-digital-green-certificates/dgc-overview/blob/main/guides/certificate-governance.md#45national-backend-tls-client-authentication-nbtls))
62 | - Upload: NBUP(Upload [Template](https://github.com/eu-digital-green-certificates/dgc-overview/blob/main/guides/certificate-governance.md#44upload-certificates-nbup))
63 | - CSCA(s): NBCSCA (CSCA [Template](https://github.com/eu-digital-green-certificates/dgc-overview/blob/main/guides/certificate-governance.md#42csca-certificate-nbcsca))
64 | 2) Transfer the certificates via circABC to the Secretariat
65 | 3) After the certificate whitelisting, test the functionality again with your backend (E2E)
66 |
67 |
68 | ## Production Environment
69 |
70 | 1) Push the certificates together with your application for going live over circABC to the secretariat (TBD)
71 | 2) Connect your production setup
72 |
73 |
74 |
75 |
76 |
77 |
--------------------------------------------------------------------------------
/CONTRIBUTING.md:
--------------------------------------------------------------------------------
1 | # Contributing
2 |
3 | ## Code of conduct
4 |
5 | All members of the project community must abide by the [Contributor Covenant, version 2.0](CODE_OF_CONDUCT.md).
6 | Only by respecting each other can we develop a productive, collaborative community.
7 | Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting [opensource@telekom.de](mailto:opensource@telekom.de) and/or a project maintainer.
8 |
9 | We appreciate your courtesy of avoiding political questions here. Issues which are not related to the project itself will be closed by our community managers.
10 |
11 | ## Engaging in our project
12 |
13 | We use GitHub to manage reviews of pull requests.
14 |
15 | * If you are a new contributor, see: [Steps to Contribute](#steps-to-contribute)
16 |
17 | * If you have a trivial fix or improvement, go ahead and create a pull request, addressing (with `@...`) a suitable maintainer of this repository (see [CODEOWNERS](CODEOWNERS) of the repository you want to contribute to) in the description of the pull request.
18 |
19 | * If you plan to do something more involved, please reach out to us and send an [email](mailto:opensource@telekom.de). This will avoid unnecessary work and surely give you and us a good deal of inspiration.
20 |
21 | * Relevant coding style guidelines are available in the respective sub-repositories as they are programming language-dependent.
22 |
23 | ## Steps to Contribute
24 |
25 | Should you wish to work on an issue, please claim it first by commenting on the GitHub issue that you want to work on. This is to prevent duplicated efforts from other contributors on the same issue.
26 |
27 | If you have questions about one of the issues, please comment on them, and one of the maintainers will clarify.
28 |
29 | We kindly ask you to follow the [Pull Request Checklist](#Pull-Request-Checklist) to ensure reviews can happen accordingly.
30 |
31 | ## Contributing Code
32 |
33 | You are welcome to contribute code in order to fix a bug or to implement a new feature.
34 |
35 | The following rule governs code contributions:
36 |
37 | * Contributions must be licensed under the [Apache 2.0 License](./LICENSE)
38 | * Newly created files must be opened by an instantiated version of the file 'templates/file-header.txt'
39 | * At least if you add a new file to the repository, add your name into the contributor section of the file NOTICE (please respect the preset entry structure)
40 |
41 | ## Contributing Documentation
42 |
43 | You are welcome to contribute documentation to the project.
44 |
45 | The following rule governs documentation contributions:
46 |
47 | * Contributions must be licensed under the same license as code, the [Apache 2.0 License](./LICENSE)
48 |
49 | ## Pull Request Checklist
50 |
51 | * Branch from the main branch and, if needed, rebase to the current main branch before submitting your pull request. If it doesn't merge cleanly with main you may be asked to rebase your changes.
52 |
53 | * Commits should be as small as possible while ensuring that each commit is correct independently (i.e., each commit should compile and pass tests).
54 |
55 | * Test your changes as thoroughly as possible before you commit them. Preferably, automate your test by unit/integration tests. If tested manually, provide information about the test scope in the PR description (e.g. “Test passed: Upgrade version from 0.42 to 0.42.23.”).
56 |
57 | * Create _Work In Progress [WIP]_ pull requests only if you need clarification or an explicit review before you can continue your work item.
58 |
59 | * If your patch is not getting reviewed or you need a specific person to review it, you can @-reply a reviewer asking for a review in the pull request or a comment, or you can ask for a review by contacting us via [email](mailto:opensource@telekom.de).
60 |
61 | * Post review:
62 | * If a review requires you to change your commit(s), please test the changes again.
63 | * Amend the affected commit(s) and force push onto your branch.
64 | * Set respective comments in your GitHub review to resolved.
65 | * Create a general PR comment to notify the reviewers that your amendments are ready for another round of review.
66 |
67 | ## Issues and Planning
68 |
69 | * We use GitHub issues to track bugs and enhancement requests.
70 |
71 | * Please provide as much context as possible when you open an issue. The information you provide must be comprehensive enough to reproduce that issue for the assignee. Therefore, contributors may use but aren't restricted to the issue template provided by the project maintainers.
72 |
73 | * When creating an issue, try using one of our issue templates which already contain some guidelines on which content is expected to process the issue most efficiently. If no template applies, you can of course also create an issue from scratch.
74 |
75 | * Please apply one or more applicable [labels](/../../labels) to your issue so that all community members are able to cluster the issues better.
76 |
--------------------------------------------------------------------------------
/CODE_OF_CONDUCT.md:
--------------------------------------------------------------------------------
1 |
2 | # Contributor Covenant Code of Conduct
3 |
4 | ## Our Pledge
5 |
6 | We as members, contributors, and leaders pledge to make participation in our
7 | community a harassment-free experience for everyone, regardless of age, body
8 | size, visible or invisible disability, ethnicity, sex characteristics, gender
9 | identity and expression, level of experience, education, socio-economic status,
10 | nationality, personal appearance, race, religion, or sexual identity
11 | and orientation.
12 |
13 | We pledge to act and interact in ways that contribute to an open, welcoming,
14 | diverse, inclusive, and healthy community.
15 |
16 | ## Our Standards
17 |
18 | Examples of behavior that contributes to a positive environment for our
19 | community include:
20 |
21 | * Demonstrating empathy and kindness toward other people
22 | * Being respectful of differing opinions, viewpoints, and experiences
23 | * Giving and gracefully accepting constructive feedback
24 | * Accepting responsibility and apologizing to those affected by our mistakes,
25 | and learning from the experience
26 | * Focusing on what is best not just for us as individuals, but for the
27 | overall community
28 |
29 | Examples of unacceptable behavior include:
30 |
31 | * The use of sexualized language or imagery, and sexual attention or
32 | advances of any kind
33 | * Trolling, insulting or derogatory comments, and personal or political attacks
34 | * Public or private harassment
35 | * Publishing others' private information, such as a physical or email
36 | address, without their explicit permission
37 | * Other conduct which could reasonably be considered inappropriate in a
38 | professional setting
39 |
40 | ## Enforcement Responsibilities
41 |
42 | Community leaders are responsible for clarifying and enforcing our standards of
43 | acceptable behavior and will take appropriate and fair corrective action in
44 | response to any behavior that they deem inappropriate, threatening, offensive,
45 | or harmful.
46 |
47 | Community leaders have the right and responsibility to remove, edit, or reject
48 | comments, commits, code, wiki edits, issues, and other contributions that are
49 | not aligned to this Code of Conduct, and will communicate reasons for moderation
50 | decisions when appropriate.
51 |
52 | ## Scope
53 |
54 | This Code of Conduct applies within all community spaces, and also applies when
55 | an individual is officially representing the community in public spaces.
56 | Examples of representing our community include using an official e-mail address,
57 | posting via an official social media account, or acting as an appointed
58 | representative at an online or offline event.
59 |
60 | ## Enforcement
61 |
62 | Instances of abusive, harassing, or otherwise unacceptable behavior may be
63 | reported to the community leaders responsible for enforcement at
64 | [opensource@telekom.de](mailto:opensource@telekom.de).
65 | All complaints will be reviewed and investigated promptly and fairly.
66 |
67 | All community leaders are obligated to respect the privacy and security of the
68 | reporter of any incident.
69 |
70 | ## Enforcement Guidelines
71 |
72 | Community leaders will follow these Community Impact Guidelines in determining
73 | the consequences for any action they deem in violation of this Code of Conduct:
74 |
75 | ### 1. Correction
76 |
77 | **Community Impact**: Use of inappropriate language or other behavior deemed
78 | unprofessional or unwelcome in the community.
79 |
80 | **Consequence**: A private, written warning from community leaders, providing
81 | clarity around the nature of the violation and an explanation of why the
82 | behavior was inappropriate. A public apology may be requested.
83 |
84 | ### 2. Warning
85 |
86 | **Community Impact**: A violation through a single incident or series
87 | of actions.
88 |
89 | **Consequence**: A warning with consequences for continued behavior. No
90 | interaction with the people involved, including unsolicited interaction with
91 | those enforcing the Code of Conduct, for a specified period of time. This
92 | includes avoiding interactions in community spaces as well as external channels
93 | like social media. Violating these terms may lead to a temporary or
94 | permanent ban.
95 |
96 | ### 3. Temporary Ban
97 |
98 | **Community Impact**: A serious violation of community standards, including
99 | sustained inappropriate behavior.
100 |
101 | **Consequence**: A temporary ban from any sort of interaction or public
102 | communication with the community for a specified period of time. No public or
103 | private interaction with the people involved, including unsolicited interaction
104 | with those enforcing the Code of Conduct, is allowed during this period.
105 | Violating these terms may lead to a permanent ban.
106 |
107 | ### 4. Permanent Ban
108 |
109 | **Community Impact**: Demonstrating a pattern of violation of community
110 | standards, including sustained inappropriate behavior, harassment of an
111 | individual, or aggression toward or disparagement of classes of individuals.
112 |
113 | **Consequence**: A permanent ban from any sort of public interaction within
114 | the community.
115 |
116 | ## Attribution
117 |
118 | This Code of Conduct is adapted from the [Contributor Covenant][homepage],
119 | version 2.0, available at
120 | https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
121 |
122 | Community Impact Guidelines were inspired by [Mozilla's code of conduct
123 | enforcement ladder](https://github.com/mozilla/diversity).
124 |
125 | [homepage]: https://www.contributor-covenant.org
126 |
127 | For answers to common questions about this code of conduct, see the FAQ at
128 | https://www.contributor-covenant.org/faq. Translations are available at
129 | https://www.contributor-covenant.org/translations.
130 |
131 |
--------------------------------------------------------------------------------
/gateway/CertificatePreperation.md:
--------------------------------------------------------------------------------
1 | This guide follows the certificate templates defined [here](https://github.com/eu-digital-green-certificates/dgc-overview/blob/main/guides/certificate-governance.md).
2 | Public Key Certificates generated by following this guide will include the minimal required fields - further fields can be added in the configuration files if needed.
3 |
4 | # Elliptic Curve Public Key Certificates (ECDSA with NIST-p-256)
5 | ## CSCA certificate (NBCSCA) generation example:
6 | ### csca.conf
7 | Create a new file called *csca.conf* and replace the dn entries with your country details.
8 | ```
9 | [req]
10 | prompt = no
11 | default_md = sha256
12 | distinguished_name = dn
13 |
14 | [dn]
15 | C = DE
16 | ST = NRW
17 | L = Bonn
18 | O = MinistryOfTest
19 | OU = DGCOperations
20 | CN = CSCA_DGC_DE_01
21 |
22 | [ext]
23 | basicConstraints = critical, CA:TRUE, pathlen:0
24 | keyUsage = critical, cRLSign, keyCertSign
25 | subjectKeyIdentifier = hash
26 | ```
27 | ### Certificate generation
28 | Open a command line prompt in the folder where the *csca.conf* is located and use the following OpenSSL command to create the private key (*CAprivkey.key*) and the certificate (*CAcert.pem*):
29 | ```
30 | openssl req -x509 -new -days 1461 -newkey ec:<(openssl ecparam -name prime256v1) -extensions ext -keyout CAprivkey.key -nodes -out CAcert.pem -config csca.conf
31 | ```
32 | ## DSC generation example
33 | Document Signer Certificates (DSCs) must be signed by the CSCA. Hence, you have to create the CSCA certificate (with the corresponding private key) before you can issue DSCs.
34 | ### DSC.conf
35 | Create a new file called *DSC.conf* in the folder where your CA's private key is located and add the following fields:
36 | ```
37 | [ext]
38 | keyUsage = critical, digitalSignature
39 | subjectKeyIdentifier = hash
40 | authorityKeyIdentifier = keyid:always
41 | crlDistributionPoints = URI:http://crl.exampledomain.example/CRL/CSCA.crl
42 | extendedKeyUsage = 1.3.6.1.4.1.1847.2021.1.1,1.3.6.1.4.1.1847.2021.1.2,1.3.6.1.4.1.1847.2021.1.3
43 | ```
44 | It is recommended that a CSCA provides certificate revocation lists. Therefore, replace the crlDistributionPoints URI with the information for your member state.
45 |
46 | The extendedKeyUsage field is optional and can be used to further restrict the DSC certificate as follows:
47 |
48 | |Field | Value|
49 | |------| -----|
50 | |extendedKeyUsage| 1.3.6.1.4.1.1847.2021.1.1 for Test Issuers
51 | |extendedKeyUsage| 1.3.6.1.4.1.1847.2021.1.2 for Vacination Issuers
52 | |extendedKeyUsage| 1.3.6.1.4.1.1847.2021.1.3 for Recovery Issuers
53 |
54 | The above example contains all three extended key usages.
55 |
56 | ### Create a certificate signing request (CSR)
57 |
58 | In order to create a certificate for a Document Signer, first create a Certificate Signing Request preferably on the maschine that will use the certificate in order to avoid copying the private key (*DSC01privkey.key*) to this maschine later. The CSR must contain the Distinguished Name (DN) information that will be included in the DSC. Open a command prompt and use the following command to create the CSR:
59 | ```
60 | openssl req -newkey ec:<(openssl ecparam -name prime256v1) -keyout DSC01privkey.key -nodes -out DSC01csr.pem
61 | ```
62 | If needed, you can repeat this procedure to create multiple CSRs for different DSCs (on different maschines).
63 | When prompted, enter the necessary information (e.g. C= your Country (MUST), O = your Organisation (OPTIONAL), CN = non-empty and unique CN (MUST), ...).
64 |
65 | ### Issue the certificate
66 | Copy the CSR (*DSC01csr.pem*) to the folder where the private key of your CA is located. Open a command prompt and use the following command to issue the DSC (*DSCcert.pem*):
67 | ```
68 | openssl x509 -req -in DSC01csr.pem -CA CAcert.pem -CAkey CAprivkey.key -CAcreateserial -days 730 -extensions ext -extfile DSC.conf -out DSCcert.pem
69 | ```
70 |
71 | ## NBUP generation example
72 | ### uploadCert.conf
73 | Create a new file called *uploadCert.conf* and replace the dn entries with your country details.
74 | ```
75 | [req]
76 | prompt = no
77 | default_md = sha256
78 | distinguished_name = dn
79 |
80 | [dn]
81 | C = DE
82 | ST = NRW
83 | L = Bonn
84 | O = MinistryOfTest
85 | OU = DGCOperations
86 | CN = NationX_NBUP
87 |
88 | [ext]
89 | keyUsage = critical, digitalSignature
90 | ```
91 | ### Certificate generation
92 | Open a command line prompt in the folder where the *uploadCert.conf* is located and use the following OpenSSL command to create the private key (*NB_UP.key*) and the certificate (*NB_UP.pem*):
93 | ```
94 | openssl req -x509 -new -days 365 -newkey ec:<(openssl ecparam -name prime256v1) -extensions ext -keyout NB_UP.key -nodes -out NB_UP.pem -config uploadCert.conf
95 | ```
96 |
97 | ## NBTLS generation example
98 | ### TLSClient.conf
99 | Create a new file called *TLSClient.conf* and replace the dn entries with your country details.
100 | ```
101 | [req]
102 | prompt = no
103 | default_md = sha256
104 | distinguished_name = dn
105 |
106 | [dn]
107 | C = DE
108 | ST = NRW
109 | L = Bonn
110 | O = MinistryOfTest
111 | OU = DGCOperations
112 | CN = NationX_NB_TLS
113 |
114 | [ext]
115 | keyUsage = critical, digitalSignature
116 | extendedKeyUsage = clientAuth
117 | ```
118 |
119 | **NOTE** :Beware that self-signed certificates should also contain the key usage Certificate signing (keyCertSign), so that the (self) signature of the certificate can be verified.
120 | ```
121 | [ext]
122 | keyUsage = critical, digitalSignature, keyCertSign
123 | extendedKeyUsage = clientAuth
124 | ```
125 |
126 | ### Certificate generation
127 | Open a command line prompt in the folder where the *TLSClient.conf* is located and use the following OpenSSL command to create the private key (*NB_TLS.key*) and the certificate (*NB_TLS.pem*):
128 | ```
129 | openssl req -x509 -new -days 365 -newkey ec:<(openssl ecparam -name prime256v1) -extensions ext -keyout NB_TLS.key -nodes -out NB_TLS.pem -config TLSClient.conf
130 | ```
131 |
132 | # RSA Public Key Certificates
133 | In case you want to use RSA certificates you can still use the configuration files provided above. During the CSR/certificate creation, replace the ```-newkey ec:<(openssl ecparam -name prime256v1)``` with ```-newkey rsa:4096``` for a 4096 Bit RSA key.
134 | Please be aware that RSA is NOT RECOMMENDED for the DSC and if you want to use RSA as your document signing algorithm, please create either a 2048 bit RSA key or at maximum a 3072 bit RSA key due to the space limitations on the QR codes.
135 |
136 |
137 | # Appendix A: Further example configuration files
138 |
139 | The following configuration files have been provided during the alignment on the [certificate governance](https://github.com/eu-digital-green-certificates/dgc-overview/blob/main/guides/certificate-governance.md). The configuration files contain additional fields that member states might want to include and use. The config-files are not tested with the OpenSSL commands provided above.
140 |
141 | ## CSCA Conf
142 | ```
143 | [ csca_ext ]
144 | basicConstraints = critical,CA:true,pathlen:0
145 | keyUsage = critical,keyCertSign,cRLSign
146 | subjectKeyIdentifier = hash
147 | authorityKeyIdentifier = keyid:always
148 | issuerAltName = dirName:dir_sect
149 | subjectAltName = dirName:dir_sect
150 | crlDistributionPoints = URI:http://crl.publichealth.xx/CRLs/XX-Health.crl
151 | 2.5.29.16 = ASN1:SEQUENCE:CAprivateKeyUsagePeriod
152 |
153 |
154 | [ CAprivateKeyUsagePeriod ]
155 | notBefore = IMPLICIT:0,GENERALIZEDTIME:$ENV::PRIV_KEY_START
156 | notAfter = IMPLICIT:1,GENERALIZEDTIME:$ENV::CA_PRIV_KEY_END
157 |
158 | [dir_sect]
159 | L=XX
160 | ```
161 | ## DSC conf
162 | ```
163 | [ document_signer_all_ext ]
164 | keyUsage = critical,digitalSignature
165 | subjectKeyIdentifier = hash
166 | authorityKeyIdentifier = keyid:always
167 | subjectAltName = dirName:dir_sect
168 | issuerAltName = dirName:dir_sect
169 | crlDistributionPoints = URI:http://crl.npkd.nl/CRLs/NLD-Health.crl
170 | extendedKeyUsage = 1.3.6.1.4.1.1847.2021.1.1,1.3.6.1.4.1.1847.2021.1.2,1.3.6.1.4.1.1847.2021.1.3
171 | 2.5.29.16 = ASN1:SEQUENCE:DSprivateKeyUsagePeriod
172 |
173 | [ document_signer_test_ext ]
174 | keyUsage = critical,digitalSignature
175 | subjectKeyIdentifier = hash
176 | authorityKeyIdentifier = keyid:always
177 | subjectAltName = dirName:dir_sect
178 | issuerAltName = dirName:dir_sect
179 | crlDistributionPoints = URI:http://crl.npkd.nl/CRLs/NLD-Health.crl
180 | extendedKeyUsage = 1.3.6.1.4.1.1847.2021.1.1
181 | 2.5.29.16 = ASN1:SEQUENCE:DSprivateKeyUsagePeriod
182 |
183 | [ document_signer_vaccinations_ext ]
184 | keyUsage = critical,digitalSignature
185 | subjectKeyIdentifier = hash
186 | authorityKeyIdentifier = keyid:always
187 | subjectAltName = dirName:dir_sect
188 | issuerAltName = dirName:dir_sect
189 | crlDistributionPoints = URI:http://crl.npkd.nl/CRLs/NLD-Health.crl
190 | extendedKeyUsage = 1.3.6.1.4.1.1847.2021.1.2
191 | 2.5.29.16 = ASN1:SEQUENCE:DSprivateKeyUsagePeriod
192 |
193 | [ document_signer_recovery_ext ]
194 | keyUsage = critical,digitalSignature
195 | subjectKeyIdentifier = hash
196 | authorityKeyIdentifier = keyid:always
197 | subjectAltName = dirName:dir_sect
198 | issuerAltName = dirName:dir_sect
199 | crlDistributionPoints = URI:http://crl.npkd.nl/CRLs/NLD-Health.crl
200 | extendedKeyUsage = 1.3.6.1.4.1.1847.2021.1.3
201 | 2.5.29.16 = ASN1:SEQUENCE:DSprivateKeyUsagePeriod
202 |
203 | [ DSprivateKeyUsagePeriod ]
204 | notBefore = IMPLICIT:0,GENERALIZEDTIME:$ENV::PRIV_KEY_START
205 | notAfter = IMPLICIT:1,GENERALIZEDTIME:$ENV::DS_PRIV_KEY_END
206 | ```
207 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | Apache License
2 | Version 2.0, January 2004
3 | http://www.apache.org/licenses/
4 |
5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6 |
7 | 1. Definitions.
8 |
9 | "License" shall mean the terms and conditions for use, reproduction,
10 | and distribution as defined by Sections 1 through 9 of this document.
11 |
12 | "Licensor" shall mean the copyright owner or entity authorized by
13 | the copyright owner that is granting the License.
14 |
15 | "Legal Entity" shall mean the union of the acting entity and all
16 | other entities that control, are controlled by, or are under common
17 | control with that entity. For the purposes of this definition,
18 | "control" means (i) the power, direct or indirect, to cause the
19 | direction or management of such entity, whether by contract or
20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the
21 | outstanding shares, or (iii) beneficial ownership of such entity.
22 |
23 | "You" (or "Your") shall mean an individual or Legal Entity
24 | exercising permissions granted by this License.
25 |
26 | "Source" form shall mean the preferred form for making modifications,
27 | including but not limited to software source code, documentation
28 | source, and configuration files.
29 |
30 | "Object" form shall mean any form resulting from mechanical
31 | transformation or translation of a Source form, including but
32 | not limited to compiled object code, generated documentation,
33 | and conversions to other media types.
34 |
35 | "Work" shall mean the work of authorship, whether in Source or
36 | Object form, made available under the License, as indicated by a
37 | copyright notice that is included in or attached to the work
38 | (an example is provided in the Appendix below).
39 |
40 | "Derivative Works" shall mean any work, whether in Source or Object
41 | form, that is based on (or derived from) the Work and for which the
42 | editorial revisions, annotations, elaborations, or other modifications
43 | represent, as a whole, an original work of authorship. For the purposes
44 | of this License, Derivative Works shall not include works that remain
45 | separable from, or merely link (or bind by name) to the interfaces of,
46 | the Work and Derivative Works thereof.
47 |
48 | "Contribution" shall mean any work of authorship, including
49 | the original version of the Work and any modifications or additions
50 | to that Work or Derivative Works thereof, that is intentionally
51 | submitted to Licensor for inclusion in the Work by the copyright owner
52 | or by an individual or Legal Entity authorized to submit on behalf of
53 | the copyright owner. For the purposes of this definition, "submitted"
54 | means any form of electronic, verbal, or written communication sent
55 | to the Licensor or its representatives, including but not limited to
56 | communication on electronic mailing lists, source code control systems,
57 | and issue tracking systems that are managed by, or on behalf of, the
58 | Licensor for the purpose of discussing and improving the Work, but
59 | excluding communication that is conspicuously marked or otherwise
60 | designated in writing by the copyright owner as "Not a Contribution."
61 |
62 | "Contributor" shall mean Licensor and any individual or Legal Entity
63 | on behalf of whom a Contribution has been received by Licensor and
64 | subsequently incorporated within the Work.
65 |
66 | 2. Grant of Copyright License. Subject to the terms and conditions of
67 | this License, each Contributor hereby grants to You a perpetual,
68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable
69 | copyright license to reproduce, prepare Derivative Works of,
70 | publicly display, publicly perform, sublicense, and distribute the
71 | Work and such Derivative Works in Source or Object form.
72 |
73 | 3. Grant of Patent License. Subject to the terms and conditions of
74 | this License, each Contributor hereby grants to You a perpetual,
75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable
76 | (except as stated in this section) patent license to make, have made,
77 | use, offer to sell, sell, import, and otherwise transfer the Work,
78 | where such license applies only to those patent claims licensable
79 | by such Contributor that are necessarily infringed by their
80 | Contribution(s) alone or by combination of their Contribution(s)
81 | with the Work to which such Contribution(s) was submitted. If You
82 | institute patent litigation against any entity (including a
83 | cross-claim or counterclaim in a lawsuit) alleging that the Work
84 | or a Contribution incorporated within the Work constitutes direct
85 | or contributory patent infringement, then any patent licenses
86 | granted to You under this License for that Work shall terminate
87 | as of the date such litigation is filed.
88 |
89 | 4. Redistribution. You may reproduce and distribute copies of the
90 | Work or Derivative Works thereof in any medium, with or without
91 | modifications, and in Source or Object form, provided that You
92 | meet the following conditions:
93 |
94 | (a) You must give any other recipients of the Work or
95 | Derivative Works a copy of this License; and
96 |
97 | (b) You must cause any modified files to carry prominent notices
98 | stating that You changed the files; and
99 |
100 | (c) You must retain, in the Source form of any Derivative Works
101 | that You distribute, all copyright, patent, trademark, and
102 | attribution notices from the Source form of the Work,
103 | excluding those notices that do not pertain to any part of
104 | the Derivative Works; and
105 |
106 | (d) If the Work includes a "NOTICE" text file as part of its
107 | distribution, then any Derivative Works that You distribute must
108 | include a readable copy of the attribution notices contained
109 | within such NOTICE file, excluding those notices that do not
110 | pertain to any part of the Derivative Works, in at least one
111 | of the following places: within a NOTICE text file distributed
112 | as part of the Derivative Works; within the Source form or
113 | documentation, if provided along with the Derivative Works; or,
114 | within a display generated by the Derivative Works, if and
115 | wherever such third-party notices normally appear. The contents
116 | of the NOTICE file are for informational purposes only and
117 | do not modify the License. You may add Your own attribution
118 | notices within Derivative Works that You distribute, alongside
119 | or as an addendum to the NOTICE text from the Work, provided
120 | that such additional attribution notices cannot be construed
121 | as modifying the License.
122 |
123 | You may add Your own copyright statement to Your modifications and
124 | may provide additional or different license terms and conditions
125 | for use, reproduction, or distribution of Your modifications, or
126 | for any such Derivative Works as a whole, provided Your use,
127 | reproduction, and distribution of the Work otherwise complies with
128 | the conditions stated in this License.
129 |
130 | 5. Submission of Contributions. Unless You explicitly state otherwise,
131 | any Contribution intentionally submitted for inclusion in the Work
132 | by You to the Licensor shall be under the terms and conditions of
133 | this License, without any additional terms or conditions.
134 | Notwithstanding the above, nothing herein shall supersede or modify
135 | the terms of any separate license agreement you may have executed
136 | with Licensor regarding such Contributions.
137 |
138 | 6. Trademarks. This License does not grant permission to use the trade
139 | names, trademarks, service marks, or product names of the Licensor,
140 | except as required for reasonable and customary use in describing the
141 | origin of the Work and reproducing the content of the NOTICE file.
142 |
143 | 7. Disclaimer of Warranty. Unless required by applicable law or
144 | agreed to in writing, Licensor provides the Work (and each
145 | Contributor provides its Contributions) on an "AS IS" BASIS,
146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 | implied, including, without limitation, any warranties or conditions
148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 | PARTICULAR PURPOSE. You are solely responsible for determining the
150 | appropriateness of using or redistributing the Work and assume any
151 | risks associated with Your exercise of permissions under this License.
152 |
153 | 8. Limitation of Liability. In no event and under no legal theory,
154 | whether in tort (including negligence), contract, or otherwise,
155 | unless required by applicable law (such as deliberate and grossly
156 | negligent acts) or agreed to in writing, shall any Contributor be
157 | liable to You for damages, including any direct, indirect, special,
158 | incidental, or consequential damages of any character arising as a
159 | result of this License or out of the use or inability to use the
160 | Work (including but not limited to damages for loss of goodwill,
161 | work stoppage, computer failure or malfunction, or any and all
162 | other commercial damages or losses), even if such Contributor
163 | has been advised of the possibility of such damages.
164 |
165 | 9. Accepting Warranty or Additional Liability. While redistributing
166 | the Work or Derivative Works thereof, You may choose to offer,
167 | and charge a fee for, acceptance of support, warranty, indemnity,
168 | or other liability obligations and/or rights consistent with this
169 | License. However, in accepting such obligations, You may act only
170 | on Your own behalf and on Your sole responsibility, not on behalf
171 | of any other Contributor, and only if You agree to indemnify,
172 | defend, and hold each Contributor harmless for any liability
173 | incurred by, or claims asserted against, such Contributor by reason
174 | of your accepting any such warranty or additional liability.
175 |
176 | END OF TERMS AND CONDITIONS
177 |
178 | APPENDIX: How to apply the Apache License to your work.
179 |
180 | To apply the Apache License to your work, attach the following
181 | boilerplate notice, with the fields enclosed by brackets "[]"
182 | replaced with your own identifying information. (Don't include
183 | the brackets!) The text should be enclosed in the appropriate
184 | comment syntax for the file format. We also recommend that a
185 | file or class name and description of purpose be included on the
186 | same "printed page" as the copyright notice for easier
187 | identification within third-party archives.
188 |
189 | Copyright [yyyy] [name of copyright owner]
190 |
191 | Licensed under the Apache License, Version 2.0 (the "License");
192 | you may not use this file except in compliance with the License.
193 | You may obtain a copy of the License at
194 |
195 | http://www.apache.org/licenses/LICENSE-2.0
196 |
197 | Unless required by applicable law or agreed to in writing, software
198 | distributed under the License is distributed on an "AS IS" BASIS,
199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 | See the License for the specific language governing permissions and
201 | limitations under the License.
202 |
--------------------------------------------------------------------------------