Overview

The X.509 Certificate Service issues X.509 certificates for PKI deployments, including ISO/IEC 18013-5 compliant certificates for mobile driving licence (mDL) ecosystems and ETSI-compliant certificates for EUDI Wallet ecosystems. One pair of endpoints issues every certificate type — self-signed roots, CA-signed intermediates and leaves, ISO IACA roots, ISO Document Signer certificates, and ETSI Provider / Wallet Relying Party certificates — selected through request fields and an optional certificate profile. The service also creates PKCS#10 Certificate Signing Requests (CSRs) and issues certificates from them.

By default, the service is stateless: it returns the generated certificate PEM without storing it. If one or more X.509 Store services are attached as dependencies, issued certificates are persisted automatically according to a configurable persistence strategy.

The X.509 Certificate Service is controlled by the x509 feature flag, which also controls the X.509 Store Service. The flag is enabled by default via the _features.conf, so the service is available unless you explicitly add x509 to disabledFeatures.

Service Dependencies

The X.509 Certificate Service supports two dependency types:

  • Key Management Service — resolves signing and subject keys referenced by issuerKeyRef / subjectKeyRef.
  • X.509 Store Service — persists issued certificates. Attach more than one to write the same certificate into several stores.

Keys supplied inline as JWKs (issuerKeyJwk / subjectKeyJwk) do not require a KMS dependency.

Endpoints

MethodPathPurpose
POST/v1/{target}/x509-service-api/csrsCreate a PKCS#10 CSR (stateless).
POST/v1/{target}/x509-service-api/certificatesIssue a certificate.
PUT/v1/{target}/x509-service-api/certificatesIssue or replace a certificate at a known ID.

The earlier endpoints POST /certificate, POST /iso/iacas, and POST /iso/document-signers, and the type-discriminated CSR body, are deprecated. They still work but are superseded by POST / PUT /certificates. See Deprecated endpoints.

Core Features

  • One issuance model — self-signed and CA-signed certificates from the same request shape; issuer identity comes from a stored certificate, an inline PEM, or an issuer key.
  • Certificate profiles — apply a predefined profile to get the required extensions plus post-issuance profile validation: iso-iaca-root / iso-document-signer (ISO/IEC 18013-5, mDL) and etsi-pid-provider / etsi-wallet-provider / etsi-wrpac / etsi-wrprc (ETSI TS 119 412-6, 119 411-8, 119 475, EUDI Wallet). See Certificate profiles.
  • CSR-based issuance — supply a CSR PEM as the subject public key source; its signature is verified for proof-of-possession before issuance.
  • Flexible key sources — signing and subject keys from a linked KMS (…KeyRef) or inline as JWKs (…KeyJwk).
  • Extended certificate extensions — Authority Information Access, Certificate Policies, and Qualified Certificate (QC) Statements, in addition to key usage, SAN/IAN, basic constraints, and CRL distribution points.
  • Configurable persistence — write issued certificates to one or all attached stores, with a service-level default that each request can override.
  • CSR creation — generate PKCS#10 CSRs for external CA workflows.

Get Started

  • Setup — Create the service, set a persistence strategy, attach dependency services.
  • Issue Certificates — Create root, intermediate, leaf, IACA, and Document Signer certificates.
  • CSR Workflows — Create CSRs and issue certificates from them.
Last updated on September 28, 2026
X.509 Store ServiceSetup