---
title: "Overview"
description: "The X.509 Certificate Service issues X.509 certificates for PKI deployments, including ISO/IEC 18013-5 compliant certificates for mobile driving licence (mDL) ecosystems. It supports self-signed IACA certificates,…"
stack: "Enterprise Stack (commercial) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/x509-service/overview
generated: 2026-07-20
---
# Overview

The X.509 Certificate Service issues X.509 certificates for PKI deployments, including ISO/IEC 18013-5 compliant certificates for mobile driving licence (mDL) ecosystems. It supports self-signed IACA certificates, Document Signer certificates, generic CA and leaf certificates, and PKCS#10 Certificate Signing Requests (CSRs).

By default, the service is stateless. If one or more [X.509 Store services](https://docs.walt.id/enterprise-stack/services/x509-store-service/overview.md) are attached as dependencies, issued certificates can also be persisted automatically.

**Note:**

The X.509 Certificate Service is controlled by the `x509` feature flag. The flag is enabled by default via the [`_features.conf`](https://docs.walt.id/enterprise-stack/setup/configurations/config-files/features.md). This means the service is available unless you explicitly add `x509` to `disabledFeatures`.

## Service Dependencies

The X.509 Certificate Service supports two dependency types:

- [Key Management Service](https://docs.walt.id/enterprise-stack/services/key-management-service/overview.md) for requests that use `kms-hosted-key-descriptor`.
- [X.509 Store Service](https://docs.walt.id/enterprise-stack/services/x509-store-service/overview.md) for persisting issued certificates.

If a request uses `jwk-encoded-key-descriptor`, no KMS dependency is required for that key input.

## Core Features

- **Generic Certificates**: Issue self-signed or CA-signed X.509 certificates with full control over extensions, key usage, and validity.
- **ISO mDL Certificates**: Issue self-signed IACA root certificates and Document Signer certificates anchored to an IACA.
- **CSR-based Issuance**: Accept CSR PEM as a subject public key source for Document Signer and generic certificate issuance, enabling proof-of-possession workflows.
- **Flexible Key Sources**: Accept signing keys from linked KMS services or directly as JWKs.
- **Automatic Persistence**: Persist issued certificates into all attached X.509 Store services when configured.
- **CSR Creation**: Generate PKCS#10 Certificate Signing Requests for use in external CA workflows or CSR-based certificate issuance.

## Get Started

- [Setup](https://docs.walt.id/enterprise-stack/services/x509-service/setup.md) - Create the service and attach optional dependency services.
- [Issue Certificates](https://docs.walt.id/enterprise-stack/services/x509-service/issue-certificates.md) - Create IACA, Document Signer, and generic certificates.
- [CSR Workflows](https://docs.walt.id/enterprise-stack/services/x509-service/csr-workflows.md) - Create CSRs and use them for certificate issuance.