Enable publishing IACA certificates

[selfissued]

Fixes #62

[peppelinux]

If I got it well, I recap:

• mdoc_iacas_uri points to an HTTPs resource that publishes a json object containing trust anchors' certificates needed to verify the mdoc issued by a VCI

may we use the certificate's CN/Subject as key name, instead of "certificate"? that would help the resolution of the issuer in a human readable way.

or, wdyt about having the certificate issuer's entity id in addition to that "certificate" member name?

[Sakurann]

there is no agreement on the issue to do this PR

[Sakurann]

even if we agree to add something like this, I am not sure this should be an mdoc specific parameter. if we agree, this is useful, it should be a generic parameter in the issuer metadata section. otherwise, it should go into an mdoc profile, not VCI.

[selfissued]

As I saw it, the discussion in the issue was mostly about how to do it - not whether it was needed - hence the PR to give us a concrete proposal on a way to do it to discuss.

Unless you can get the root signing keys, you can't evaluate the X.509 certificate chain, so there's clearly a need for something like this.

If someone wants to propose a concrete way of generalizing this so that it's not mdoc specific, should that be the direction that people want to go, we could also discuss that.

Anyway, it seems like putting this topic on a call agenda would be productive.

[tplooker]

I agree with @selfissued without a mechanism like the proposed the issuance of mdocs is at best incomplete because there is no way to verify the credentials that are issued, we should discuss it more on the next editors call

[tlodderstedt]

I object against this proposal. I don't think this is in scope for the oid4vci spec.

[awoie]

IMO, the IACA could go into the issuer metadata and more specifically the credential format-specific metadata where also claims are described. The reason is why this makes sense is that different types can have different X.509 cert profiles and issuers.

[awoie]

IMO, the IACA could go into the issuer metadata and more specifically the credential format-specific metadata where also claims are described. The reason is why this makes sense is that different types can have different X.509 cert profiles and issuers.

I made a proposal here #161 by using @selfissued language. @selfissued please feel free to update this PR using #161 if the group feels more comfortable making this a Credential Issuer mso_mdoc-specific metadata which I think is the right approach.

[Sakurann]

closing this in a week, unless strong objections, because there is #161 and also not enough discussion on the topic.