Skip to content

[OID4VCI] Document SD-JWT credential signing key setup - #51197

Merged
mposolda merged 2 commits into
keycloak:mainfrom
adorsys:issue-51177
Jul 27, 2026
Merged

[OID4VCI] Document SD-JWT credential signing key setup#51197
mposolda merged 2 commits into
keycloak:mainfrom
adorsys:issue-51177

Conversation

@forkimenjeckayang

@forkimenjeckayang forkimenjeckayang commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Follow-up to #48528.

This updates the OID4VCI issuer configuration guide to document the signing-key requirements for SD-JWT VC issuance.

The documentation now:

  • explains that the signing key must have a non-self-signed leaf certificate and an appropriate X.509 certificate chain;
  • clarifies that generated realm keys are unsuitable for SD-JWT VC signing because their certificate is absent or self-signed;
  • documents the recommended P-256/ES256 setup using the java-keystore key provider;
  • explains certificate-chain ordering and the removal of the trailing self-signed trust anchor from the x5c header;
  • clarifies explicit signing-key selection and active-key fallback behavior;
  • documents the relevant CredentialSignerException failure cases;
  • notes that these certificate requirements do not apply to JWT VC issuance.

Closes #51177

@forkimenjeckayang
Document SD-JWT credential signing key setup
4c5b4af 
Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
@forkimenjeckayang
forkimenjeckayang requested a review from a team as a code owner July 27, 2026 13:27
Copilot AI review requested due to automatic review settings July 27, 2026 13:27
@forkimenjeckayang forkimenjeckayang mentioned this pull request Jul 27, 2026
Open
Copilot AI reviewed Jul 27, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Documents SD-JWT VC signing-key and certificate-chain requirements for OID4VCI issuers.

Changes:

  • Adds P-256/ES256 Java keystore setup guidance.
  • Explains key selection, certificate-chain handling, and failure cases.
  • Distinguishes SD-JWT VC requirements from JWT VC issuance.

Comment thread docs/documentation/server_admin/topics/oid4vci/vc-issuer-configuration.adoc Outdated
@forkimenjeckayang
adjust copilot review comment
a7950f2 
Signed-off-by: forkimenjeckayang <forkimenjeckayang@gmail.com>
Copilot AI review requested due to automatic review settings July 27, 2026 13:43
Copilot AI reviewed Jul 27, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

@mposolda mposolda self-assigned this Jul 27, 2026
mposolda
mposolda approved these changes Jul 27, 2026
View reviewed changes

@mposolda mposolda left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@forkimenjeckayang Thanks!

@mposolda
mposolda merged commit 70e4d1d into keycloak:main Jul 27, 2026
68 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@mposolda mposolda mposolda approved these changes

Assignees

@mposolda mposolda

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[OID4VCI] Do we need better documentation related to setup of credential signing keys?

3 participants

@forkimenjeckayang @mposolda