HAIP Verifier — operator setup

Runbook for IT admins deploying the CodeB HAIP Verifier on a per-tenant IIS site. Covers the three operator-supplied trust-anchor stores, the two related tenant settings, and the post-deploy smoke tests that confirm each store is wired up correctly.

Optional setup, honest gates. The verifier boots and serves traffic without any trust anchors configured. But without them, HAIP-conformant credential paths return HTTP 501 with a clear diagnostic (mdoc_verify_not_configured, wallet_attestation_not_configured) rather than silently trusting anything. This page is what an operator does before going live.

1. mDoc issuer anchors

Directory: App_Data/<tenant>/trust/mdoc-issuers/
File format: *.cer or *.crt — DER- or PEM-encoded X.509 certificates
Purpose: Trust roots for ISO 18013-5 mDoc credentials. The verifier walks the x5chain in every DeviceResponse IssuerAuth COSE_Sign1 and requires termination at one of these anchors.
Missing state: HTTP 501 mdoc_verify_not_configured on every mDoc credential-verify call and on any VP whose token starts with an mso_mdoc CBOR map header.
How to obtain: From your PID issuer or the issuing authority of the member state whose mDL / PID you want to accept. Also usable for your own MDocIssuer test root.

New-Item -ItemType Directory -Force `
  -Path 'C:\inetpub\wwwroot\<tenant>\App_Data\<tenant>\trust\mdoc-issuers'
Copy-Item .\pid-issuer-root.cer `
  'C:\inetpub\wwwroot\<tenant>\App_Data\<tenant>\trust\mdoc-issuers\'

2. Wallet-provider anchors — HAIP §5.11

Directory: App_Data/<tenant>/trust/wallet-providers/
File format: *.jwks.json (JSON Web Key Set) or *.pem (SPKI or X.509 CERT)
Purpose: Public keys that signed the Wallet Attestation JWT presented by a wallet on OID4VP requests (draft-ietf-oauth-attestation-based-client-auth).
Missing state: HTTP 501 wallet_attestation_not_configured whenever a wallet supplies wallet_attestation or the tenant has Oidc:WalletAttestationRequired=true.
How to obtain: From the wallet vendor's attestation-issuer service (JWKS endpoint export) or the operator you have contracted to issue attestations.

Invoke-WebRequest 'https://wallet-vendor.example/attestation-issuer/jwks.json' `
  -OutFile 'C:\inetpub\wwwroot\<tenant>\App_Data\<tenant>\trust\wallet-providers\vendor-a.jwks.json'

3. SD-JWT VC issuer anchors — LOTL overlay

Directory: App_Data/<tenant>/trust/vc-issuers/ (preferred). Legacy fallback: App_Data/<tenant>/trust/mdoc-issuers/.
File format: *.cer or *.crt — DER- or PEM-encoded X.509
Purpose: Operator-supplied overlay on top of the built-in EU LOTL cache. Iter-3 / iter-3b of the SD-JWT VC issuer chain gate in oidc.ashx requires the x5c chain in the VC's JWS header to terminate at either the LOTL cache or one of these anchors.
Missing state: If both this dir and the fallback are empty, the built-in LOTL cache is used alone. When the LOTL cache also has no match, behaviour depends on Oidc:LotlRequireChain: strict mode → HTTP 400 unresolved; non-strict → iter-2 SAN-only path or lower.
How to obtain: The EU List-of-the-Lists at ec.europa.eu/tools/lotl/eu-lotl.xml, your member state's Trusted List (TSL), or any issuer root you have received out-of-band.

Per-tenant settings

Setting	Default	Effect when enabled
Oidc:WalletAttestationRequired	false	Verifier advertises `wallet_attestation_required=true` in the JAR and rejects OID4VP responses without a valid `wallet_attestation` JWT.
Oidc:LotlRequireChain	false	Strict-mode SD-JWT VC: iter-3 that cannot resolve the `x5c` chain fails closed (HTTP 400) instead of falling through to iter-2 SAN-only.
Recording:AppDataRoot	(unset)	Overrides the default `App_Data/<tenant>/recordings/` output directory — useful for pointing at a dedicated volume.

Set via App_Data/<tenant>/appsettings.json or through the tenant admin UI (Settings → OIDC / Recording).

Post-deploy smoke tests

Every script targets a running tenant and either exits 0 (green) or prints a diagnostic. Run them from any Windows/Linux host that can reach the tenant HTTPS endpoint.

Script	What it exercises
testscripts/mdoc-cred-verify-smoke.py	Round-trips a self-issued mDoc through the credential-verify endpoint. Green means anchors under `trust/mdoc-issuers/` are loaded and chain-walk succeeds.
testscripts/wallet-attestation-smoke.py	Sends an OID4VP flow with a Wallet Attestation JWT and PoP. Green means anchors under `trust/wallet-providers/` are loaded and JWT verifies.
testscripts/lotl-iter3-smoke.py	Presents an SD-JWT VC with an `x5c` chain and confirms iter-3 walks up to the operator overlay or the EU LOTL cache.
testscripts/wa-pop-selfcheck.py	Exercises the Wallet Attestation verifier's negative paths (bad alg, missing cnf, missing iat, PoP nonce/aud mismatch) without production credentials. Green means all reject branches surface their expected diagnostic reasons.
testscripts/dcql-smoke.py	Drives an OID4VP 1.0 FINAL DCQL query end-to-end — a good final sanity check after all three anchor stores are in place.

Honesty. The verifier is HAIP-1.0-FINAL conformance-tested against the OpenID Foundation alpha suite (self-test evidence). It is not yet listed on the OIDF certified-implementations page — formal submission is on the roadmap. The mDoc / wallet-attestation / LOTL overlay paths documented here are spec-compliant against their respective specifications; independent certification of those specific paths follows once the OIDF harness ships coverage.

Last updated 2026-07-23. Related pages: HAIP Verifier conformance · EU Wallet Verifier reference · API reference · Deutsch