Attribute certificates
An attribute certificate doesn't bind a key pair to its holder: it attests a characteristic of the holder, such as a professional ID (PrivateID) or a Brazilian student ID card (CIE).
Before you start
Attribute certificates are issued by a CA set up to issue them, which is not the CA that issues public-key certificates: the samples
keep its id in a separate setting, attributeCaId. Operators can create such a CA on the dashboard.
TODO(docs): no page explains how to create a CA for attribute certificates.
Flow
- Create the order on the attribute CA, with
kindset toAttributeand the parameters of the certificate's format. - Issue the certificate without a CSR, since an attribute certificate has no key pair of its own.
- Store the certificate's content.
| Format | Order endpoint | Required parameters |
|---|---|---|
| Brazilian student ID card (CIE) | POST /api/orders/cie | name, registrationNumber, degree, course and institution (name, city, state) |
| PrivateID | POST /api/orders/private-id | name, cpf, idNumber |
A CIE order also takes eea, cpf, birthDate, idNumber, idIssuer and idIssuerState.
Since Amplia 4.15.0, operators can also create CIE orders on a dashboard form.
TODO(docs): what the CIE and PrivateID fields mean (for example eea).
Example
The only sample is in PHP. It creates a CIE order and issues the certificate with a null CSR:
use Lacuna\Amplia\CreateOrderRequest;
use Lacuna\Amplia\CertificateKinds;
use Lacuna\Amplia\CieCertificateParameters;
use Lacuna\Amplia\CieInstitution;
$client = Util::getAmpliaClient();
$createOrderRequest = new CreateOrderRequest();
$createOrderRequest->caId = getConfig()['amplia']['attributeCaId'];
$createOrderRequest->validityEnd = Util::getDateYearsFromNow(2);
$createOrderRequest->kind = CertificateKinds::ATTRIBUTE;
$parameters = new CieCertificateParameters();
$parameters->name = $name;
$parameters->cpf = $cpf;
$parameters->eea = $eea;
$parameters->degree = $degree;
$parameters->course = $course;
$parameters->registrationNumber = $registrationNumber;
$institution = new CieInstitution();
$institution->name = $institutionName;
$institution->city = $institutionCity;
$institution->state = $institutionState;
$parameters->institution = $institution;
$createOrderRequest->parameters = $parameters;
$order = $client->createOrder($createOrderRequest);
$cert = $client->issueCertificate($order->getId(), null);
$fileId = StorageMock::store($cert->getContentRaw(), '.ac');
The PHP client sends the null CSR to POST /api/v2/certificates, as for any other certificate; none of the client libraries has a
method of its own for attribute certificates.
An attribute certificate has no standard file extension: the sample stores it as .ac.
Use the certificate
PKI SDK decodes, validates and issues X.509 attribute certificates in .NET applications. Attribute certificates can be revoked like any other.