[Openid-specs-digital-credentials-protocols] openid/oid4vc-haip-sd-jwt-vc: Comment created on issue 103

[github at oidf.org]

openid/oid4vc-haip-sd-jwt-vc event

Issue Comment created on issue 103
Issue Title: SD-JWT VC requires `iss` value to be a URI
https://github.com/openid/oid4vc-haip-sd-jwt-vc/issues/103

Comment: So my analysis is: - we want Issuers to support both web-based and x509 keys at the same time - almost all x509 certificates today use dNSName SAN - SD-JWT VC disallows us this usecase as `iss` can only either be https:// or dns:// - I believe nobody has implemented `iss` with "dns://..." - my proposal: always use HTTPS URL for `iss`, matchting rules for for certificate from `x5c` header is that - X509 Certificate with uniformResourceIdentifier SAN must match with `iss` - X509 Certificate with dNSName SAN must match the FQDN of the `iss`
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-digital-credentials-protocols/attachments/20240524/584b4055/attachment.html>