Certificates
A Country Signing Certificate (CSC) is needed to verify the
authenticity of the Document Signing Certificate (DSC).
Some countries have made their CSC publicly available. The list
below contains those CSCs that we could find with
Google.
The list has links to government Web and LDAP servers where we found the
certificates. (But please, don't trust us, go to your government's server and
download the certificate yourself!)
A DCS is needed to verify
the authenticity of the contents of the ePassport. Most ePassports
we've seen include the DSC on the passport itself.
If this is not the case for your country you may need to read the DSC from the
ICAO PKD.
Adam Laurie maintains a
list of document signing certificates
read from passports from different countries.
A Certificate Revocation List contains certificates which should no longer be
used for document verification. Those countries publishing CSCs also publish
Certificate Revocation Lists (CRLs). The ICAO PKD also contains CRLs.
Other countries
Some other countries, while not offering their CSC certificate for download, do provide
some information.
Philippe Teuwen did some research into which manufacturers provide technology for which countries.
Using the ICAO PKD files with OpenLDAP
The ICAO PKD currently provides
dumps of the read-only PKD for download (for non-commercial personal
use).
Importing these into OpenLDAP is easy:
- Download the
pkd.xxxxxx.ldif
- Stop
slapd and setup
slapd.conf to use suffix
"dc=data,dc=pkdDownload"
- In the ldif file replace
"
userCertificate::" with
"userCertificate;binary::" and
"certificateRevocationList::" with
"certificateRevocationList;binary::".
slapadd the resulting ldif file and start
slapd.
A JNDI interface to such
a PKD LDAP server is currently supported in the development version of
JMRTD (in SVN).
Certificate validation with OpenSSL
If you wish to verify the signature of the CSC (in file csc.cer)
on some DSC (in file dsc.cer), without relying on JMRTD, here's
how to do it with OpenSSL:
openssl x509 -in csc.cer -inform DER -out csc.pem
openssl x509 -in dsc.cer -inform DER -out dsc.pem
openssl verify -CAfile csc.pem dsc.pem
