Verifier
Identity Verification
Anyone can deploy their own document store, therefore it is not sufficient to check the document store name on the smart contract to ensure the identity of an issuer.
To ensure that certificates are issued by the right identity, OpenAttestation provides a solution based on DNS-TXT records.
Additionally, OpenCerts provides a registry to associate the identity of a contract store owner to that of a physical legal entity.
An OpenCerts certificate will have its identity verified if at least one of the following condition is respected:
- the issuer identity is registered in the registry.
- the issuer has a valid DNS-TXT record associated to its document store.
In the event none of the condition above are fulfilled, the certificate will be declared from coming from an unknown source and thus it wont be declared as valid.
Please note that the OpenCerts registry has been ceased.
OpenCerts vs OpenAttestation
As explained above OpenCerts checks that your identity is valid against the registry OR against the DNS records (you need at least one to be valid). However if you use the OpenAttestation CLI to create an OpenCerts document without providing identityProof
(required for DNS records), you will face an error:
❯ ./open-attestation-linux wrap raw-documents wrapped-documents --schema https://schema.opencerts.io/transcripts/2.0
✖ error Document /path/to/cli/raw-documents/opencerts.json is not valid against open-attestation schema
...
✖ error The required property "issuers[0].identityProof" is missing
...
ℹ info You can enable logging by adding DEBUG=open-attestation-cli:* to your command
ℹ info More info on debug: https://www.npmjs.com/package/debug
We strongly encourage you to use identity proof in your documents. However, if for any reason you don't want to use it, you can use this deprecated CLI which does not check for the presence of the identity proof.
However, OpenCerts registry is not compliant with OpenAttestation standards. It's a specific way, used by OpenCerts, to verify the identity of a certificate. Even if we strongly encourage people to use DNS-TXT records, it's not mandatory. The consequence is that a certificate may be identified only thanks to the registry.
In order to support those certificates and to verify the identity of issuers, a custom verifier is needed. Indeed, using OpenAttestation verifier on OpenCerts document without identityProof
will result in an error for the ISSUER_IDENTITY
type.
OpenCerts verify library has been built to handle this problem.
Differences with @govtechsg/oa-verify
OpencertsRegistryVerifier
OpencertsRegistryVerifier
is a new verification method:
- it ensures document
ISSUER_IDENTITY
and works closely withOpenAttestationDnsTxt
verifier (see below) - it returns a
VALID
fragment if at least one of the issuer is in OpenCerts registry - it returns a
SKIPPED
fragment if none of the issuers is in the registry.
isValid
With the addition of OpencertsRegistryVerifier
verification method, different rules apply for ISSUER_IDENTITY
type fragments:
ISSUER_IDENTITY
is valid if at least one issuer is in the registry, i.e. ifOpencertsRegistryVerifier
has statusVALID
- if
OpencertsRegistryVerifier
doesn't haveVALID
status then all issuers must have validDNS-TXT
record.
Please note that the OpenCerts registry has been ceased.