Trust and production
Trust in LutraID today is anchored in a single platform CA that LutraID operates. Every issuer and verifier gets a leaf certificate under it, and relying parties must install its root out of band.
How signing keys are anchored
Each issuer and verifier is issued an EC leaf certificate from the LutraID platform root. Issuer leaves carry the credential_issuer URI in their SANs; verifier leaves carry the verifier resource URI and its DNS name — which is what makes the x509_san_dns: and x509_hash: client identifiers resolvable.
Following the ARF, the self-signed root is stripped from every outbound x5c and COSE x5chain. A wallet therefore cannot bootstrap trust from the credential alone.
Installing the root
Editions: Public
curl -s "$LUTRAID_API/v1/trust/platform-root-ca"
# { "certificate": "-----BEGIN CERTIFICATE-----\n…" }
Unauthenticated, returns PEM. On SaaS and self-hosted deployments the root is distributed through the admin console instead.
Not available yet
Plan around these — none of them are implemented:
| EU trusted lists, LOTL, VICAL, IACA registries | not implemented |
| Registering an external CA or uploading your own roots | not implemented |
| Revocation status lists | not implemented |
| Wallet key attestation | policy field only, not validated |
| DID methods | not implemented |
| mTLS sender-constrained tokens | not implemented |
Assurance profiles accept trustPolicy and issuerCertificateMode values, but the evaluator currently only emits warnings — it never rejects.
When verifying an SD-JWT VC, the holder-binding KB-JWT signature is verified,
but the issuer signature is not checked against a trusted issuer registry.
For mdoc, IssuerAuth is verified against the certificate embedded in the
presentation itself, not against an IACA root. Treat presentations from
issuers outside your own deployment accordingly.
Before going live
Give every relying wallet the platform root, keep signing keys in KMS (KEY_BACKEND=aws_kms; demo mode refuses to start with it), and confirm which edition your deployment runs — the route set differs.