Wallet Attestation x5c, no reuse across Issuers, client_id equals sub

Requirement as recorded in the ProtocolSoup registry

When using OID4VCI Appendix E Wallet Attestations, the validating certificate and chain excluding the trust anchor are included in the Client Attestation JWT x5c, attestations MUST NOT be reused across Issuers, the attestation sub MUST be shared across Wallet instances of that type, and PAR client_id MUST equal the attestation sub.

Self-test verdict

Tests

• TestClientAttestationIssuerEnvOverride

  ./cmd/walletharness

  Pass
• TestHAIPAttestationJWTBuildersUseExpectedHeaders

  ./cmd/walletharness

  Pass
• TestPushAuthorizationRequestFetchesChallengeEndpoint

  ./cmd/walletharness

  Pass
• TestBuildClientAttestationPoPJWTIncludesChallengeClaim

  ./cmd/walletharness

  Pass

Implementation

• backend/cmd/walletharness/haip_issuance.go
• backend/cmd/walletharness/oid4vci_client.go

Related requirements