Independently issued SD-JWT VCs validate to a configured trust anchor

HAIP 1.0 §6.1.1MUSTRoles: verifier

Requirement as recorded in the ProtocolSoup registry

Independently issued SD-JWT VCs are accepted only after their issuer signature and leaf-only x5c chain validate to an explicitly configured trust anchor.

Read §6.1.1 in HAIP 1.0

Self-test verdict

PassCommit 97df6a8Evaluated 2026-10-11

This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.

Tests

TestExternalSDJWTIssuerRequiresTrustedLeafOnlyX5C
./internal/protocols/oid4vp
Pass

Implementation

backend/internal/protocols/oid4vp/external_issuer_trust.go
backend/internal/protocols/oid4vp/handlers.go

Related requirements

HAIP-VP-001x5c request-object chain excludes the root trust anchor CW-H017ES256 with P-256 and SHA-256 supported for validation

All HAIP 1.0 requirements · OID4VCI protocol page