Skip to main content

Access Certificate

Certificates and X.509 tend to sound like a purely technical detail you can leave to your developers. For the Access Certificate, that is a mistake — it represents something your organization has to do, not just something your software has to implement. This page explains what it is and why, in plain terms, without the cryptographic detail.

Trust has to run in both directions​

Most people's mental model of the EUDI Wallet starts with the citizen: "the person proves who they are to a service." That is only half the picture.

Think of it as the mirror image of an ID check: just as a bank needs to know its customer is really who they claim to be, the wallet — acting on behalf of its holder — needs to know that the organization asking for data is really who it claims to be, and not an impersonator trying to phish personal information. The Access Certificate is what makes that possible: it is a digital proof for your organization, presented automatically by your systems every time you ask a wallet for data.

The core idea

Before a wallet will hand over any of its holder's data, the Relying Party has to prove who it is to the wallet app — not the other way around. The Access Certificate is how a Relying Party authenticates itself to the wallet.

Who issues it, and why you cannot just generate one yourself​

You cannot simply create your own Access Certificate the way you might generate a password. It is issued by the Registrar — the body responsible for keeping the EUDI Wallet Ecosystem trustworthy by making sure that only genuine, verified organizations can ask wallets for personal data.

Before issuing a certificate, the Registrar has to actually establish that your organization is who it claims to be. In Germany, this legitimation is done through a Know Your Business (KYB) process using your organization's ELSTER certificate — the official digital business identity issued by the German tax authorities, already used to authenticate your organization with government systems. Because ELSTER certificates are themselves issued only after verifying a company's legal registration, they let the Registrar confirm your organization's identity without inventing a new, separate proofing process from scratch.

In practice, this means three things have to happen before your organization can request any data from a wallet:

  1. Register with the Registrar as an organization.
  2. Authenticate and legitimize your organization using your ELSTER certificate, so the Registrar can confirm you are a real, registered legal entity and not an impersonator.
  3. Once legitimation succeeds, the Registrar issues your Access Certificate — the certificate your systems will present to every wallet you interact with going forward. This certificate is bound to a cryptographic key pair that you generate and whose public key you provide during the process.
Sandbox note

This describes the legitimation process for production access to the ecosystem. The Sandbox environment offers a lighter-weight onboarding path to obtain test certificates — see Joining the Ecosystem and the Onboarding Process for how that works.