Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

PKIOverheid G4 migration

Aperta
  • Qualcosa non va?
#4,355 6 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@reinkrul ci sta già lavorando.

Dal 16/6/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

https://www.logius.nl/onze-dienstverlening/toegang/pkioverheid/wees-voorbereid-de-nieuwe-generatie-pkioverheidcertificaten-komen-eraan

First analysis:

New G4 PKIoverheid Private certificates:

  • Can still be used as a client certificate
  • Are still valid for just as long as the current certificates
  • Require support for RSA-PSS as cryptographic algorithm, in line with NCSC (mainly concerns network infrastructure, such as proxies)
  • Require the inclusion of G4 Certificate Authorities in the trust store (action required from Nuts node administrators at software vendors), otherwise a requesting party may be unable to establish a
    connection with a data source holder.
  • It is not yet clear to me from when the G4 certificates will be available

We need to find out what it means for the UZI server-certificate-backed credentials.

TODO:

  • Check CPS statement: what attributes will it contain, how does the CPS differ from the old one
  • Update java-didx509-toolkit if needed (not needed, verified; test in uzi-did-x509-issuer-java#5)
  • Update nuts-node if needed (no production change; tests in #4595)
  • Write migration path for community

did:x509 ca-fingerprints for G4 UZI server certificates

Pin the issuing (TSP) CA, not the shared G4 Root Priv G-TLS: KPN, DigiCert and Digidentity issue under the same root. The ca-fingerprint is the base64url-encoded, unpadded SHA-256 over the DER-encoded CA certificate.

Production Test (acceptatie)
Issuing CA CN=UZI Server - G4 PKIo Priv G-TLS SYS - 2025, organizationIdentifier=NTRNL-50000535, O=CIBG, C=NL CN=ACCEPTATIE UZI Server - G4 Priv G-TLS SYS - 2025, organizationIdentifier=NTRNL-50000535, O=CIBG, C=NL
Chain Staat der Nederlanden - G4 Root Priv G-TLS - 2024 → Staat der Nederlanden - G4 Intm Priv G-TLS SYS - 2024 → issuing CA ACCEPTATIE Zorg CSP - G4 Root Priv G-TLS - 2024 → ACCEPTATIE Zorg CSP - G4 Intm Priv G-TLS SYS - 2024 → issuing CA
Valid 2025-07-17 to 2039-05-18 2026-04-12 to 2039-05-18
Certificate http://cert.pkioverheid.nl/UZIServerG4PKIoPrivGTLSSYS2025.cer http://www.uzi-register-test.nl/cacerts/acceptatie_uzi_server-g4_priv_g-tls_sys-2025.cer
SHA-256 (hex) b034cbfffcafe784edaef49fefad354edbc7823d8d6522d3da6f8e91ff28aa42 b2f2b3371852d3b57574a91e91639957477a028effaaf8ea5de816077d988d91
SHA-1 (hex) 758b611fafbc4d178a88cb4048677ad1456cfb3c 9da8fcc902210f0934382dd6d351d7f0f20c8775
did:x509 prefix did:x509:0:sha256:sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI did:x509:0:sha256:svKzNxhS07V1dKkekWOZV0d6Ao7_qvjqXegWB32YjZE
Policy / discovery pattern ^did:x509:0:sha256:sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI::.*$ ^did:x509:0:sha256:svKzNxhS07V1dKkekWOZV0d6Ao7_qvjqXegWB32YjZE::.*$

UZI Server - G4 PKIo Priv G-TLS SYS - 2024 (vzLz0CQ4GMpgjboDI2aaEDA9mrKoEGiv_jc1ANaUaHo) was revoked on 2025-10-29 and must not be used.

Verify yourself:

curl -sO http://cert.pkioverheid.nl/UZIServerG4PKIoPrivGTLSSYS2025.cer
openssl dgst -sha256 -binary UZIServerG4PKIoPrivGTLSSYS2025.cer | base64 | tr '+/' '-_' | tr -d '='
# sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI

Sources: production CA list https://cert.pkioverheid.nl/ and https://www.uziregister.nl/softwareleveranciers/ca-certificaten-g4 (publishes the root thumbprints, which match); test CA list https://acceptatie.zorgcsp.nl/ca-certificaten.

Migration path for use cases

Every discovery definition and access policy that pins the G1 UZI-register Private Server CA G1 must accept the G4 UZI Server - G4 PKIo Priv G-TLS SYS - 2025 CA next to it until 12-11-2028. Pattern to use (production; the test hierarchy uses the test fingerprints from the table above):

^did:x509:0:sha256:(vdhg746H4rLH67NN1unhdxo6PF3shQunCA4-KQTb2Jc|sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI)[\w\-.:%]*$

Order, per use case:

  1. Update the definition and policy files in the use-case repository (add G4 next to G1, never replace).
  2. The discovery server operator deploys the updated definition and restarts.
  3. Every participant deploys the updated discovery definition and access policy and restarts (both are read at startup). A node running the old files does not see, and does not issue tokens to, participants that use a G4 credential.
  4. Only then may participants switch to a G4 certificate: issue a new X509Credential with the toolkit, load it in the wallet, re-register on the discovery service. Their did:x509 changes.
  5. Add the G4 chain to the truststores: tls.truststorefile (when the gRPC network is active) and the reverse proxy's client-certificate trust for the gRPC and FHIR endpoints. Truststores and instructions: https://nuts.nl/certs (#4603).
  6. After 12-11-2028: remove the G1 fingerprint.

Tracking per use case:

  • #4598 360 graden cliëntbeeld (nl-zorginzage)
  • #4599 Huisartsinzage (Zorginzage Huisarts-VVT), PR toepassing-zorginzage-ha-vvt#52
  • #4600 Zorg bij jou Thuismonitoring
  • #4601 LSPxNuts
  • #4602 Proactieve Zorgplanning (ACP/PZP)
  • #4603 Publish the truststores on nuts.nl/certs
  • #4604 Test the migration path end-to-end with CIBG test certificates
Lingua principale
Go
Stelle
29
Fork
24
Merge medio
2g 18h
PR unite (30g)
45

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nuts-foundation/nuts-node

Tutte le issue di nuts-foundation/nuts-node

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.