Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

PKIOverheid G4 migration

オープン
  • 何か問題がありますか？
#4,355 コメント 6 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@reinkrul がすでに取り組んでいます。

2026年6月16日 から。

評価

この issue はまだ評価されていません。

説明

https://www.logius.nl/onze-dienstverlening/toegang/pkioverheid/wees-voorbereid-de-nieuwe-generatie-pkioverheidcertificaten-komen-eraan

First analysis:

New G4 PKIoverheid Private certificates:

  • Can still be used as a client certificate
  • Are still valid for just as long as the current certificates
  • Require support for RSA-PSS as cryptographic algorithm, in line with NCSC (mainly concerns network infrastructure, such as proxies)
  • Require the inclusion of G4 Certificate Authorities in the trust store (action required from Nuts node administrators at software vendors), otherwise a requesting party may be unable to establish a
    connection with a data source holder.
  • It is not yet clear to me from when the G4 certificates will be available

We need to find out what it means for the UZI server-certificate-backed credentials.

TODO:

  • Check CPS statement: what attributes will it contain, how does the CPS differ from the old one
  • Update java-didx509-toolkit if needed (not needed, verified; test in uzi-did-x509-issuer-java#5)
  • Update nuts-node if needed (no production change; tests in #4595)
  • Write migration path for community

did:x509 ca-fingerprints for G4 UZI server certificates

Pin the issuing (TSP) CA, not the shared G4 Root Priv G-TLS: KPN, DigiCert and Digidentity issue under the same root. The ca-fingerprint is the base64url-encoded, unpadded SHA-256 over the DER-encoded CA certificate.

Production Test (acceptatie)
Issuing CA CN=UZI Server - G4 PKIo Priv G-TLS SYS - 2025, organizationIdentifier=NTRNL-50000535, O=CIBG, C=NL CN=ACCEPTATIE UZI Server - G4 Priv G-TLS SYS - 2025, organizationIdentifier=NTRNL-50000535, O=CIBG, C=NL
Chain Staat der Nederlanden - G4 Root Priv G-TLS - 2024 → Staat der Nederlanden - G4 Intm Priv G-TLS SYS - 2024 → issuing CA ACCEPTATIE Zorg CSP - G4 Root Priv G-TLS - 2024 → ACCEPTATIE Zorg CSP - G4 Intm Priv G-TLS SYS - 2024 → issuing CA
Valid 2025-07-17 to 2039-05-18 2026-04-12 to 2039-05-18
Certificate http://cert.pkioverheid.nl/UZIServerG4PKIoPrivGTLSSYS2025.cer http://www.uzi-register-test.nl/cacerts/acceptatie_uzi_server-g4_priv_g-tls_sys-2025.cer
SHA-256 (hex) b034cbfffcafe784edaef49fefad354edbc7823d8d6522d3da6f8e91ff28aa42 b2f2b3371852d3b57574a91e91639957477a028effaaf8ea5de816077d988d91
SHA-1 (hex) 758b611fafbc4d178a88cb4048677ad1456cfb3c 9da8fcc902210f0934382dd6d351d7f0f20c8775
did:x509 prefix did:x509:0:sha256:sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI did:x509:0:sha256:svKzNxhS07V1dKkekWOZV0d6Ao7_qvjqXegWB32YjZE
Policy / discovery pattern ^did:x509:0:sha256:sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI::.*$ ^did:x509:0:sha256:svKzNxhS07V1dKkekWOZV0d6Ao7_qvjqXegWB32YjZE::.*$

UZI Server - G4 PKIo Priv G-TLS SYS - 2024 (vzLz0CQ4GMpgjboDI2aaEDA9mrKoEGiv_jc1ANaUaHo) was revoked on 2025-10-29 and must not be used.

Verify yourself:

curl -sO http://cert.pkioverheid.nl/UZIServerG4PKIoPrivGTLSSYS2025.cer
openssl dgst -sha256 -binary UZIServerG4PKIoPrivGTLSSYS2025.cer | base64 | tr '+/' '-_' | tr -d '='
# sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI

Sources: production CA list https://cert.pkioverheid.nl/ and https://www.uziregister.nl/softwareleveranciers/ca-certificaten-g4 (publishes the root thumbprints, which match); test CA list https://acceptatie.zorgcsp.nl/ca-certificaten.

Migration path for use cases

Every discovery definition and access policy that pins the G1 UZI-register Private Server CA G1 must accept the G4 UZI Server - G4 PKIo Priv G-TLS SYS - 2025 CA next to it until 12-11-2028. Pattern to use (production; the test hierarchy uses the test fingerprints from the table above):

^did:x509:0:sha256:(vdhg746H4rLH67NN1unhdxo6PF3shQunCA4-KQTb2Jc|sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI)[\w\-.:%]*$

Order, per use case:

  1. Update the definition and policy files in the use-case repository (add G4 next to G1, never replace).
  2. The discovery server operator deploys the updated definition and restarts.
  3. Every participant deploys the updated discovery definition and access policy and restarts (both are read at startup). A node running the old files does not see, and does not issue tokens to, participants that use a G4 credential.
  4. Only then may participants switch to a G4 certificate: issue a new X509Credential with the toolkit, load it in the wallet, re-register on the discovery service. Their did:x509 changes.
  5. Add the G4 chain to the truststores: tls.truststorefile (when the gRPC network is active) and the reverse proxy's client-certificate trust for the gRPC and FHIR endpoints. Truststores and instructions: https://nuts.nl/certs (#4603).
  6. After 12-11-2028: remove the G1 fingerprint.

Tracking per use case:

  • #4598 360 graden cliëntbeeld (nl-zorginzage)
  • #4599 Huisartsinzage (Zorginzage Huisarts-VVT), PR toepassing-zorginzage-ha-vvt#52
  • #4600 Zorg bij jou Thuismonitoring
  • #4601 LSPxNuts
  • #4602 Proactieve Zorgplanning (ACP/PZP)
  • #4603 Publish the truststores on nuts.nl/certs
  • #4604 Test the migration path end-to-end with CIBG test certificates
主要言語
Go
スター
29
フォーク
24
平均マージ
2日 18時間
マージ済み PR（30日）
45

環境構築

  • Dockerfile または Docker Compose ファイルあり
  • プルリクエストのテンプレートなし
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

nuts-foundation/nuts-node のほかの issue

nuts-foundation/nuts-node の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。