PKIOverheid G4 migration
维护者通常 1 天内回复
@reinkrul 已经在做这个了。
开始于 2026年6月16日。
评估
这个 Issue 还没有评估数据。
描述
First analysis:
New G4 PKIoverheid Private certificates:
- Can still be used as a client certificate
- Are still valid for just as long as the current certificates
- Require support for RSA-PSS as cryptographic algorithm, in line with NCSC (mainly concerns network infrastructure, such as proxies)
- Require the inclusion of G4 Certificate Authorities in the trust store (action required from Nuts node administrators at software vendors), otherwise a requesting party may be unable to establish a
connection with a data source holder. - It is not yet clear to me from when the G4 certificates will be available
We need to find out what it means for the UZI server-certificate-backed credentials.
TODO:
- Check CPS statement: what attributes will it contain, how does the CPS differ from the old one
- Update java-didx509-toolkit if needed (not needed, verified; test in uzi-did-x509-issuer-java#5)
- Update nuts-node if needed (no production change; tests in #4595)
- Write migration path for community
did:x509 ca-fingerprints for G4 UZI server certificates
Pin the issuing (TSP) CA, not the shared G4 Root Priv G-TLS: KPN, DigiCert and Digidentity issue under the same root. The ca-fingerprint is the base64url-encoded, unpadded SHA-256 over the DER-encoded CA certificate.
| Production | Test (acceptatie) | |
|---|---|---|
| Issuing CA | CN=UZI Server - G4 PKIo Priv G-TLS SYS - 2025, organizationIdentifier=NTRNL-50000535, O=CIBG, C=NL |
CN=ACCEPTATIE UZI Server - G4 Priv G-TLS SYS - 2025, organizationIdentifier=NTRNL-50000535, O=CIBG, C=NL |
| Chain | Staat der Nederlanden - G4 Root Priv G-TLS - 2024 → Staat der Nederlanden - G4 Intm Priv G-TLS SYS - 2024 → issuing CA |
ACCEPTATIE Zorg CSP - G4 Root Priv G-TLS - 2024 → ACCEPTATIE Zorg CSP - G4 Intm Priv G-TLS SYS - 2024 → issuing CA |
| Valid | 2025-07-17 to 2039-05-18 | 2026-04-12 to 2039-05-18 |
| Certificate | http://cert.pkioverheid.nl/UZIServerG4PKIoPrivGTLSSYS2025.cer | http://www.uzi-register-test.nl/cacerts/acceptatie_uzi_server-g4_priv_g-tls_sys-2025.cer |
| SHA-256 (hex) | b034cbfffcafe784edaef49fefad354edbc7823d8d6522d3da6f8e91ff28aa42 |
b2f2b3371852d3b57574a91e91639957477a028effaaf8ea5de816077d988d91 |
| SHA-1 (hex) | 758b611fafbc4d178a88cb4048677ad1456cfb3c |
9da8fcc902210f0934382dd6d351d7f0f20c8775 |
| did:x509 prefix | did:x509:0:sha256:sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI |
did:x509:0:sha256:svKzNxhS07V1dKkekWOZV0d6Ao7_qvjqXegWB32YjZE |
| Policy / discovery pattern | ^did:x509:0:sha256:sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI::.*$ |
^did:x509:0:sha256:svKzNxhS07V1dKkekWOZV0d6Ao7_qvjqXegWB32YjZE::.*$ |
UZI Server - G4 PKIo Priv G-TLS SYS - 2024 (vzLz0CQ4GMpgjboDI2aaEDA9mrKoEGiv_jc1ANaUaHo) was revoked on 2025-10-29 and must not be used.
Verify yourself:
curl -sO http://cert.pkioverheid.nl/UZIServerG4PKIoPrivGTLSSYS2025.cer
openssl dgst -sha256 -binary UZIServerG4PKIoPrivGTLSSYS2025.cer | base64 | tr '+/' '-_' | tr -d '='
# sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI
Sources: production CA list https://cert.pkioverheid.nl/ and https://www.uziregister.nl/softwareleveranciers/ca-certificaten-g4 (publishes the root thumbprints, which match); test CA list https://acceptatie.zorgcsp.nl/ca-certificaten.
Migration path for use cases
Every discovery definition and access policy that pins the G1 UZI-register Private Server CA G1 must accept the G4 UZI Server - G4 PKIo Priv G-TLS SYS - 2025 CA next to it until 12-11-2028. Pattern to use (production; the test hierarchy uses the test fingerprints from the table above):
^did:x509:0:sha256:(vdhg746H4rLH67NN1unhdxo6PF3shQunCA4-KQTb2Jc|sDTL__yv54TtrvSf7601TtvHgj2NZSLT2m-Okf8oqkI)[\w\-.:%]*$
Order, per use case:
- Update the definition and policy files in the use-case repository (add G4 next to G1, never replace).
- The discovery server operator deploys the updated definition and restarts.
- Every participant deploys the updated discovery definition and access policy and restarts (both are read at startup). A node running the old files does not see, and does not issue tokens to, participants that use a G4 credential.
- Only then may participants switch to a G4 certificate: issue a new X509Credential with the toolkit, load it in the wallet, re-register on the discovery service. Their did:x509 changes.
- Add the G4 chain to the truststores:
tls.truststorefile(when the gRPC network is active) and the reverse proxy's client-certificate trust for the gRPC and FHIR endpoints. Truststores and instructions: https://nuts.nl/certs (#4603). - After 12-11-2028: remove the G1 fingerprint.
Tracking per use case:
- #4598 360 graden cliëntbeeld (nl-zorginzage)
- #4599 Huisartsinzage (Zorginzage Huisarts-VVT), PR toepassing-zorginzage-ha-vvt#52
- #4600 Zorg bij jou Thuismonitoring
- #4601 LSPxNuts
- #4602 Proactieve Zorgplanning (ACP/PZP)
- #4603 Publish the truststores on nuts.nl/certs
- #4604 Test the migration path end-to-end with CIBG test certificates
- 主要语言
- Go
- 星标
- 29
- 派生
- 24
- 平均合并
- 2 天 5 小时
- 30 天内合并 PR
- 37
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
nuts-foundation/nuts-node 的其他 Issue
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
nuts-foundation/nuts-node#4450 ·
维护者通常 1 天内回复
-
bug discuss
难度 1/5 1 小时以内 新手友好度 88/100
nuts-foundation/nuts-node#4436 ·
维护者通常 1 天内回复
-
auth bug
难度 2/5 1-3 小时 新手友好度 82/100
nuts-foundation/nuts-node#4435 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
nuts-foundation/nuts-node#4321 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 88/100
nuts-foundation/nuts-node#4230 ·
维护者通常 1 天内回复
查看 nuts-foundation/nuts-node 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 82/100
-
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
enhancement
难度 1/5 1-3 小时 新手友好度 76/100
superplanehq/superplane#9007 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复