Trust Infrastructure · Reader Authentication
ONEPROOF Reader Auth
Reader Certificates, On Your Infrastructure
Generate and validate ISO 18013-5 compliant reader authentication certificates, the IACA root and reader signer your verifier presents to the holder's wallet during device retrieval. Everything runs locally: private keys never leave your machine. Available today as a Docker image or a single binary.
Also distributed as a single binary for macOS, Linux, and Windows.
What It Generates
Two Certificates. Exact Annex B Profiles.
During device retrieval, your reader proves its identity to the holder's wallet with a reader authentication certificate. Wallets reject certificates that deviate from the ISO profiles. Reader Auth produces both certificates to the letter of the standard.
IACA Root CA Certificate
Your organization's root certificate authority for reader authentication. Correct key usage (keyCertSign + cRLSign), basic constraints (CA:TRUE, pathLen:0), issuer alternative name, and root validity up to 20 years, exactly as the profile requires.
Reader Auth Signer Certificate
The end-entity certificate your reader presents to the holder's wallet during device retrieval. Extended key usage mdlReaderAuth (1.0.18013.5.1.6), digitalSignature key usage, and the 1187-day maximum validity enforced automatically.
Compliance Validator
Validate Certificates You Already Have
Bring existing reader certificates and check them against the standard before a wallet rejects them in the field. The validator enforces:
Certificate chain integrity against your Root CA
Key usage and extended key usage OIDs per Annex B
Validity period bounds, including the 1187-day reader auth maximum
Serial number entropy (63–71 bits, CSPRNG-generated)
Required subject fields, including mandatory country
Signature algorithm and curve consistency (P-256 / P-384)
Full ISO 18013-5 Annex B profile compliance
Technical Specifications
Reader Auth Specifications
Stand up ISO-compliant reader authentication today.
Generate your reader certificates in minutes, on your own infrastructure. All engagements are enterprise qualified.
Get Reader Auth