Class StaticTrustListResolver

Namespace

Tessio.Verifier.Trust

Assembly

Tessio.Verifier.Trust.dll

Trust resolver backed by a fixed set of trusted issuer identifiers, plus optional trust-anchor certificates for issuers that present an X.509 chain. Suitable for development, tests and small deployments. Load the identifier set from a JSON file or URL with TrustListLoader.

public sealed class StaticTrustListResolver : ITrustListResolver

Inheritance

object

StaticTrustListResolver

Implements

ITrustListResolver

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The trust mechanism depends on how the key was resolved. A key resolved from issuer metadata is trusted exactly when its issuer identifier is on the configured list, proven by control of the issuer's HTTPS origin. A key resolved from an x5c (or x5chain) header is trusted when its chain anchors on one of trustAnchors (or the leaf itself is a pinned anchor); the identifier is not required to be on the list, because anyone can put any name in a certificate, so the X.509 chain is the proof. This is the only mechanism ISO mdoc has, where the issuer identifier is a Document Signer subject DN that no list enumerates. Binding the certificate to a claimed issuer, where that applies, is the caller's concern: SD-JWT VC ties iss to a certificate SAN before this point. Without configured anchors, x5c credentials are rejected.

This is the open-source end of the trust seam. Production EU trust (LOTL, national lists, WRPAC) is a separate concern behind the same ITrustListResolver interface.

Constructors

StaticTrustListResolver(IEnumerable<string>, string, IEnumerable<X509Certificate2>?)

Creates a resolver trusting exactly the given issuer identifiers.

public StaticTrustListResolver(IEnumerable<string> trustedIssuers, string source = "static", IEnumerable<X509Certificate2>? trustAnchors = null)

Parameters

trustedIssuers IEnumerable<string>

Issuer identifiers (iss values or certificate subjects).

source string

Optional label reported as TrustListSource.

trustAnchors IEnumerable<X509Certificate2>

Root or pinned certificates that x5c chains must anchor on. Credentials presenting an x5c chain are rejected when this is empty.

Methods

ResolveAsync(string, ReadOnlyMemory<byte>[], CancellationToken)

public Task<IssuerTrustStatus> ResolveAsync(string issuer, ReadOnlyMemory<byte>[] x5c, CancellationToken ct = default)

Parameters

issuer string

Issuer identifier from the credential (e.g., an HTTPS URI for JWT VC Issuer Metadata).

x5c ReadOnlyMemory<byte>[]

Optional X.509 chain from the credential header (DER-encoded, leaf first).

ct CancellationToken

Cancellation token.

Returns

Task<IssuerTrustStatus>