Topic starter
24/10/2026 8:51 pm
TL;DR: EUDI wallet registration cannot authenticate a relying party, according to Procivis, so live requests need cryptographic proof tied to the registered organisation. Wallet trust therefore depends on certificate issuance, revocation, and trust list upkeep, not registration alone.
Editorial analysis by NHI Mgmt Group, based on content published by Procivis: “EUDI Wallet relying party certificates: a technical guide for eIDAS 2.0”.
Key questions
Q: Why do wallet relying party certificates matter when a national register already exists?
A: Because a register can prove eligibility, but it cannot authenticate the party sending a request.
Q: What breaks if certificate issuance is treated as a one-time onboarding task?
A: The trust chain becomes stale as soon as organisations change status, keys rotate, or revocation is needed.
Q: How should organisations separate registration from runtime authentication in wallet ecosystems?
A: Use registration to confirm that an organisation is allowed to participate, then use certificates to prove that a live request really comes from that organisation.
Practitioner guidance
- Define separate lifecycle owners for registration and access certificates Assign one governance path for declared identity and entitlements, and a different one for the certificate used to authenticate live wallet requests.
- Tie issuance to CSR proof of key possession Require a signed certificate signing request before issuance so the requester proves control of the private key that will anchor trust.
- Operationalise revocation and trust list monitoring Monitor certificate revocation lists, OCSP responses, and trust framework updates so removed parties stop being trusted when status changes.
Bottom line: EUDI wallet trust depends on more than registration because a register cannot prove the caller behind a live request.
Glossary terms: Wallet-Relying Party, Certificate Signing Request, Trust Chain, Revocation Mechanism
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Certificate trust is the runtime control that makes wallet registration enforceable. Registration creates permission to participate, but certificates create the ability to prove participation at the moment of interaction. That distinction is central to any digital identity ecosystem that must make policy decisions automatically. For practitioners, the lesson is that governance without cryptographic proof remains advisory, not enforceable.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: How do wallets decide whether to trust a relying party certificate?
A: They validate the certificate chain back to an authorised certificate provider and then to a trusted root in the Member State trust framework. That means trust depends on both cryptographic validity and the operational trust list. If either layer is missing or stale, the wallet should not treat the party as trusted.
👉 Read our full editorial: EUDI wallet relying party certificates must be governed as live PKI
This post was modified 6 days ago by NHI Mgmt Group