If you're implementing OpenID for Verifiable Presentations (OpenID4VP) or OpenID for Verifiable Credential Issuance (OpenID4VCI), you need a clear path from development to public certification. The OpenID Foundation's conformance test suites are now open for self-certification. Certifying early can establish your organization as a benchmark in the digital identity ecosystem.
This checklist guides you through the self-certification process. Use it to prepare your implementation, run the tests, interpret the results, and submit for formal certification.
Purpose of This Checklist
This checklist helps you navigate OpenID Foundation self-certification for OpenID4VP and OpenID4VCI when used with the High Assurance Interoperability Profile (HAIP). It's designed for:
- Wallet providers preparing for production deployment
- Credential issuers building verifiable credential infrastructure
- Verifiers (relying parties) accepting digital credentials
- Technology vendors supporting any of these roles
Use this checklist to ensure your implementation conforms to the specifications before public deployment. The OpenID Foundation hosts the conformance tests at no charge, and self-certification places your implementation on the Foundation's public registry.
Prerequisites
Before you begin testing:
Infrastructure Access
- Network connectivity to OpenID Foundation test infrastructure or capacity to run tests on your own systems
- TLS certificates for your test endpoints
- Test credentials and signing keys for your implementation role
Implementation Readiness
- Your implementation must handle both success and failure scenarios
- You need working endpoints for all required operations in your role
- Your code must support the High Assurance Interoperability Profile
Role Clarity
- For OpenID4VP: determine if you're testing as a wallet or verifier/relying party
- For OpenID4VCI: determine if you're testing as an issuer or wallet provider
- Each role has dedicated test profiles
Documentation Access
- OpenID4VP specification
- OpenID4VCI specification
- HAIP profile requirements
- Your implementation's configuration documentation
Certification Checklist
Phase 1: Pre-test Configuration
☐ Identify Your Implementation Role
- Wallet (OpenID4VP)
- Verifier/relying party (OpenID4VP)
- Issuer (OpenID4VCI)
- Wallet provider (OpenID4VCI)
☐ Document Your Configuration
- List all endpoints your implementation exposes
- Document supported credential formats
- Note any optional features you've implemented
- Record cryptographic algorithms in use
☐ Set Up Test Environment
- Deploy test instance separate from production
- Configure logging to capture full request/response cycles
- Enable detailed error reporting
- Verify network connectivity to test infrastructure
☐ Review HAIP Requirements
- Confirm you meet mandatory security controls
- Verify signature validation implementation
- Check disclosure limitation mechanisms
- Validate session management approach
Phase 2: Execute Conformance Tests
☐ Access Test Suite
- Navigate to OpenID Foundation conformance test portal
- Select your specification (OpenID4VP or OpenID4VCI)
- Choose your implementation role
- Review test scope and coverage
☐ Configure Test Parameters
- Enter your endpoint URLs
- Specify supported credential types
- Declare optional features under test
- Set timeout values appropriate to your infrastructure
☐ Run Required Test Cases
- Execute all mandatory success scenarios
- Complete all mandatory failure scenarios
- Verify error handling for malformed requests
- Test credential validation logic
- Confirm proper rejection of invalid signatures
☐ Run Optional Test Cases (if applicable)
- Test any optional features you claim to support
- Verify backward compatibility if relevant
- Check interoperability with alternative encodings
☐ Capture Test Results
- Download full test report
- Save detailed logs for failed tests
- Document any unexpected behavior
- Note test environment configuration
Phase 3: Analyze Results
☐ Review Pass/Fail Status
- Identify which requirements passed
- List all failed test cases
- Categorize failures by severity
- Check if failures are in required or optional features
☐ Investigate Failures
- Review detailed error messages
- Compare your implementation against specification requirements
- Check for configuration issues vs. code defects
- Reproduce failures in isolated test cases
☐ Plan Remediation
- Prioritize required fixes over optional features
- Estimate effort for each fix
- Identify dependencies between fixes
- Set target date for retest
☐ Implement Fixes
- Make code changes to address failures
- Update configuration if needed
- Add automated tests for previously failed scenarios
- Document changes in implementation notes
☐ Retest
- Run conformance tests again
- Verify all previously failed tests now pass
- Confirm fixes didn't break passing tests
- Achieve clean pass on all required tests
Phase 4: Submit for Certification
☐ Prepare Certification Package
- Confirm all required tests pass
- Prepare implementation description
- Document any deviations or notes
- Review OpenID Foundation fee schedule
☐ Submit Application
- Complete self-certification form
- Upload test results
- Provide implementation details
- Submit payment if applicable
☐ Respond to Review
- Monitor for OpenID Foundation questions
- Provide clarifications if requested
- Address any issues identified during review
- Confirm final approval
☐ Publication
- Verify your listing on OpenID Foundation website
- Check accuracy of published details
- Note certification date and scope
- Plan communication to partners and customers
Customizing This Checklist
Add Role-Specific Steps
If you're testing a wallet, add:
- Verify credential storage security
- Test selective disclosure mechanisms
- Confirm user consent flows
If you're testing an issuer, add:
- Validate credential signing process
- Test batch issuance if supported
- Verify credential revocation handling
Integrate with Your SDLC
Map these steps to your development workflow:
- Run Phase 1 during feature complete
- Execute Phase 2 during integration testing
- Complete Phase 3 before release candidate
- Submit Phase 4 before production deployment
Track Optional Features
Create a separate section for optional features you support:
- List each optional feature by specification reference
- Note business justification for including it
- Track test coverage for optional features
- Document any partial implementations
Add Jurisdiction Requirements
If you're deploying in specific jurisdictions, add:
- Review local regulatory requirements
- Identify jurisdiction-specific test profiles
- Verify compliance with regional privacy laws
- Check for additional certification needed
Validation Steps
After you complete certification:
Verify Your Public Listing
- Check openid.net/certification for your entry
- Confirm role and specification version are correct
- Verify certification date and validity period
Test Interoperability
- Exchange credentials with other certified implementations
- Verify end-to-end flows work as expected
- Document any interoperability issues
- Report findings to OpenID Foundation if needed
Monitor for Updates
- Subscribe to OpenID Foundation announcements
- Track specification updates
- Plan recertification when specifications change
- Budget for ongoing conformance testing
Communicate Certification
- Notify ecosystem partners of your certification
- Update technical documentation
- Add certification badge to marketing materials
- Include certification status in RFP responses
Organizations participating in OpenID4VP and OpenID4VCI interoperability testing achieved pass rates over 90% for OpenID4VP and 87% for OpenID4VCI. These numbers reflect real implementations working through the test suites. Your results will improve with each iteration.
Early certification carries weight. In Brazil, OpenID Foundation certification began as voluntary and became a regulatory requirement for open banking participation. The EU Digital Identity Wallet ecosystem and other jurisdictions are in active dialogue with the OpenID Foundation about conformance requirements. Self-certify now, and you'll be listed publicly as a benchmark implementation when those requirements take effect.
