OpenG2P — Verifiable Credentials

Issuance of Verifiable Credentials for OpenG2P registries, via MOSIP Inji Certify.

Phase 1 — paper credential. A credential is issued assisted: an authenticated agent looks a citizen up by their functional ID, the Agent Portal API pushes the claims to Certify, Certify signs them, and the result is printed as a PDF carrying an offline-verifiable signed QR. The citizen needs no device, no login and no connectivity; a verifier scans the QR with Inji Verify and validates the signature offline.

Phase 2 (device wallet / OpenID4VCI pull) is designed but not the current deliverable.

What lives here

Path	What it is
helm/openg2p-inji-certify	Helm chart deploying Inji Certify OpenG2P-style (common + postgres-init deps, properties ConfigMap, .p12 keystore volume, DB-schema-init Job). Generic — it seeds no credential_config; consuming modules register their own.
helm/openg2p-inji-verify	Helm chart deploying Inji Verify's verify-service — the verifier side. Stock image, no MOSIP config-server, no PostgreSQL (bundled in-memory DB) and no verify-ui. A separate chart from Certify on purpose: issuer and verifier sit on opposite sides of a trust boundary. See the Verification guide.
registry-dataprovider-plugin	Java DataProvider plugin that reads a registry view directly (the Phase-2 / pull model). Built to a JAR via build.sh or the Dockerfile's artifact target.
scripts/issue_vc.py	Helper to drive an end-to-end issuance against a running Certify.
scripts/uninstall-inji-certify.sh	Full teardown of a Certify install — release, DB + role inside commons-postgresql, keystore PVC, pinned Secrets.
examples/	Sample issued credentials and a rendered paper VC PDF.
vendor/ (gitignored)	Local clone of upstream inji-certify, kept for reference (base config, init SQL). Not part of the repo.

Components that are not here: the Agent Portal API (in openg2p-registry-gen2-apis), and the per-registry VC definitions — credential types, templates, fields and views are owned by the consuming module (e.g. NSR), which registers each credential_config with Certify.

Deploying

The chart is published to the shared openg2p/charts Helm registry by CI and is normally installed as part of commons-services (dependency alias injiCertify), reusing the cluster PostgreSQL.

Two things are set at Certify install time, because they are environment-level (one issuer per environment):

• global.vcIssuerDid — the issuer DID stamped onto every credential, e.g. did:web:certify.<env>.openg2p.org;
• the signing keypair — generated by Certify's keymanager on first boot.

The issuer identity is a 3-part bundle: back it up together. The .p12 keystore (default: a durable PVC, generated on first boot) + the keymanager key rows in PostgreSQL + the keystore password. Losing or changing any of them invalidates every credential already issued.

Documentation

Full functional and deployment documentation lives in the OpenG2P documentation site, under Platform Services → VC Issuance (platform/platform-services/vc-issuance/ in the openg2p-documentation repo): custody options and strategy, the Phase-1 paper credential flow, the registry data connector, deployment and teardown, and the Phase-2 device-wallet design.

License

MPL-2.0