Accessing your Root Certificate
Your server's Root Certificate contains the public key for you as an eID Issuer and CA
Your Root Certificate forms the root of trust for anyone verifying Face Certificates issued by you.
It is generated automatically at server startup from the pki_private_key configured in your secrets.json (or PKI_PRIVATE_KEY environment variable).
The certificate's signing algorithm matches the key type you configured:
| pki_private_key type | Root certificate algorithm |
|---|---|
| Secp256k1 | ECDSA (secp256k1) |
| ML-DSA-44 / ML-DSA-65 / ML-DSA-87 | ML-DSA (post-quantum) |
The root certificate is returned in PEM format.
Endpoint GET /root-certificate - No request body required.
Success response (200): Returns the root certificate as a PEM-encoded string.
-----BEGIN CERTIFICATE-----
<base64-encoded DER>
-----END CERTIFICATE-----Access Instructions - To retrieve your Root Certificate:
GET http://localhost:7777/root-certificate
Distribute this certificate to clients who need to verify Face Certificates issued by your server. It acts as the trust anchor: any Face Certificate signed by your server can be validated against this root.
Note: If pki_private_key is not set in your configuration, this endpoint returns 404 ERR_ROOT_CERTIFICATE_NOT_FOUND. See Face PKI Configuration to set up your PKI key.