attestto-did-resolver

Unified DIF Universal Resolver driver for Attestto DID methods. Resolves did:pki and did:sns identifiers to W3C DID Documents.

Part of the Attestto decentralized identity infrastructure.

Supported methods

Method	Description	Spec
did:pki	National PKI bridge — maps X.509 CA hierarchies to DID Documents	did:pki spec
did:sns	Solana Name Service — resolves .sol domain names to DID Documents	did:sns spec

API

Conforms to the DIF Universal Resolver HTTP API:

GET /1.0/identifiers/{did}    → W3C DID Resolution Result
GET /1.0/identifiers          → List resolvable did:pki DIDs
GET /1.0/properties            → Driver metadata (DIF convention)
GET /revocation/cr/{ca}        → CR Firma Digital (SINPE) CRL revocation status (JSON, CORS)
GET /health                    → Health check

Revocation endpoint (GET /revocation/cr/{ca})

Lets a browser (e.g. verify.attestto.com) learn the revocation status of Costa Rica CR Firma Digital (SINPE) certificates without fetching the CRL directly — the BCCR CRLs are plain HTTP with no CORS, so browsers are blocked by both mixed-content and CORS. The resolver fetches the CRLs server-side, verifies each CRL signature against the CA cert it already bundles in the trust store, caches the parsed result in memory, and serves it as CORS-enabled JSON.

{ca} is one of sinpe-persona-fisica or sinpe-persona-juridica. Both current-era CRLs (v2(2) and v2(3)) are fetched and their revoked serials merged; the earliest nextUpdate is reported.

Privacy: the endpoint takes no certificate serial. It returns the entire revoked list so the client checks locally and never reveals which certificate it is verifying.

curl https://resolver.attestto.com/revocation/cr/sinpe-persona-fisica

{
  "ca": "sinpe-persona-fisica",
  "issuer": "serialNumber=CPJ-4-000-004017, C=CR, O=BANCO CENTRAL DE COSTA RICA, ...",
  "thisUpdate": "2026-07-21T11:40:06.000Z",
  "nextUpdate": "2026-07-29T00:00:06.000Z",
  "stale": false,
  "signatureVerified": true,
  "revokedSerials": ["14000f93bf...", "..."]
}

signatureVerified is true only when every merged CRL verifies against a bundled CA cert. It is false if a CRL is signed by a CA generation not present in the trust store, or if an upstream CRL fetch fails (the data is still returned). On total upstream failure the endpoint returns 502 { "error", "ca", "message" }. CRL parsing and signature verification use the built-in node:crypto library — no new dependencies.

Example

# Resolve a Costa Rica root CA
curl https://resolver.attestto.com/1.0/identifiers/did:pki:cr:raiz-nacional

# Resolve a Solana domain
curl https://resolver.attestto.com/1.0/identifiers/did:sns:attestto

Response follows the W3C DID Resolution format:

{
  "@context": "https://w3id.org/did-resolution/v1",
  "didDocument": {
    "@context": ["https://www.w3.org/ns/did/v1", "https://w3id.org/security/suites/jws-2020/v1"],
    "id": "did:pki:cr:raiz-nacional",
    "controller": "did:pki:cr:raiz-nacional",
    "verificationMethod": [...],
    "assertionMethod": [...],
    "pkiMetadata": {
      "country": "cr",
      "countryName": "Costa Rica",
      "hierarchy": "SINPE",
      "level": "root",
      ...
    }
  },
  "didDocumentMetadata": { ... },
  "didResolutionMetadata": { "contentType": "application/did+ld+json" }
}

Run locally

npm install
npm run dev
# Listening on http://localhost:8080

Environment variables

Variable	Default	Description
PORT	8080	HTTP port
TRUST_STORE_PATH	./trust-store/countries	Path to attestto-trust country manifests (for did:pki)
SOLANA_RPC_URL	Solana mainnet public	Custom Solana RPC endpoint (for did:sns)
LOG_LEVEL	info	debug, info, warn, or error

Deploy

Deploys to Fly.io via Docker:

fly deploy

The Docker image bundles the trust store from trust-store/ and runs as a non-root node user with health checks.

Architecture

Request → /1.0/identifiers/{did}
  ├── did:pki:* → DidPkiResolver (X.509 → DID Document)
  │     └── reads attestto-trust country manifests + PEM certs
  └── did:sns:* → DidSnsResolver (Solana Name Service → DID Document)
        └── queries Solana mainnet via @solana/web3.js

The trust store for did:pki comes from attestto-trust, which catalogs national PKI hierarchies with X.509 certificates and manifests.

Ecosystem

Package	Role
attestto-trust	PKI trust store — country CA manifests + certs
@attestto/verify	Document verification Web Components
@attestto/login	DID login Web Component

License

Apache 2.0