NlVaxPass codes recognized as fake.

[craftxbox]

Codes issues from the Government of Newfoundland & Laborador NLVaxPass app result in a 'This looks like a fake vaccination proof' error.

[steven676]

Could you visit https://steven676.github.io/shc-covid19-decoder/, uncheck "Verify signature", scan your SHC, and provide the value of the issuer field (first line of the output)?

[craftxbox]

Could you visit https://steven676.github.io/shc-covid19-decoder/, uncheck "Verify signature", scan your SHC, and provide the value of the issuer field (first line of the output)?

Sure, https://www.gov.nl.ca/covid-19/life-during-covid-19/vaccination-record/prod
Already checked and the keys are available at https://www.gov.nl.ca/covid-19/life-during-covid-19/vaccination-record/prod/.well-known/jwks.json
{"keys":[{"kty":"EC","kid":"UboztS3pE1mr0dnG7Rv24kRNqlYbHrbxd-qBFerpZvI","use":"sig","alg":"ES256","crv":"P-256","x":"mB0PKTVRnr3JCtyucEjCHXkXW3COg5KP0y4gKCNJxWc","y":"PTpxiYECNiuyRwpwqjme8OIFdG7N-HwN2XH02phdZCs","date":1632779181394}]}

[steven676]

Thanks; key added to my branch and build at https://steven676.github.io/shc-covid19-decoder/ updated. (There is a second key embedded in the NLVaxVerify Android app with kid: NCdFVhxkSS2qo6COhJ9q_Pdm1PjZcdNAGvaMaFwkvdQ; I'm moderately curious as to where that one comes from.)

[craftxbox]

Huh, interesting. I wonder why they had that one.

[Andrew1431]

issuer (UNVERIFIED): https://prd.pkey.dhdp.ontariohealth.ca

[craftxbox]

issuer (UNVERIFIED): https://prd.pkey.dhdp.ontariohealth.ca

Are you sure you're on the correct issue? This issue relates to the Newfoundland issued passports, Not ontario.