Verifiable Health Link
0.0.2-current - ci-build International flag

Verifiable Health Link, published by IHE IT Infrastructure Technical Committee. This guide is not an authorized publication; it is the continuous build for version 0.0.2-current built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/IHE/ITI.VHL/ and changes regularly. See the Directory of published versions

: Distribute PKI Material - XML Representation

Active as of 2025-09-19

Raw xml | Download


<Requirements xmlns="http://hl7.org/fhir">
  <id value="DistributePKIMaterial"/>
  <text>
    <status value="generated"/>
    <div xmlns="http://www.w3.org/1999/xhtml"><p class="res-header-id"><b>Generated Narrative: Requirements DistributePKIMaterial</b></p><a name="DistributePKIMaterial"> </a><a name="hcDistributePKIMaterial"> </a><p>These requirements apply to the actor <a href="ActorDefinition-TrustAnchor.html">Trust Anchor</a></p><p>These requirements derive from <a href="Requirements-EstablishTrust.html">Establish Trust</a></p><table class="grid"><tr><td><b><a name="receive-pki-distribution-request"> </a></b>Receive PKI Distribution Request</td><td/><td><div><p>Receive a PKI material submission from a VHL Sharer or VHL Receiver.</p>
</div></td></tr><tr><td><b><a name="validate-pki-material"> </a></b>Validate PKI Material</td><td/><td><div><p>Validate submitted PKI material in accordance with the certificate governance policies of the Trust Anchor. Validation SHALL include checks on cryptographic algorithm conformity, expiration dates, and valid certificate chains to a trusted authority.</p>
</div></td></tr><tr><td><b><a name="assemble-trust-list"> </a></b>Assemble Trust List</td><td/><td><div><p>Organize validated PKI material into a structured trust list. The Trust Anchor SHOULD support categorization by submitting participant, key usage type (e.g., signing, encryption, mTLS), and operational context.</p>
</div></td></tr><tr><td><b><a name="sign-trust-list"> </a></b>Sign Trust List</td><td/><td><div><p>Digitally sign the assembled trust list using the Trust Anchor's private key, ensuring the integrity and authenticity of the distributed material.</p>
</div></td></tr><tr><td><b><a name="make-keys-available-at-distribution-endpoint"> </a></b>Expose Trust List Distribution Endpoint</td><td/><td><div><p>Make the signed trust list available via one or more distribution endpoints accessible to authorized trust network participants.</p>
</div></td></tr></table></div>
  </text>
  <url
       value="https://profiles.ihe.net/ITI/VHL/Requirements/DistributePKIMaterial"/>
  <version value="0.0.2-current"/>
  <name value="DistributePKIMaterial"/>
  <title value="Distribute PKI Material"/>
  <status value="active"/>
  <date value="2025-09-19T17:04:40+00:00"/>
  <publisher value="IHE IT Infrastructure Technical Committee"/>
  <contact>
    <telecom>
      <system value="url"/>
      <value value="https://www.ihe.net/ihe_domains/it_infrastructure/"/>
    </telecom>
  </contact>
  <contact>
    <telecom>
      <system value="email"/>
      <value value="iti@ihe.net"/>
    </telecom>
  </contact>
  <contact>
    <name value="IHE IT Infrastructure Technical Committee"/>
    <telecom>
      <system value="email"/>
      <value value="iti@ihe.net"/>
    </telecom>
  </contact>
  <description
               value="Upon receipt of public key material from a [VHL Sharer](ActorDefinition-VHLSharer.html) or [VHL Receiver](ActorDefinition-VHLReceiver.html), the [Trust Anchor](ActorDefinition-TrustAnchor.html) SHALL validate, organize, sign, and expose the PKI material as part of a trusted, canonical trust list.

This signed trust list enables all participants in the VHL trust network to verify digital signatures and establish secure connections in accordance with the governance policies of the Trust Anchor."/>
  <jurisdiction>
    <coding>
      <system value="http://unstats.un.org/unsd/methods/m49/m49.htm"/>
      <code value="001"/>
    </coding>
  </jurisdiction>
  <derivedFrom
               value="https://profiles.ihe.net/ITI/VHL/Requirements/EstablishTrust"/>
  <actor
         value="https://profiles.ihe.net/ITI/VHL/ActorDefinition/TrustAnchor"/>
  <statement>
    <key value="receive-pki-distribution-request"/>
    <label value="Receive PKI Distribution Request"/>
    <requirement
                 value="Receive a PKI material submission from a VHL Sharer or VHL Receiver."/>
  </statement>
  <statement>
    <key value="validate-pki-material"/>
    <label value="Validate PKI Material"/>
    <requirement
                 value="Validate submitted PKI material in accordance with the certificate governance policies of the Trust Anchor. Validation SHALL include checks on cryptographic algorithm conformity, expiration dates, and valid certificate chains to a trusted authority."/>
  </statement>
  <statement>
    <key value="assemble-trust-list"/>
    <label value="Assemble Trust List"/>
    <requirement
                 value="Organize validated PKI material into a structured trust list. The Trust Anchor SHOULD support categorization by submitting participant, key usage type (e.g., signing, encryption, mTLS), and operational context."/>
  </statement>
  <statement>
    <key value="sign-trust-list"/>
    <label value="Sign Trust List"/>
    <requirement
                 value="Digitally sign the assembled trust list using the Trust Anchor's private key, ensuring the integrity and authenticity of the distributed material."/>
  </statement>
  <statement>
    <key value="make-keys-available-at-distribution-endpoint"/>
    <label value="Expose Trust List Distribution Endpoint"/>
    <requirement
                 value="Make the signed trust list available via one or more distribution endpoints accessible to authorized trust network participants."/>
  </statement>
</Requirements>