Problem with certificate validity check for the Netherlands

[Ein-Tim]

Avoid duplicates

• Bug is not mentioned in the FAQ
• Bug is specific for iOS only, for general issues / questions that apply to iOS and Android please raise them in the documentation repository
• Bug is not already reported in another issue

Technical details

• Device name: iPhone XR
• iOS version: 14.7.1
• App version: 2.6.1

Describe the bug

When checking the vaccination certificate for the Netherlands, I only get this:

I don't fully understand what the app is trying to tell me here (;

Steps to reproduce the issue

1. Add a DCC
2. Check for the validity in the Netherlands

Expected behaviour

Clear description why the certificate is not valid.

Additional context

Please check the behavior under Android.

---

Internal Tracking ID: EXPOSUREAPP-8786

[fynngodau]

Android shows the same behavior. For the second card, it looks a little different and not like it was designed this way:

[thomasaugsten]

This works as expected. Netherlands requieres a schema version 1.3 but if your vaccinate certificates is created before Juli you have schema version 1.0. We address this already to the Netherlands but we have no information if and when they plan to downgrade the business rules.

[Ein-Tim]

@thomasaugsten

Okay thanks. I'll leave this open for further communication. It's really not optimal for the end user.

[Ein-Tim]

Please transfer this issue to the documentation repository.

[Ein-Tim]

FYI: Everybody who got their vaccination certificate via the https://impfzentren.bayern/citizen/ can download a new certificate which is created with the latest schema. This then validates correctly in CWA.

[MikeMcC399]

@thomasaugsten
Could CWA display the schema version and the date of certificate creation in the UI if this is important for compatibility?

[vaubaehn]

@thomasaugsten and @mlenkeit
I'm wondering, whether the information in this "open status" screen can be enhanced somehow to enable users to better understand what they're supposed to do with these information...
If the answer was yes, I'd create a wishlist issue for that. But for this I have two open questions:

Goal for the "open status" in wallet and verifier apps is to provide information to the user that the validity of the certificate can't be checked, because there is a lack of information or the schema version for the check doesn't fit. The "checking rules" are displayed as text above of the contents of the certificate, so that user may estimate whether the certificate may actually be valid or not.

The text/strings for the "checking rules" are directly provided by the participating member countries. Whether the member countries provide translations or not is apparently their matter of taste.
In result, some countries provide texts in German, English, Spanish, French and Italian, other countries only provide English texts (even for their own inhabitants - like the Netherlands currently). Additionally, the texts can be rather different even they express the same rules (e.g., Netherlands & Slovenia: "At most one v-event." Other countries: "Vaccine Certificate can only relate to a single Vaccine event for Covid-19"/"One type of event of vaccination")

=> Is there any task force or working group, that could be able to harmonize texts provided in the description strings and also probably coordinate translation efforts? If you could provide an address, maybe the community could place a request there? I think that could help users in all countries independent of their wallet/verifier apps...

Not all of the cards in the "open status" screen provide information of the validated DCC, for example:

• Number of "events" found in the DCC ("Exactly one type of events")
• Number of "vaccination events" found in the DCC ("At most one v-event")

=> Does CertLogic pass on these details to CWA so that they could be used to display these results (e.g., number of "events" found in the DCC), or only a simple "true/false" or "pass/fail"?

Thanks in advance for your answer!

[mlenkeit]

@vaubaehn

I'm wondering, whether the information in this "open status" screen can be enhanced somehow to enable users to better understand what they're supposed to do with these information...

Technically, that's possible, although it may require enhancements of the CertLogic dependencies. Feel free to raise a wishlist issue for that. I would assume that the chance of implementing such a change will depend on how frequent rules evaluate to open "in the wild".

Is there any task force or working group, that could be able to harmonize texts provided in the description strings and also probably coordinate translation efforts?

I would suggest filing an issue in https://github.com/eu-digital-green-certificates/dcc-quality-assurance

Does CertLogic pass on these details to CWA so that they could be used to display these results (e.g., number of "events" found in the DCC), or only a simple "true/false" or "pass/fail"?

CertLogic only returns pass/fail/open for a given rule. The rule itself has affectedFields which CWA uses to determine the fields to display in case of fail/open. During upload of the rules, it is checked that all fields used by CertLogic are covered by affectedFields. We do not really get additional details from the rule evaluation result though.

[error401de]

What does "This works as expected. Netherlands requieres a schema version 1.3" exactly mean?

The official dutch app (https://play.google.com/store/apps/details?id=nl.rijksoverheid.ctr.verifier) shows a green status with my certificate while I get the error from above in CWA.

[MikeMcC399]

@error401de

What does "This works as expected. Netherlands requieres a schema version 1.3" exactly mean?

You are referring to #671 (comment)

so it means that the Business Rules (for travel) for the Netherlands requires Schema Version 1.3, which is not necessarily the same as the app from the Netherlands.

When was your certificate issued?

[error401de]

It was issued in June, actually at the first day it was possible in Baden-Württemberg.

[Ein-Tim]

FYI: @thomasaugsten said in https://github.com/corona-warn-app/cwa-app-android/issues/3847#issuecomment-889940530:

[...] we are working on this to downgrade the Dutch rules

[vaubaehn]

@mlenkeit
Thanks for your helpful response!

Feel free to raise a wishlist issue for that. I would assume that the chance of implementing such a change will depend on how frequent rules evaluate to open "in the wild".

I will do that next week. I assume that DCCs and the need to check their validity will stay part of our lives for quite a while. While I think it's unlikely to see more "open states" currently, the chances may rise in the future, when developments in the pandemic situation may require changes of DCCs and their schemes, but not all participating countries can react on those in a timely manner...
Additionally, some basic considerations reported here in context of "open status" do also apply for the "failed state" information screen, as texts of failing rules and DCC contents are derived and displayed in a similar manner like for "open". You may easily try with your 1/2 VaccDCC 😉 .

I would suggest filing an issue in https://github.com/eu-digital-green-certificates/dcc-quality-assurance

Thank you for the suggestion! I will try my chances there next week.

Technically, that's possible, although it may require enhancements of the CertLogic dependencies.

CertLogic only returns pass/fail/open for a given rule. The rule itself has affectedFields which CWA uses to determine the fields to display in case of fail/open. During upload of the rules, it is checked that all fields used by CertLogic are covered by affectedFields. We do not really get additional details from the rule evaluation result though.

Hm, I see. Doesn't sound too easy to implement for above mentioned cards (the others are quite sufficient, imho), but maybe we can discuss this via the wishlist issue I'm going to open soon.

Again, thank you, and have a nice week-end!

[MikeMcC399]

@vaubaehn

You may easily try with your 1/2 VaccDCC 😉 .

Interesting point! According to this, Spain allows entry with only 1/2, which contradicts the information on https://reopen.europa.eu/en/from-to/DEU/ESP, where it says "COVID-19 Vaccination Certificate. Valid 14 days after receiving the complete regimen". That needs to be a separate issue.

[vaubaehn]

@MikeMcC399

Spain allows entry with only 1/2, which contradicts the information on https://reopen.europa.eu/en/from-to/DEU/ESP, where it says "COVID-19 Vaccination Certificate. Valid 14 days after receiving the complete regimen".

If the information on https://reopen.europa.eu/en/from-to/DEU/ESP is valid, then it's indeed a bug in their businessrules and an argument to also open source the national business rules (or the compiled JSON from gateway) for public bug bounty :)

Edit: I looked into the rule set, and the rule to check for amount of doses is simply missing for them.
There is also another issue: They have two rules to check for age of NAA-Test: one is "not older than 48 hours" an one is "not older than 72 hours"...

[MikeMcC399]

@vaubaehn

I looked into the rule set, and the rule to check for amount of doses is simply missing for them.

Can you help me jump start to be able to read the rule set? Where can I see it? There are so many repositories and documents these days it's quite difficult to find one's way around.

I have opened #675 anyway for Spain.

[vaubaehn]

@MikeMcC399
You will find the business rules test data here:
https://github.com/eu-digital-green-certificates/dgc-business-rules-testdata

The rules that were PROD yesterday and delivered to CWA here:
https://covidapps.slack.com/archives/C0194ML0MLN/p1627562570043600?thread_ts=1627556597.041700&cid=C0194ML0MLN

[Ein-Tim]

The same also happens with test certificates...

[MikeMcC399]

@Ein-Tim

The same also happens with test certificates...

Are you saying you get exactly the same screenshots as you originally posted?

Did you have both a vaccination certificate and a test certificate stored? If yes, what happens if you only have a test certificate stored?

[Ein-Tim]

@MikeMcC399

Are you saying you get exactly the same screenshots as you originally posted?

Not exactly the same, but very close. Here's a screenshot (RAT, sample taken today):

Did you have both a vaccination certificate and a test certificate stored?

Yes.

If yes, what happens if you only have a test certificate stored?

I just tried and I get the same result.

[MikeMcC399]

@Ein-Tim
Good to have the exact screenshots for the test certificate case!

Maybe you could activate the Error Reports and check the schema (version) of the test certificate. See corona-warn-app/cwa-app-android#3838 (comment) relating to finding the information for a vaccination certificate. I guess it would be similar for a test certificate.

[Ein-Tim]

@MikeMcC399

I don't see the schema version in the log when adding the test certificate to the app.

Because I was curious I also tested with a vaccination certificate, I don't see the schema version in the log there neither.

[MikeMcC399]

@Ein-Tim
Did you capture logs when you tried to validate the certificates?

[vaubaehn]

@MikeMcC399 Please see also:
https://covidapps.slack.com/archives/C0194ML0MLN/p1627920307008000?thread_ts=1627556597.041700&cid=C0194ML0MLN

[vaubaehn]

@jwildeboer

When the problem is a schema version mismatch, the CWA should give exactly that as a warning, not a list of confusing errors that actually are no errors.

The problem here is, that it is not clear whether the schema mismatch leads to an "unacceptable" certificate or not. The solution by the eHN group is, to set such a certificate to "open" (="unclear") and to provide a complete list of all rules with their related contents of the certificate, aiming that a human being will check the certificate's contents for validity.
So, this is intended behavior for all verifier apps (like CovPassCheck) to let gate keepers (e.g., border control) check rule-by-rule for validity. But also wallet apps (CWA in this case) should provide the same information to let users check whether their certificate might lead to problems at border control.

But I fully agree, that the current information and formatting is rather confusing and insufficient, and should urgently be enhanced.

[vaubaehn]

@mlenkeit and @ALL

Is there any task force or working group, that could be able to harmonize texts provided in the description strings and also probably coordinate translation efforts?

I would suggest filing an issue in https://github.com/eu-digital-green-certificates/dcc-quality-assurance

In parallel to your recommendation I was also asking the creator of CertLogic for his suggestions. But he also took the opportunity to raise this issue in his work group and provided some information (ehn-dcc-development/eu-dcc-business-rules#56 (comment)):
There is/was (still) work in progress on translating the EU template that member states may adopt for themselves.
I would conclude to maybe wait patiently for two more weeks to see, if these descriptions/translations will actually be adopted.
If not, I will create an issue in the repo you suggested.

[vaubaehn]

ehn-dcc-development/eu-dcc-business-rules#56 (comment)

Updated rules for NL can be expected from next week-end on! 🎉

[vaubaehn]

For now (Acceptance Rules from 06.08.2021) the schema version of all previously existing NL business rules have not been set to "1.0.0" yet. If they're not adapted soon, it may take a while longer, until wallet apps won't give the "open" status.

The only change I could figure out so far, is, that for certificate type "test" 2 new rules have been added. They will take effect on 08.08.2021, and they have the schema version 1.0.0 and also translations into DE/EN/FR/ES/IT & NL.
This will give an interesting output in wallet apps, as

• some rules have an English discription only, and others are translated, and
• some rules have schema version 1.3.0 and two have version 1.0.0

Interesting enough to create my own test certificate (schema version 1.2.0) and to see, what will CWA make out of it. (And time runs out to test these things, as with CWA 2.7 only certificates with a valid signature may be imported.)

And CWA did well: while the test sample collection time already expired, CWA shows it as "failed" in German language (because this rule has translations). And it showed it at all as expired, because this rule has schema version 1.0.0.
For all other rules, CWA presented them as "open" in English, because they are schema version 1.3.0 and no translation is available yet.

So, while the NL rules are mixed up even more, CWA presented the status (open/failed) correctly in available languages.
Acceptance_Rules-NL-20210806.json.txt

[vaubaehn]

Hi @mlenkeit ,

please have a look at ehn-dcc-development/eu-dcc-business-rules#56 (comment).
For now I'm only picking up the announced European Health Network Technical Interoperability meeting on Friday.
Probably you are one of the SAP representatives who were advised to ask TSI to put issues discussed here to their agenda?
I'm guessing, @daniel-eder may be one of the participants from TSI side?
Next to the schema issue, could this also be a good platform to discuss the introduction of localizations for the English-only rule descriptions currently in PROD?

For the other annotations made in above referenced comment, I'll need to think a bit deeper... tomorrow 😉

[MikeMcC399]

@vaubaehn
I tried today with a
"ver": "1.0.0"
1/2 vaccination certificate
and Netherlands and it is still throwing up the multiple errors:
GR-NL-0000 (1.0.0)
GR-NL-0001 (1.0.0)
VR-NL-0000 (1.0.0)
VR-NL-0001 (1.0.0)
VR-NL-0002 (1.0.0)
VR-NL-0005 (1.0.0)

It should only have failed the
VR-NL-0002 (1.0.0) rule (Vaccination doses must be equal or greater than expected doses)

---

I then tried with a
"ver": "1.3.0"
1/2 vaccination certificate
and this correctly failed only
VR-NL-0002 (1.0.0) rule (Vaccination doses must be equal or greater than expected doses)

---

I was a bit confused about whether the checking of vaccination certificates with schema (ver) 1.0.0 with the Business Rules for the Netherlands is supposed to work already in production on CWA, but re-reading your notes it seems that this needs to be discussed in a meeting taking place tomorrow, Friday, Aug 13, 2021. Correct?

[vaubaehn]

@MikeMcC399
True, the previous Business Rules that resulted in "open status" with schema version 1.3.0 have not been changed yet. Instead, some important rules for the period of test validity have been added - with schema version 1.0.0, which causes some funny effects now.

I was a bit confused about whether the checking of vaccination certificates with schema (ver) 1.0.0 with the Business Rules for the Netherlands is supposed to work already in production on CWA, but re-reading your notes it seems that this needs to be discussed in a meeting taking place tomorrow, Friday, Aug 13, 2021. Correct?

I was understanding the comment ehn-dcc-development/eu-dcc-business-rules#56 (comment) in that way, that NL subgroup could downgrade the schema version (without discussion in their meeting), but they are not sure whether that was an adequate solution. So that subject might be picked up in that meeting.

That lead me to a bit long analysis (ehn-dcc-development/eu-dcc-business-rules#56 (comment)) where I conclude that a downgrade in this case is an appropriate solution.

Let's see how the plot continues...

[vaubaehn]

New information from here: ehn-dcc-development/eu-dcc-business-rules#56 (comment)

Updated rules and hopefully validation with status "pass" for NL can be expected from Thursday, August 19, 2021.

[vaubaehn]

After a fast check I can confirm that the new rules for NL are online.
They're coexisting with the old ones (with their expiry dates in 2030), but obviously the rule runner engine is able to pick 'the right one' for validating, so all (valid) certificates should show as 'pass' or 'fail' after August 19.
Please note that the new 'downgraded' rules will take effect on 2021-08-19T00:00:00+02:00, which is different from time zone UTC of the former rules for schema 1.3.0 (2021-xx-yyT00:00:00Z) - so, rule runner engine also handles the time zones well!

What did not happen yet for the new rules, is localization.
@mlenkeit , could you kindly push that subject to TSI so that they can take it on their agenda? The next TechIOP meeting will be on Friday. I think it's a good place to discuss this, as the technical subgroups could forward it to their responsible institutions (if necessary at all), and they are the ones who will need to implement it into their rules. That could improve UX by a lot. Thank you in advance!

[Ein-Tim]

You can already now confirm that this has been fixed by checking the validity of the certificate for any date in the future but today, tomorrow & the day after tomorrow. Or to make it clear: Select the 19.08.2021 as date of entry and the certificate will show the correct status.

I will still leave this open until 19.08.2021 and close it then.

[mlenkeit]

could you kindly push that subject to TSI so that they can take it on their agenda? The next TechIOP meeting will be on Friday.

@vaubaehn we cannot make any promises. These meetings typically have a packed agenda and the priority of the individual topics is usually beyond our control.

[vaubaehn]

hi @mlenkeit ,

we cannot make any promises. These meetings typically have a packed agenda and the priority of the individual topics is usually beyond our control.

You have my full understanding. But I guess we both (or: "we all", if I may speak for the user community) see the advantage for UX, when localizations find their way into the descriptions of business rules one day. And as it is not too easy to approach to TSI directly from our side in this regard, it is good that we have one spokesman with you in this subject, who can from time to time knock onto TSI's door...
I can imagine how huge is your work load in general, so I hope to not bother you too much with this specific issue. (If you contracted me as your junior assistant, for sure I would keep your back free from these tasks 😉 ) Anyway I will reduce my pings a bit now, so - thanks for all your replies and your support, and have a good time for now!

[Ein-Tim]

This has been fixed on 19.08.2021 though a server-side update.

Closing as fixed.

[dsarkar]

Thanks everybody for contributing here.

---

Corona-Warn-App Open Source Team

[vaubaehn]

A similar problem now popped up with France...
Looking to some rules in https://github.com/eu-digital-green-certificates/dgc-business-rules-testdata, there are more countries in the pipeline with schema 1.3.0...
Will try to open an issue for this in the dgc-business-rules-testdata repo somewhere next week.
(And I will also add a separate issue for localization there)

[thomasaugsten]

This is already addressed. I think this will be fixed soon.

[vaubaehn]

@thomasaugsten thanks for your response, great. If you don't mind I will open an issue there anyway, as this may also affect other country teams, and when they read along there by chance, it could be more easy to prevent future issues. Ok?

[thomasaugsten]

France is fixed

[vaubaehn]

@thomasaugsten Thanks for notifying!

[error401de]

There are also issues with Switzerland, does anybody know a status about that?

[MikeMcC399]

@error401de

There are also issues with Switzerland, does anybody know a status about that?

Switzerland seems to be a different issue.
CWA reports "There are currently no entry rules for the selected country ..." see FAQ
https://www.coronawarn.app/en/faq/#cert_eu_travel and
https://www.coronawarn.app/en/faq/#dcc_no_rules

(If this is not the issue that you are seeing, then please open a new issue.)