did:pki — PKI Bridge

did:pki bridges traditional PKI infrastructure (X.509 certificates) into the DID ecosystem. Organizations and governments that already have PKI can participate in decentralized identity without replacing their existing certificate infrastructure.

Format

DID 
 did:pki:<fingerprint>

The <fingerprint> is derived from the X.509 certificate's SHA-256 fingerprint, hex-encoded and lowercased.

How It Works

  1. Take an existing X.509 certificate (e.g., a Firma Digital certificate from Costa Rica's SINPE-FD)
  2. Compute the SHA-256 fingerprint of the DER-encoded certificate
  3. The DID becomes did:pki:<hex-fingerprint>
  4. Resolution discovers the certificate and extracts the public key into a DID Document

DID Document Structure

JSON 
 {
  "@context": ["https://www.w3.org/ns/did/v1"],
  "id": "did:pki:a1b2c3d4e5f6...",
  "verificationMethod": [{
    "id": "did:pki:a1b2c3d4e5f6...#key-1",
    "type": "JsonWebKey2020",
    "controller": "did:pki:a1b2c3d4e5f6...",
    "publicKeyJwk": {
      "kty": "EC",
      "crv": "P-256",
      "x": "...",
      "y": "..."
    }
  }],
  "authentication": ["did:pki:a1b2c3d4e5f6...#key-1"],
  "assertionMethod": ["did:pki:a1b2c3d4e5f6...#key-1"]
}

Use Cases

  • Government PKI — Costa Rica's Firma Digital, SINPE-FD certificates, and other national PKI systems can participate as DID-based issuers and verifiers
  • Enterprise certificates — organizations with existing TLS or code-signing certificates can derive DIDs without new key generation
  • Certificate transparency — bridge CT logs into the DID ecosystem for auditable identity
💡

did:pki does not replace or compete with PKI. It bridges existing PKI trust into the DID world, letting the same certificate that signs a government document also anchor a Verifiable Credential.

Further Reading