Hacker News Reader

I don't know how the signing process is for this specific green pass, but the national France one is signed exclusively by the French healthcare system: vaccination centers and test locations can emit a signed pass remotely and print it, but they don't possess the private key locally.

View on HN

I'm speculating somewhat as I haven't been through the process, but it seems like the test centers give you a string that the app converts into the QR code. The app is supposed to work offline, though perhaps the initial string -> QR code does an online lookup and thus is signed externally to the test centers.

The string is a BASE45-encoded payload that has already been signed before encoding as a QR-friendly string. The BASE45 is because QR codes only support 45 characters (versus more common BASE64). But by the time the string -> QR happens, the signing has already taken place from the lab who provides the string.

Reply on news.ycombinator.com