Let’s make a COVID Certificate [ENCODING]

The EU Digital COVID Certificate is just a QR code, is it really that hard to make it? My good old friend Homer Simpson doesn’t want to get the vaccine, so they don’t let him enter the bar, could we make him one? Let’s find out.

In a previous post I described in detail how to decode the EU Digital COVID Certificate, now we go the other way, to generate such a QR code. Here is a brief overview taken from that previous post. If you want to try this code, you should definitely visit the previous post and copy all the maven dependencies, because I will use them here as well.

Data → JSON

This is how I generated the JSON, again with ObjectMapper.

List<VaccinationPayload> vaccinations = new ArrayList<>();
VaccinationPayload vaccine = new VaccinationPayload();
vaccine.setVaccine("1119349007"); // COVID-19 mRNA vaccine
vaccine.setAuthorizationHolder("ORG-100030215"); // Biontech
vaccine.setDoseNumber(2); // Dose number: 2
vaccine.setDoseTotalNumber(2); // Expected doses: 2

PersonPayload person = new PersonPayload();
CertificatePayload certificate = new CertificatePayload();
ObjectMapper mapper  = new ObjectMapper();

String json = mapper.writeValueAsString(certificate);

Of course, this JSON can be generated in various ways, even manually, the most important thing is that in the end it looks like this.

{"v":[{"ci":"URN:UVCI:01:DE:187/37512422923","co":"DE","dn":2,"dt":"2021-09-24","is":"Robert Koch-Institut","ma":"ORG-100030215","mp":"EU/1/20/1528","sd":2,"tg":"840539006","vp":"1119349007"}],"dob":"1956-05-12","nam":{"fn":"Simpson","gn":"Homer","fnt":"SIMPSON","gnt":"HOMER"},"ver":"1.0.0"}


You may have seen the country code DE, which means that Homer is now German, this is for a specific reason and will be revealed at the end. Now let’s make these CBOR bytes.

long issuedAtSec = LocalDateTime.now().atZone(ZoneId.systemDefault()).toInstant().toEpochMilli() / 1000L;
long expirationSec = LocalDateTime.now().plusYears(1).atZone(ZoneId.systemDefault()).toInstant().toEpochMilli() / 1000L;

CBORObject map = CBORObject.NewMap();
map.set(CBORObject.FromObject(1), CBORObject.FromObject("DE"));
map.set(CBORObject.FromObject(6), CBORObject.FromObject(issuedAtSec));
map.set(CBORObject.FromObject(4), CBORObject.FromObject(expirationSec));
CBORObject hcertVersion = CBORObject.NewMap();
CBORObject hcert = CBORObject.FromJSONString(json);
hcertVersion.set(CBORObject.FromObject(1), hcert);
map.set(CBORObject.FromObject(-260), hcertVersion);

byte[] cbor = map.EncodeToBytes();

This is what it looks like when encoded in CBOR.



Now comes the complicated part, we have to sign these bytes with a key issued by the German certification authority in charge of COVID certificates. So, let’s hack them…
Just kidding, we’ll make a new key and sign it with him.

OneKey privateKey = OneKey.generateKey(AlgorithmID.ECDSA_256);
byte[] kid = UUID.randomUUID().toString().getBytes(StandardCharsets.UTF_8);

Sign1Message msg = new Sign1Message();
msg.addAttribute(HeaderKeys.Algorithm, privateKey.get(KeyKeys.Algorithm), Attribute.PROTECTED);
msg.addAttribute(HeaderKeys.KID, CBORObject.FromObject(kid), Attribute.PROTECTED);

byte[] cose = msg.EncodeToBytes();

This was the most complicated part, but now we have COSE bytes.


Do not be surprised if you got different COSE bytes, in this process a new key is generated and it is almost impossible for these keys to be the same/to generate the same signature.


Compression and the rest are much simpler.

ByteArrayOutputStream stream = new ByteArrayOutputStream();
try (CompressorOutputStream deflateOut = new CompressorStreamFactory()
	stream)) {
byte[] zip = stream.toByteArray();

All zipped up and we get some bytes again that I won’t write down, because they don’t matter, they will look different every time this code is executed.


Base45 encoding goes like this.

String base45 = Base45.getEncoder().encodeToString(zip);


Final touch, adding the prefix.

String hc1 = "HC1:" + base45;

And this is what the certificate looks like, for now.


PREFIX → QR Code Image 

All that remains is to make a QR code out of this.

QRCodeWriter qrCodeWriter = new QRCodeWriter();
int width = 300, height = 300; //px
BitMatrix bitMatrix = qrCodeWriter.encode(hc1,
	BarcodeFormat.QR_CODE, width, height);
// Write to file
MatrixToImageWriter.writeToPath(bitMatrix, "PNG",
	new File(elHomo.png).toPath());

And here it is.


The only thing left is to scan the code with the CovPas app. And… D’oh! It doesn’t work. That app was made by IBM and they are not so naive.

But there is hope, and it all lies in the fact that we made Homer a German. To uncover the secret, the Corona-Warn-App, before version 2.7, did not perform a digital signature check at all. This means that it will accept our certificate without any problems. You don’t believe me, download the Corona-Warn-App 2.6.1 and scan this previously generated QR code.

Guess who’s now staying in the bar until dawn, let’s hope no one will actually check his certificate.

38 thoughts on “Let’s make a COVID Certificate [ENCODING]

  1. Avatar
    Daniel Harmann says:

    Excellent Article
    Small question at the JSON – CBOR step.
    You have converted the JSON data to CBOR before the COSE signing stage.
    Do you also need to convert the protected/unprotected headers to CBOR BEFORE the COSE signing stage?

    1. Avatar
      alberto says:

      hola buenas, soy un poco torpe . que aplicación estáis utilizando.

  2. Avatar
    Daniel Harmann says:

    Hi, me again.
    Thanks for your reply to the last comment.
    At the CBOR-COSE step, I have found that decoding a QR is not possible if the cbor.tag “18” has not been encoded at the COSE stage.
    The COSE step would look like this {18: [[headers],[payload],[signature]]} and not just {[[headers],[payload],[signature]]}
    Do you have any idea how you would encode the cbor.tag of 18 into the COSE step.

        1. admin
          admin says:

          None, this is a simple Maven project written in Java.
          The same code can be used in Android with another form of dependencies.

          1. Avatar
            console says:

            hi admin where can i use this commands

    1. admin
      admin says:

      Of course, my Spanish friend, otherwise this would be a crime of forging documents.

  3. Avatar
    Randomguy says:

    If there was to be a leak of digital signatures, does it mean one could create a working covid certificate pretty much in any country using this?

    1. admin
      admin says:

      Nope, every certificate already has a digital signature, what you need is a “leaked” key to create such signature. That shouldn’t be possible, because all compromised keys are put into CRL lists/black listed.

      1. Avatar
        Iulian Daniel says:

        I think he meant , if a valid certificate is already at hand… Can one use that data to make other certificates which have the same signature ? And still be valid?! The process of verifying the qr code is made offline anyway, so how would the know ?

        1. admin
          admin says:

          It’s not that simple. I will avoid using the word certificate because it confuses the QR certificate with the signer key certificate.
          Imagine you have a doctor who signs these QR codes with his keys. He has a private key, with which he signs the data and generates a signature that is also in the QR code and a public key, which he puts in the certificate verification application because it can be used to verify the validity of the signature. The application can work offline because while it is online it downloads all these public keys and has them in memory when checking certificate signatures.
          Now when you make a small change to the data and leave the same signature, an error will appear when verifying the signature, because any change in the data will generate a completely different signature when signing with a real private key.

          1. Avatar
            Iulian Daniel says:

            Then my understanding of the meaning of signing was false in my head, Thank you for clearing that for me.

  4. Avatar
    Crackaner says:

    I’m using my real ci (Unique cert identifier) from my legit passport covid, why is still not working when creating a fake one?

  5. Avatar
    jonofoster says:

    Hi Admin

    wonderful article, i’m just stuck on something i don’t know how to insert a key in your code i see you generate a key

    I would like to put a key instead of generating one

    for example directly a key in SHA256 or a key in string: ‘abcde%12345’ who is transformed into sha256

    how do I put that in place of

    OneKey privateKey = OneKey.generateKey(AlgorithmID.ECDSA_256);

    Thanks for your response

    1. admin
      admin says:


      With that OneKey class, something like that is definitely not possible. I would recommend that you google something like “loading a private key from a file”. Because you need a private key to sign, and the file can be binary DER (where you will see how a key is made from bytes) or written as a string PEM (you will see how to convert the string to bytes and then to a key).
      And at the same time you will see the algorithms for the keys and realize that SHA256 is a hash algorithm used for digital signatures, not for keys.

      Greetings to the UK,

  6. Avatar
    Mike says:

    Hello admin can you plz list all the dependencies that you used … but in simple java app… and thanks a lot

  7. Avatar
    Stephan says:

    Can You Please post the project here . I literally import all the needed dependencies but every time I got a lot of errors even with the localdatetime thanks in advance

  8. Avatar
    Mr. M says:

    Hi Admin,
    I would like to ask you a question. I have a original valid recovery-certificate. When I now decode the qr-code and afterwards encode the json again but with no changes of the original data I would expect the so created qr-code will work and is valid but in my case the new generated qr-code is then invalid. Do you maybe know why it is the case?
    Thanks a lot for your answer!

    1. Avatar
      Stephan says:

      Will simply because the second time it was signed by a random key 🔐 not the original from the RKI … And how do you generate one what are the libraries you used and if it possible can you post the code here …

  9. Avatar
    Ghostpuppet says:

    Hey nice job encoding, how similar would this be to the smart health card framework used in Canada?(shc) any way we could get those encoded?

  10. Avatar
    Dan says:

    Hi I have read this entire page and the previous one with the dependencies, I was wondering if we could get the whole portrait at once. Not being an expert in java i find it a bit twisted and all my efforts so far has failed.

  11. Avatar
    Sonny says:

    ich habe es entschlüsselt aber sobald ich vom Json eine Zahl änder zum beispiel 28.OKT 2021 zu 27.OKT 2021 wird der QR Code nicht mehr als Gültig erkannt nur in der alten App wird es als gültig erkannt.

    Ich hoffe sie verstehen Deutsch.

  12. Avatar
    Bonito Broccolini says:

    Good day, I have a little problem – what if I am not from Germany and I am travelling – won’t the fact that I am from X country instead of Germany cause problems? Am I even allowed to get the covid-QR pass in Germany as a person from X country and use it?
    Does the DE code mean that I am German or that I just got the certificate in Germany?

  13. Avatar
    Bonito Broccolini says:

    Forgot to add that the X country is in the European Union

  14. Avatar
    Neculiti Ivan says:

    I can recommend to come on a site on which there are many articles on this question.

    _ _ _ _ _ _ _ _ _ _ _ _ _ _
    Некулицы Иван laravel github


Leave a Reply

Your email address will not be published. Required fields are marked *