FIDO Functional Certification #155

Tracking issue for FIDO2 Server Functional Certification, the applicable program for a server and relying party. Authenticator Certification levels (L1 to L3+) apply only to authenticator hardware and are not in scope.

This began as a certification readiness review that also covered GovRAMP. GovRAMP is no longer pursued, and the sessions below are kept as the record of what shipped.

Status, 2026-10-12

Narrowed to FIDO Functional Certification. GovRAMP is no longer pursued, and the feature freeze this issue used to declare is lifted; the roadmap now runs through the release epics (#385 onward). Every session below has shipped. What remains is publishing the self-validation results and submitting for certification, tracked as sub-issues.

Update 2026-10-13: publishing the self-validation results (#396) is in v0.19. Interoperability testing and the certification submission (#397) are deferred to v1.0.

Sessions, in order

Each session is intended to be a self-contained working session.

Session 1: what the collateral promises but the code does not do

Highest priority. Each of these is a gap between what is being sold and what ships.

• Passkey registration is locked to platform authenticators, so security keys cannot be enrolled #156 Passkey registration is locked to platform authenticators, so security keys cannot be enrolled
• Session idle timeout can never fire, and neither lifetime is configurable #157 Session idle timeout can never fire, and neither lifetime is configurable
• Admin-assisted recovery records no identity proofing #158 Admin-assisted recovery records no identity proofing
• Authenticator attachment has no deployment-level default in system_config #182 Authenticator attachment has no deployment-level default in system_config
• React SDK cannot request a security key at enrollment #183 React SDK cannot request a security key at enrollment

#156 is the single highest value item in this plan. One hardcoded value blocks every
hardware security key scenario in Appendix B of the migration runbook. It shipped in
#180; #182 and #183 are the deployment-default and SDK halves split out of it, both
of which cross a repository boundary.

Session 2: audit trail correctness

• Admin recovery audit event names the target user, not the acting admin #159 Admin recovery audit event names the target user, not the acting admin
• webauthn_registration_success is logged when options are generated, before anything is registered #160 webauthn_registration_success is logged when options are generated, before anything is registered
• Auth events carry no session id, so events cannot be correlated to a session #161 Auth events carry no session id, so events cannot be correlated to a session
• Audit write failure disabled lockout, fixed in 0.8.0 (fix(security): stop an audit write failure disabling account lockout #227), published as GHSA-2r8w-h4h9-jw8p

#159 and #161 both migrate the same table and are best done together.

Session 3: CI, supply chain and scanning

Independent of the application code, so it can run in parallel with anything else.

• Add dependency vulnerability scanning and static analysis to CI #162 Add dependency vulnerability scanning and static analysis to CI
• Published container images have no SBOM, vulnerability scan, or signature #163 Published container images have no SBOM, vulnerability scan, or signature

Session 4: WebAuthn correctness and FIDO prerequisites

• WebAuthn challenges share one user column, with no TTL and no concurrency #164 WebAuthn challenges share one user column, with no TTL and no concurrency
• Credentials do not store the AAGUID, blocking metadata lookup and authenticator policy #165 Credentials do not store the AAGUID, blocking metadata lookup and authenticator policy
• Registration does not advertise RS1, which FIDO Server Requirements v2.3 requires #166 Registration does not advertise RS1, which FIDO Server Requirements v2.3 requires
• userVerification is preferred at registration but required at login, so some credentials become unusable #167 userVerification is preferred at registration but required at login, so some credentials become unusable
• WebAuthn challenge replay, fixed in 0.8.0 alongside WebAuthn challenges share one user column, with no TTL and no concurrency #164, published as GHSA-7f64-r335-j842

#165 is a prerequisite for Session 5.

Session 5: FIDO attestation and metadata

• Wire the FIDO Metadata Service and validate attestation certificate chains #168 Wire the FIDO Metadata Service and validate attestation certificate chains
• Support direct attestation and persist the attestation format #169 Support direct attestation and persist the attestation format
• No authenticator policy: synced passkeys cannot be blocked and AAGUIDs cannot be restricted #170 No authenticator policy: synced passkeys cannot be blocked and AAGUIDs cannot be restricted

#170 resolves the synced passkey open decision the public sector README flags. It is
currently unimplemented, so the website text should be corrected until it ships.

Session 6: FIDO conformance

• Add the FIDO2 conformance test interface behind an environment flag #171 Add the FIDO2 conformance test interface behind an environment flag
• Run FIDO2 conformance self-validation and remediate findings #172 Run FIDO2 conformance self-validation and remediate findings

Do not start the 90 day interoperability clock until Sessions 4 and 5 have landed.
Register for tool access early so the tools can be run iteratively.

Session 7: audit and session hardening (originally gated on GovRAMP)

• Audit events have no retention policy and no bulk export #173 Audit events have no retention policy and no bulk export
• Audit records are updatable and have no integrity protection #174 Audit records are updatable and have no integrity protection
• Production JWKS key rotation is not implemented #175 Production JWKS key rotation is not implemented
• No concurrent session limit per user #176 No concurrent session limit per user
• Refresh rotation resets the absolute session lifetime, so there is no absolute cap #185 Refresh rotation resets the absolute session lifetime, so there is no absolute cap
• No enforceable phishing-resistant-only login mode, and magic link is on by default #177 No enforceable phishing-resistant-only login mode, and magic link is on by default
• No authentication coverage report for assessment and insurance responses #178 No authentication coverage report for assessment and insurance responses

Open decisions

1. Attestation posture, and whether to require it by default
2. Audit failure posture: decided in fix(security): stop an audit write failure disabling account lockout #227 (lockout has its own counter, write failures are reported, an unreadable count is treated as locked)

Related

Two findings were handled privately as security advisories per SECURITY.md, and are now published.