content: # The commented out lines show optional configuration with their default value.
  # All key material should be replaced with secret values.
  
  # Identifier for key used to sign JWT's sent from wallet_provider to wallet
  certificate_signing_key_identifier = "certificate_signing_key"
  
  # Identifier for key used to sign instruction results sent from wallet_provider to wallet
  instruction_result_signing_key_identifier = "instruction_result_signing_key"
  
  # Identifier for key used to wrap attestation private keys that will be persisted
  attestation_wrapping_key_identifier = "attestation_wrapping_key"
  
  # Identifier for key used to encrypt the pin public key
  pin_pubkey_encryption_key_identifier = "pin_pubkey_encryption_key"
  
  # Identifier for key used to sign the hash of the pin public key for use in the wallet certificate
  pin_public_disclosure_protection_key_identifier = "pin_public_disclosure_protection_key"
  
  # Identifier for key used to issue WUAs to wallets
  wua_signing_key_identifier = "wua_signing_key"
  
  # Identifier for the WUA issuer. Must equal the CN from the WUA trust anchor CA certificate.
  wua_issuer_identifier = "wua-issuer.example.com"
  
  # Indicates whether logging should be output in a structured (JSON) manner.
  #structured_logging = false
  
  [database]
  # host = "localhost"
  # username = "postgres"
  # password = "postgres"
  # name = "wallet_provider"
  
  [webserver]
  # ip = "0.0.0.0"
  # port = 8001
  
  [pin_policy]
  # rounds = 4
  # attempts_per_round = 4
  # timeouts_in_ms = [60_000, 300_000, 3_600_000]
  
  [hsm]
  library_path = "/usr/lib/softhsm/libsofthsm2.so"
  user_pin = "12345678"
  
  [ios]
  team_identifier = "123ABC321A"
  bundle_identifier = "com.example.wallet-app"
  # The "environment" can be either "development" or "production", the latter being the default.
  # environment = production
  root_certificates = [
      "MIICITCCAaegAwIBAgIQC/O+DvHN0uD7jG5yH2IXmDAKBggqhkjOPQQDAzBSMSYwJAYDVQQDDB1BcHBsZSBBcHAgQXR0ZXN0YXRpb24gUm9vdCBDQTETMBEGA1UECgwKQXBwbGUgSW5jLjETMBEGA1UECAwKQ2FsaWZvcm5pYTAeFw0yMDAzMTgxODMyNTNaFw00NTAzMTUwMDAwMDBaMFIxJjAkBgNVBAMMHUFwcGxlIEFwcCBBdHRlc3RhdGlvbiBSb290IENBMRMwEQYDVQQKDApBcHBsZSBJbmMuMRMwEQYDVQQIDApDYWxpZm9ybmlhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAERTHhmLW07ATaFQIEVwTtT4dyctdhNbJhFs/Ii2FdCgAHGbpphY3+d8qjuDngIN3WVhQUBHAoMeQ/cLiP1sOUtgjqK9auYen1mMEvRq9Sk3Jm5X8U62H+xTD3FE9TgS41o0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSskRBTM72+aEH/pwyp5frq5eWKoTAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwMDaAAwZQIwQgFGnByvsiVbpTKwSga0kP0e8EeDS4+sQmTvb7vn53O5+FRXgeLhpJ06ysC5PrOyAjEAp5U4xDgEgllF7En3VcE3iexZZtKeYnpqtijVoyFraWVIyd/dganmrduC1bmTBGwD",
  ]
  
  [android]
  # The root certificate received during key attestation is checked against all of these public keys.
  # They can be either RSA or ECDSA keys, base64 encoded in PKCS 8 format.
  root_public_keys = [
      "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr7bHgiuxpwHsK7Qui8xUFmOr75gvMsd/dTEDDJdSSxtf6An7xyqpRR90PL2abxM1dEqlXnf2tqw1Ne4Xwl5jlRfdnJLmN0pTy/4lj4/7tv0Sk3iiKkypnEUtR6WfMgH0QZfKHM1+di+y9TFRtv6y//0rb+T+W8a9nsNL/ggjnar86461qO0rOs2cXjp3kOG1FEJ5MVmFmBGtnrKpa73XpXyTqRxB/M0n1n/W9nGqC4FSYa04T6N5RIZGBN2z2MT5IKGbFlbC8UrW0DxW7AYImQQcHtGl/m00QLVWutHQoVJYnFPlXTcHYvASLu+RhhsbDmxMgJJ0mcDpvsC4PjvB+TxywElgS70vE0XmLD+OJtvsBslHZvPBKCOdT0MS+tgSOIfga+z1Z1g7+DVagf7quvmag8jfPioyKvxnK/EgsTUVi2ghzq8wm27ud/mIM7AY2qEORR8Go3TVB4HzWQgpZrt3i5MIlCaY504LzSRiigHCzAPlHws+W0rB5N+er5/2pJKnfBSDiCiFAVtCLOZ7gLiMm0jhO2B6tUXHI/+MRPjy02i59lINMRRev56GKtcd9qO/0kUJWdZTdA2XoS82ixPvZtXQpUpuL12ab+9EaDK8Z4RHJYYfCT3Q5vNAXaiWQ+8PTWm2QgBR/bkwSWc+NpUFgNPN9PvQi8WEg5UmAGMCAwEAAQ==",
  ]
  package_name = "com.example.wallet-app"
  # If this value is set to :"false" (which is the default), the Android app has to be installed through the Play Store.
  # If "true", sideloading is also allowed. This is checked through app attestation during registration.
  # allow_sideloading = false
  # The JSON credentials file for a Google Cloud service account that can be used
  # to retrieve integrity verdicts for Android devices from Google's API.
  # Below is the default file name.
  # credentials_file = "google-cloud-service-account.json"
  # The integrity verdict is checked for the hash of the certificate that was used to submit the app to the Play Store.
  # A certificate hash needs to be present within the integrity verdict AND it needs to be one of the ones specified
  # below. Note that this value is completely ignored if sideloading is allowed.
  # play_store_certificate_hashes = ["01020304050607081010101010101010ABABABABABABABAB1234567890ABCDEF"]
  