Trouble with “Actually used Certificate” if more than one vaccination certificate is available…

[Jo-Achim]

Avoid duplicates

• Bug is not mentioned in the FAQ
• ?: Bug is specific for Android only, for general issues / questions that apply to iOS and Android please raise them in the documentation repository
• Bug is not already reported in another issue

Technical details

• Device name: Samsung Galaxy Note 10, SM-N970F/DS
• Android version: Android 11 (One UI 3.1) with Android security update: 01. August 2021
• App version: 2.8.0

Describe the bug

Problems after selecting the "Currently used Certificate" („Aktuell verwendetes Zertifikat“) because then another vaccination certificate is the current one...
If more than one vaccination certificate for a person has been scanned into the CWA, the following selection results, for example:

If you now tap on the "Currently used Certificate" („Aktuell verwendetes Zertifikat“) you can see the details of this certificate; including the URN. For example, my URN ends with "5".
After tapping on the arrow at the top left [<-] you get to the previous screen (see picture above).

If you look closely, you can see that after tapping on [<-] the positions of the two 2/2 certificates are swapped.
If you now tap on the "Currently used Certificate" („Aktuell verwendetes Zertifikat“) again and look at its details, the position swap of the two certificates is confirmed. In my example, the certificate with the URN "5" is no longer displayed, but my certificate with the URN "Q" at the end.

Steps to reproduce the issue

1. Start CWA.

2. Select "Certificates".

3. Select a person with multiple vaccination certificates.

4. Scroll down the screen; see screenshot above.

5. Select the "Currently used Certificate" („Aktuell verwendetes Zertifikat“) and pay attention e.g. to the URN under certificate identifier ("Unique Certificate Identifier").

6. Tap on [<-] (top left) - the two vaccination certificates 2 of 2 are visibly reversed in the order.

7. Select the "Currently used Certificate" („Aktuell verwendetes Zertifikat“) again and verfify the URN under Certificate ID ("Unique Certificate Identifier"). It is now the other certificate.

8. Steps 6 and 7 can now be repeated as required; the 'other' certificate is displayed in each case.

Possibly incomplete Example:

Notes:

• If in steps 5 and 7 you do not select the "Currently used Certificate" („Aktuell verwendetes Zertifikat“) but rather the other one ('Currently NOT used Certificate' 2/2), the order of the certificates is not changed; i.e. the same certificate is always displayed here. Depending on the initial situation, in my case either the one with the URN ending "5" or "Q".

• All of the above steps and results can be transferred 1:1 to certificates 1/2. When selecting the upper 1/2 certificate and taping on [<-] (top left), it is also visibly exchanged with the other (here second) 1/2 certificate in the sequence shown.
  When you tap on the lower 1 of 2 certificate (also several times) - as with the 'Currently NOT used Certificate' above - the order of the 1/2-certificates is not changed either, which means that always the same certificate is displayed.

• Changing the order of certificates 2/2 does not affect the order of certificates 1/2 and vice versa.

(Hint: This means that the affiliations of the certificates (2/2 & 1/2) with regard to the displayed order are no longer given.)

Expected behaviour

Is that so useful / desired? I don't think so.
This can become problematic and confusing if the 'country-specific checks of the vaccination certificates' are different for several existing valid certificates; e.g. because of different DCC schema versions or other.
(See "Additional Context" below.)

Possible Fix

I suspect it would make sense to be able to set a certificate as the standard certificate, which is then also used for the 'country-specific check of the vaccination certificate' - until the standard certificate is explicitly changed, right?
Of course, this assumes that a standard certificate can be set manually.

Additional context

As a result for CWA v 2.8.0, the workaround for sorting the vaccination certificates no longer works; see: corona-warn-app/cwa-documentation#679 (comment).

Cross links:

• Latest issued Vaccination DCC 2/2 does not have highest priority.
• Check for different schema versions for certificates stored for the same person.

---

PS: I don't think we need to have another discussion here about whether or not it makes sense to have multiple valid certificates for one person.

PS2: A revision of the certificate handling is likely to be necessary if 3rd / 4th / ... vaccinations or their certificates have to be processed in the CWA in the future.

Best regards, Joachim.

Internal Tracking ID: EXPOSUREAPP-8756
[Android] Latest issued Vaccination DCC 2/2 does not have highest priority

[mtwalli]

@Jo-Achim are these real certificates? I don't see the vaccinatedOn date in your screenshot?

[Jo-Achim]

@mtwalli, yes, these are real, valid certificates.

I don't quite understand your question. What information should my screenshot have included? Do you have a screenshot with the missing data? Further data are only visible after selecting one of the certificates.

[vaubaehn]

I think Mohamed means, that instead of your real name "Joachim Mustermann" and your real birthdate/vaccination date "29.02.1963" there are just placeholders "Firstname Surname" and "dd.mm.yyyy".
So, question is, whether the certificates are self-created ones, or if they had been issued officially with valid data, but you replaced your personal data in the screenshot for privacy reasons.

By the way, the described behaviour does not appear with CWA 2.6.1, so it must have been introduced after.

[mtwalli]

@Jo-Achim As @vaubaehn already clarified. I want to understand the data in the certificate is real or you created it. Valid does not mean it is real, right?. I assume that these certificates some of them have the same vaccinatedOn date which Vaccination certificates are sorted by it. If more than one certificate with the same vaccinatedOn date it might be the cause of the re-ordering you experienced. In real cases no user will take more than one dose in the same day, is that your case ?

[Jo-Achim]

@vaubaehn, @mtwalli, the screenshots are scans from real original "EU Digital Covid Vaccination Certificates"!
The entries "Firstname", "Name" and "dd.mm.yy" in the screenshots above have been constituted by me for data protection reasons.

The different certificates for the same two vaccinations comes from different downloads (25.06.2021 (QR code on the left of the text, validity: "21.06.22 12:35 Uhr") and 31.07.2021 (QR code on the right side of text, validity: "30.07.22 12:01 Uhr")).

The reason why I scanned both the 'old' and the 'new' certificate is because the newer certificate has a completely different, significantly larger QR code; so, I think, it also contains more data.
(Even if it shouldn't be probable, I don't want to rule out that these two QR code versions of the same vaccinations lead to different results when checking the certificates.)

By the way, the described behaviour does not appear with CWA 2.6.1, so it must have been introduced after.

Right, that's how I see it too.

[vaubaehn]

@mtwalli
I'm not @Jo-Achim , but can answer some questions.

In real cases no user will take more than one dose in the same day, is that your case ?

There are many users with 4 vacc certs: 1 pair 1/2 + 2/2 issued by pharmacy in mid-June (DCC schema version 1.0.0) and 1 pair 1/2 + 2/2 issued by federal government/download portal from July on (DCC schema version 1.3.0). The vaccination dates for pairs with schema 1.0.0/1.3.0 will be the same then. See also: #3838
A use case that could make it necessary to import the newer certs are business rules: Like the Netherlands published business rules for schema 1.3.0 some weeks ago, validation with vacc certs with schema 1.0.0 resulted in status 'open'. While NL downgraded their rules meanwhile, a similar problem pops up with France currently, which may force users to import 'freshly issued' certs additionally.

I assume that these certificates some of them have the same vaccinatedOn date which Vaccination certificates are sorted by it.

I have 2 vacc certs 2/2 with same vaccination date imported (schemas 1.0.0 and 1.3.0), but in CWA 2.6.1 the described issue is not present.

[Jo-Achim]

@vaubaehn, thank you! I couldn't have gotten to the point better.

[mtwalli]

Okay , Thanks for the clarifications, since you mentioned that 2.6.0 did not have this behaviour. I think 🧐 this behaviour was introduced in 2.7.0 where certificate priority is also affected by Validity State. We will investigate it further, thanks for your help!

[Jo-Achim]

Possible Fix:
Wouldn't the “Technisches Ablaufdatum” ("Technical expiry date") be helpful for sorting multiple vaccination certificates from one person?

It could ensure that the most current certificate (with the latest expiration date) is used by default and is displayed at the top. (So in my example above: 30.07.22.)

This default could be restored when the CWA is started. This would give the option of selecting a different certificate during a CWA session, which will be used until the CWA is closed.

PS:
My suggestion above to orient the sorting of the EU vaccination certificates on the “Technisches Ablaufdatum” ("Technical expiry date") naturally assumes that the period of validity is not changed. Should this not be guaranteed for the future, I would like to come back to my workaround mentioned above, with which - at least under CWA 2.6.1 - a sorting was possible.

Although this sorting option is somewhat inconvenient, it is still a possibility. In particular, since since CovPass (v1.85.6) certificates stored there can be created, exported and printed out again. This means that missing documents for re-scanning EU vaccination certificates into CWA can be generated again using CovPass. (As a precaution, all vaccination certificates should have been scanned in at least in CovPass.)

[Jo-Achim]

This problem also exists in CWA 2.10.1.

[mtwalli]

@dsarkar could you please link the internal ticket of this issue ?

[dsarkar]

Internal Tracking ID: EXPOSUREAPP-8756
[Android] Latest issued Vaccination DCC 2/2 does not have highest priority
@mtwalli

[MikeMcC399]

"Latest issued Vaccination DCC 2/2 does not have highest priority" is logged as #3838.

[mtwalli]

PR: #4123

[MikeMcC399]

@Jo-Achim

I can reproduce your issue with CWA 2.10.1 on Android 8. The certificate with the label "Currently used certificate" moves up and down in the overview when selected and when there is more than one certificate for the same vaccination date. The label "Currently used certificate" is not automatically applied to the certificate with the latest issue date.

The latest build in development from the release/2.11.x branch contains the fix from PR #4123 "Latest issued Vaccination DCC 2/2 does not have highest priority (EXPOSUREAPP-8756)".

I tried out the release/2.11.x branch (commit 292f97c - or v2.11.0-RC2).

With the release/2.11.x branch, the certificate which was issued latest is always labelled with the text "Currently used certificate", for instance the latest 2/2 certificate. So that fixes the issue #3838.

The behavior is still a bit strange though.

Starting here:

If an older 2/2 certificate is shown at the top of the overview list and I tap on it, then return to the overview, the newest 2/2 has moved to the top of the list (with the correct text "Currently used certificate"). The older 2/2 certificate has moved down one place.

Now if I tap on the newest 2/2 certificate at the top of the overview list, then return to the overview, the newest certificate has moved downwards one place and the previous sorting order is displayed.

Perhaps @mtwalli could look at this to determine if there is still an open issue which needs to be addressed?

[dsarkar]

@MikeMcC399 Thanks for thorough analysis, forwarded to internal ticket.

[MikeMcC399]

@dsarkar

Thanks for thorough analysis, forwarded to internal ticket.

I added some screenshots to make it easier to understand visually.

[dsarkar]

@MikeMcC399 internal ticket updated with your screenshots

[mtwalli]

@MikeMcC399
These are two different issues PR #4123 fixed the priority issue. PR #4136 should fix the re-ordering issue.

There are two different things happening in this list:
1- Finding the highest priority Cert
2- Ordering the rest of the list (TC, VC, VC)

[MikeMcC399]

@mtwalli

PR #4136 should fix the re-ordering issue.

I agree! Thank you! 👍🏻

[MikeMcC399]

@Jo-Achim
Do you use Android Studio? If yes, you could try out the fix yourself on a pre-release version.

It should be fixed in the next release 2.11.x! 🙂

[Jo-Achim]

@MikeMcC399,
thanks for info.
And no, I don’t use / work with Android Studio.

[marcauberer]

@Jo-Achim version 2.11 was released today. Can you confirm the fix? Can we close the issue?

[Jo-Achim]

Sorry, no test possible so far, as version 2.11 has not yet arrived.
Will still do the test.

[MikeMcC399]

@Jo-Achim

no test possible so far, as version 2.11 has not yet arrived.

I am in the same position.

The release has been delayed due to a hotfix according to corona-warn-app/cwa-website#1842 (comment).

[Jo-Achim]

CWA 2.11.2 has meanwhile arrived and, if I have tested correctly, the problem 'Trouble with “Actually used Certificate” if more than one vaccination certificate is available…' is solved.

It should be noted that this workaround for sorting the digital EU vaccination certificates no longer seems to work:

But there is a workaround to sort the EU certificates:

1. Delete the relevant certificates.
2. Scan the certificate that should be the standard certificate (1/2 and 2/2) first.
3. Scan the 'old' certificate(s).

Result: the EU certificate scanned first is shown as the 'Standard Certificate'.

This works under CWA 2.6.1 as well as under CovPass 1.28.7.

[dsarkar]

@Jo-Achim Thanks for reporting and your feedback. Best wishes, DS

---

Corona-Warn-App Open Source Team