CODEWITHSUNDEEP
javasecurity
David Sykes
David Sykes

Reputation: 7269

How can I establish trust in a X.509 certificate issued by an intermediary?

I have an XML document that is digitally signed. I use the XML Digital Signature API to verify the signature. But this document is a SAML 2.0 Assertion that will be used for single sign-on into our web application. As such I need to establish trust in the X.509 certificate used to sign the XML document.

The code I am using to try and establish this trust is:

String filename = System.getProperty("java.home") + "/lib/security/cacerts".replace('/', File.separatorChar);
FileInputStream is = new FileInputStream(filename);
KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
String password = "changeit";
keystore.load(is, password.toCharArray());

PKIXParameters params = new PKIXParameters(keystore);
params.setRevocationEnabled(false);

CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
CertPath certPath = certFactory.generateCertPath(Arrays.asList(signatureCertificate));

CertPathValidator certPathValidator = CertPathValidator.getInstance(CertPathValidator.getDefaultType());
CertPathValidatorResult result = certPathValidator.validate(certPath, params);

PKIXCertPathValidatorResult pkixResult = (PKIXCertPathValidatorResult) result;
TrustAnchor ta = pkixResult.getTrustAnchor();
X509Certificate cert = ta.getTrustedCert();

When run the call to certPathValidator.validate() throws a CertPathValidatorException with the message Path does not chain with any of the trust anchors.

Examining the certificate, it says it has been issued by OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign,OU=VeriSign International Server CA - Class 3,OU=VeriSign\, Inc.,O=VeriSign Trust Network. This is not one of the trust anchors in the JDK's cacerts key store.

However, using IE to inspect a similar certificate's trust chain I see that www.verisign.com/CPS Incorp.'s was issued by VeriSign Class 3 Public Primary CA, which does appear to be one of the trust anchors in the JDK's cacerts key store.

My question: how can I get Java to validate this certificate?

Upvotes: 2

Views: 6531

Answers (3)

Konki
Konki

Reputation: 1

I've got better solution. I've found java service that can be run and do everything for us.

Java: http://code.google.com/p/java-use-examples/source/browse/trunk/src/com/aw/ad/util/InstallCert.java

Upvotes: -1

bethlakshmi
bethlakshmi

Reputation: 4609

Exactly what xelco said - add the intermediate CA:

OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign,OU=VeriSign International Server CA - Class 3,OU=VeriSign\, Inc.,O=VeriSign Trust Network

To the JDK's key store. You can use keytool to do it.

Reason: Generally when an XML message is signed, the signature includes only the signing cert. X509 Certificates are like singly linked lists. The End Entity points to its issuer. The issuer points to its issuer until you get to a self-signed Root CA, which points to itself. To verify a certificate according to PKIX, the validator needs to be able to build the whole CA chain from end entity to self signed root, so every part of the chain (except for the end entity) must be in your certificate store.

Upvotes: 3

xelco52
xelco52

Reputation: 5347

Insert the public cert of the issuing CA into the cacert keystore.

edit: You can use keytool or one of the other tools out there. Article describes keytool use: keytool-Key and Certificate Management Tool

Upvotes: 4

Related Questions