I'm using xades4j and I'm getting this exception when trying to verify signature:
xades4j.verification.SigningCertificateCertsNotInCertPathException: Verification failed for property 'SigningCertificate': SigningCertificate property contains one or more certificates that are not part of the certification path.
Here is my code to sign:
public File sign(final X509Certificate x509, final PrivateKey priv, final Element elemToSign, final Document doc, final String fileName, final com.softexpert.crypto.document.Document document, List<X509Certificate> chain) throws Exception {
final KeyingDataProvider kp = new SEDirectKeyingDataProvider(x509, priv, chain);
XadesSigningProfile profile = new XadesBesSigningProfile(kp);
final SESignaturePropertiesProvider propProv = this.getPropertiesProvider(document);
profile = profile.withSignaturePropertiesProvider(propProv);
profile = profile.withAlgorithmsProvider(AlgorithmsProvider.class);
profile = profile.withTimeStampTokenProvider(TimeStampTokenProvider.class);
final SignerBES signer = (SignerBES) profile.newSigner();
final IndividualDataObjsTimeStampProperty dataObjsTimeStamp = new IndividualDataObjsTimeStampProperty();
final DataObjectDesc obj = new EnvelopedXmlObject(elemToSign.getFirstChild()).withDataObjectTimeStamp(dataObjsTimeStamp);
AllDataObjsCommitmentTypeProperty commitment = null;
if (document.isProofOfOrigin() != null && document.isProofOfOrigin()) {
commitment = AllDataObjsCommitmentTypeProperty.proofOfOrigin();
} else {
commitment = AllDataObjsCommitmentTypeProperty.proofOfReceipt();
}
SignedDataObjects dataObjs = new SignedDataObjects(obj).withCommitmentType(commitment);
dataObjs = dataObjs.withDataObjectsTimeStamp();
signer.sign(dataObjs, elemToSign);
return this.outputDocument(doc, fileName);
}
private SESignaturePropertiesProvider getPropertiesProvider(com.softexpert.crypto.document.Document document) {
SESignaturePropertiesProvider propertiesProvider = new SESignaturePropertiesProvider();
if (document.getRole() != null) {
final SignerRoleProperty signerRole = new SignerRoleProperty().withClaimedRole(document.getRole());
propertiesProvider.setSignerRole(signerRole);
}
final SigningTimeProperty signingTime = new SigningTimeProperty();
propertiesProvider.setSigningTime(signingTime);
if (document.getLocalityName() != null && document.getCountry() != null) {
final SignatureProductionPlaceProperty signatureProductionPlaceProperty = new SignatureProductionPlaceProperty(document.getLocalityName(), document.getCountry());
propertiesProvider.setSignatureProductionPlaceProperty(signatureProductionPlaceProperty);
}
return propertiesProvider;
}
private File outputDocument(final Document doc, String fileName) throws Exception {
if (!fileName.endsWith(".dsg")) {
fileName += ".dsg";
}
FileOutputStream out = null;
File f = null;
try {
final TransformerFactory tf = TransformerFactory.newInstance();
f = new File(fileName);
if (!f.exists()) {
new File(f.getParent()).mkdirs();
f.createNewFile();
}
out = new FileOutputStream(f);
tf.newTransformer().transform(new DOMSource(doc), new StreamResult(out));
} finally {
if(out != null) {
try {
out.close();
} catch(IOException e) {}
}
}
return f;
}
And here is my code to verify:
try {
final org.w3c.dom.Document doc = this.getDomDocument();
doc.getDocumentElement().normalize();
// Find Signature element
final NodeList nl = doc.getElementsByTagNameNS(javax.xml.crypto.dsig.XMLSignature.XMLNS, "Signature");
final CertStore crls = ... // get CRLS
final CertStore certs = ... // get intermediate certs
final KeyStore ks = ... // get KS from Windows-ROOT
final PKIXCertificateValidationProvider cvp = new PKIXCertificateValidationProvider(ks, false, certs, crls);
final XadesVerificationProfile p = new XadesVerificationProfile(cvp);
p.withTimeStampTokenVerifier(SETimeStampTokenProvider.class);
final Element signatureElemntNode = (Element) nl.item(0);
final XadesVerifier verifier = p.newVerifier();
XAdESVerificationResult verificationResult = verifier.verify(signatureElemntNode, null); // exception is thrown here
}
I've searched for this error but couldn't find anything to help me. How can I solve this error?
Thanks in advance.
Based on lgoncalve's answer, I've changed my code a little bit:
Signing: Instead of signing with the whole chain of certificates, I used only the signing certificate, so that SEDirectKeyingDataProvider.getSigningCertificateChain()
returns only the signing cert). With this approach, my xml now has only one property <SigningCertificate>
and no more the whole chain.
Verifying: Using the approach I've commented above, I had a problem when verifying certs: in my xml, only the signing certificate was being referenced in property <ds:X509Certificate>
, so that I could not verify the whole chain. To solve it, I had to use this code after calling XAdESVerificationResult result = verifier.verify(signatureElemntNode, null);
:
for(X509Certificate cert : chain) {
result.getSignature().addKeyInfo(cert);
}
Using this code, each cert of the chain is referenced by a property <ds:X509Certificate>
and I can obtain the whole chain to verify if it is trustworthy or not.