You are viewing a plain text version of this content. The canonical link for it is here.
Posted to wss4j-dev@ws.apache.org by "Seumas Soltysik (JIRA)" <ji...@apache.org> on 2010/09/29 06:26:32 UTC
[jira] Updated: (WSS-40) WSSecurityEngine does not support chained
certificates
[ https://issues.apache.org/jira/browse/WSS-40?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Seumas Soltysik updated WSS-40:
-------------------------------
Attachment: wss-40-test.patch
Hi Colm,
Thanks for the response. Here is what I am thinking for a testcase and for wss4j modifications.
1)Create a Certificate chain where A is signed by B which is signed by a CA.
2)Create a keystore containing only the CA
3)Create a message that is signed by Cert A and includes Cert A and Cert B within the BST using the PKIPath ValueType.
4)Call WSSecEngine.processSecurityHeader() on the signed message.
This should test the above scenario where the server keystore only has the CA and WSS4J is able to validate the CertChain against the CA in the keystore.
What do you think?
I am attaching what I think are the necessary changes to WSS4J which will validate the Cert chain when the ValueType for the BST is set to PKIPath.
I will put together a test following the above outline on the trunk as a start.
> WSSecurityEngine does not support chained certificates
> ------------------------------------------------------
>
> Key: WSS-40
> URL: https://issues.apache.org/jira/browse/WSS-40
> Project: WSS4J
> Issue Type: Bug
> Affects Versions: 1.5.6
> Environment: WSS4J 1.0.0, Axis 1.2.1, Sun JDK 1.4.2
> Reporter: Guy Rixon
> Assignee: Colm O hEigeartaigh
> Fix For: 1.6
>
> Attachments: wss-40-test.patch
>
>
> My project, which is associated with the Grid, uses limited proxy certificates for digital signature. I.e., the signing application holds a user's permanent certificate, signed by a CA and a proxy certificate signed with the permanent certificate. The application signs a message using the proxy certificate and includes both the proxy and permanent certificates in the message header as a WS-Security direct reference to a BinarySecurityToken. The service has the CA certificate with which the user's permanent certficate was signed. Therefore, to establish trust, the service has to chain back from the proxy to the permanent certificate and then to the CA certificate.
> WSSignEnvelope includes both certificates correctly but WSSecurityEngine fails when checking the chain of trust. WSSecurityEngine..processSecurityHeader() only adds one certificate to the results passed back to WSDoAllReceiver; it ignores the intermediate certificate in the chain.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org