Do I need to load the trusted roots manually (does the xmlsec utility?)? If that's the case, that may be why xmlsec will verify it but my code won't, it doesn't load the root certificates. I'll give that a try.
<br><br><div class="gmail_quote">On Dec 4, 2007 8:19 PM, Aleksey Sanin <<a href="mailto:aleksey@aleksey.com">aleksey@aleksey.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Yes, it will get a key from the certificate! You need a trusted<br>certificate (e.g. root CA certificate) to have the certificate<br>in the signature verified.<br><font color="#888888"><br>Aleksey<br></font><div><div></div>
<div class="Wj3C7c"><br><br>Jim Nutt wrote:<br>> Ok, a bit more info. The xmlsec utility will verify the signature<br>> without being passed the pem file separately, so it apparently is able<br>> to suck the key from the signature. I'm trying to create a minimal size
<br>> code set that demonstrates the problem, I'll post that when I have it.<br>><br></div></div></blockquote></div><br><br clear="all"><br>-- <br>Jim Nutt<br><a href="http://jim.nuttz.org">http://jim.nuttz.org</a>