Still no success I'm afraid. I'm starting to think that the only option I'm left with is to (within my application) manually parse the signed document and add all of the certificates to the untrusted store. <br>
<br>Failing that I suppose I can get serious and debug xmlsec to see what's going on.<br><br>Thanks again for your ideas - and do keep them coming whilst your patience persists :)<br><br><div class="gmail_quote">On Thu, Feb 21, 2008 at 3:21 PM, Aleksey Sanin <<a href="mailto:aleksey@aleksey.com">aleksey@aleksey.com</a>> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d"><br>
<br>
> My understanding (which may be flawed!) is that the following output<br>
> represents a single unique chain:<br>
<br>
</div>Yes, this is a single chain :) Next idea, could you try to remove<br>
the self-signed (root) certificate from the signature and just<br>
supply it as the parameter to xmlsec command line utility?<br>
I can see how openssl can be confused if it this certificate in<br>
two places.<br>
<font color="#888888"><br>
Aleksey<br>
<br>
</font></blockquote></div><br>