Hi Aleksey,<br><br>Taking pointers from this mail thred:<a href="http://www.aleksey.com/pipermail/xmlsec/2008/008300.html" target="_blank">http://www.aleksey.com/pipermail/xmlsec/2008/008300.html</a><br><br>I also tried extracting the intermediate CA cert from my signed file and give it as a untrusted input, still the verification fails.<br>
<br> xmlsec1 --verify --trusted-pem Root.pem --untrusted-pem .pem signa<br>ture.xml<br><br>Regards,<br>Ashish<br><br><div class="gmail_quote">On Thu, Jun 4, 2009 at 8:25 PM, Ashish Agrawal <span dir="ltr"><<a href="mailto:meetashish@gmail.com" target="_blank">meetashish@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi Aleksey,<br><br>My signature.xml file has two certificate, one is the end certificate and the other is the intermediate CA.<br>
In the intermediate certificate also the "CA" field is true .Could this be the root cause of the problem.<br>
<br>Attaching the intermediate CA pem file<br><br>Thanks for ur help.<br><br>Regards,<br><font color="#888888">Ashish</font><div><div></div><div><br><br><br><div class="gmail_quote">On Thu, Jun 4, 2009 at 8:21 PM, Aleksey Sanin <span dir="ltr"><<a href="mailto:aleksey@aleksey.com" target="_blank">aleksey@aleksey.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">This error means that xmlsec can't build certs chain for some reasons.<br>
<br>
Aleksey<br>
<br>
Ashish Agrawal wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div><div></div><div>
Hi Aleksey,<br>
<br>
I ve a problem where i v a root CA and and two certificates in the chain, when i try to verify the chain using openssl it works :<br>
openssl verify -CAfile root.pem EE.pem <br>
but when i to to verify using xmlsec it fails with the error :<br>
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=360:obj=x509-store:subj=X509_verify_cert:error=4:crypto library function failed:subj=/C=CN/ST=BJ/O=JIL/OU=JIL/CN=JIL EE demo;err=20;msg=unable to get local issuer certificate<br>
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=408:obj=x509-store:subj=unknown:error=71:certificate verification failed:err=20;msg=unable to get local issuer certificate<br>
func=xmlSecKeysMngrGetKey:file=keys.c:line=1364:obj=unknown:subj=xmlSecKeysMngrFindKey:error=1:xmlsec library function failed:<br>
func=xmlSecDSigCtxProcessKeyInfoNode:file=xmldsig.c:line=884:obj=unknown:subj=unknown:error=45:key is not found:<br>
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=578:obj=unknown:subj=xmlSecDSigCtxProcessKeyInfoNode:error=1:xmlsec library function failed:<br>
func=xmlSecDSigCtxVerify:file=xmldsig.c:line=379:obj=unknown:subj=xmlSecDSigCtxSigantureProcessNode:error=1:xmlsec library function failed:<br>
Error: signature failed<br>
ERROR<br>
SignedInfo References (ok/all): 6/6<br>
Manifests References (ok/all): 0/0<br>
<br>
<br>
Does xmlsec imposes ny additional constraint on the certificate validation and if yes what are they ?<br>
<br>
Regards,<br>
Ashish<br>
<br>
<br></div></div>
------------------------------------------------------------------------<br>
<br>
_______________________________________________<br>
xmlsec mailing list<br>
<a href="mailto:xmlsec@aleksey.com" target="_blank">xmlsec@aleksey.com</a><br>
<a href="http://www.aleksey.com/mailman/listinfo/xmlsec" target="_blank">http://www.aleksey.com/mailman/listinfo/xmlsec</a><br>
</blockquote>
</blockquote></div><br>
</div></div></blockquote></div><br>