Hi,<div><br><div> Thanks. I had misunderstood a concept. Now it works fine. </div><div><br></div><div>One more question: In this case I know the start and end date of the certificate. What if I dont know the expiry date of the certificate? Then, how can I bypass expiry date checking of certificates?</div>
<div><br></div><div>Will <i><b>XMLSEC_KEYINFO_FLAGS_X509DATA_SKIP_STRICT_CHECKS</b></i> flag be of any help?</div><div><br></div><div>The available documentation on xmlsec says "i<span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: medium; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; ">f the flag is set then we'll skip strict checking of certs and CRLs" . What parameters of a certificate are skipped if we use this flag?</span></div>
<div><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: medium; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><br></span></div><div><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: medium; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; ">If there is no way to handle it in xmlsec, Any pointers to alternate solutions(maybe openssl) would be of great help.. </span></div>
<div><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: medium; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><br></span></div><div><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: medium; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; ">Thanks and Regards,</span></div>
<div><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: medium; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; ">Mahendra Naik</span></div><div><br></div>
<div><br></div><div><br><br><div class="gmail_quote">2010/11/22 Aleksey Sanin <span dir="ltr"><<a href="mailto:aleksey@aleksey.com">aleksey@aleksey.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Try<br>
<br>
--verification-time "2010-11-12 20:45:34"<div><div></div><div class="h5"><br>
<br>
On 11/22/10 2:37 AM, mahendra N wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div></div><div class="h5">
Hi ,<br>
I have tried the folowing command<br>
<br>
xmlsec1 --verify --id-attr:Id LicenceData --verification-time<br>
"2010-12-12 20:45:34" --trusted-pem root_kuc.pem license.xml<br>
<br>
license.xml is signed by root_kuc.pem, which expires on 2010-12-02.<br>
<br>
I get the following error:<br>
<br>
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=360:obj=x509-store:subj=X509_verify_cert:error=4:crypto<br>
library function failed:subj=/C=US/ST=Newyork/O=Company/OU=BI/CN=Company<br>
Licence Generator ILG;err=10;msg=certificate has expired<br>
func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=400:obj=x509-store:subj=unknown:error=76:certificate<br>
has expirred:err=10;msg=certificate has expired<br>
func=xmlSecKeysMngrGetKey:file=keys.c:line=1364:obj=unknown:subj=xmlSecKeysMngrFindKey:error=1:xmlsec<br>
library function failed:<br>
func=xmlSecDSigCtxProcessKeyInfoNode:file=xmldsig.c:line=871:obj=unknown:subj=unknown:error=45:key<br>
is not found:<br>
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=565:obj=unknown:subj=xmlSecDSigCtxProcessKeyInfoNode:error=1:xmlsec<br>
library function failed:<br>
func=xmlSecDSigCtxVerify:file=xmldsig.c:line=366:obj=unknown:subj=xmlSecDSigCtxSigantureProcessNode:error=1:xmlsec<br>
library function failed:<br>
Error: signature failed<br>
ERROR<br>
SignedInfo References (ok/all): 1/1<br>
Manifests References (ok/all): 0/0<br>
Error: failed to verify file "license.xml"<br>
<br>
Thanks and Regards,<br>
Mahendra Naik<br>
<br>
2010/11/22 mahendra N <<a href="mailto:mahendra0203@gmail.com" target="_blank">mahendra0203@gmail.com</a><br></div></div>
<mailto:<a href="mailto:mahendra0203@gmail.com" target="_blank">mahendra0203@gmail.com</a>>><div class="im"><br>
<br>
Hi,<br>
<br>
I want to verify a file, signed with a digital certificate which<br>
has expired. Is there a way in xmlsec to skip the checking of expiry<br>
date of certificates, and only check for the keys?<br>
<br>
<br>
Thanks and Regards,<br>
Mahendra Naik<br>
<br>
<br>
<br>
<br></div>
_______________________________________________<br>
xmlsec mailing list<br>
<a href="mailto:xmlsec@aleksey.com" target="_blank">xmlsec@aleksey.com</a><br>
<a href="http://www.aleksey.com/mailman/listinfo/xmlsec" target="_blank">http://www.aleksey.com/mailman/listinfo/xmlsec</a><br>
</blockquote>
</blockquote></div><br></div></div>