Certificate Verification - guidelines requested

Thread view:

Stephen Chell - 21 Apr 2004 05:23 GMT

My java app gets an X509 certificate out of an XML signature, and I
want to verify that the certificate is signed by any one of several
trusted CAs.

If we assume that all relevant CA certificates are stored in the
"cacerts" file in the local JDK, what is a simple way of verifying
that the original certificate is signed by one of these trusted CAs?

Please outline the steps my code should perform. (I couldn't find any
simple examples in the JDK documentation or on the web.)

Thanks very much!

Steve

Reply to this Message

Michel Gallant - 21 Apr 2004 16:38 GMT

One procedure to achieve that is:

- oX509Certificate.getIssuerDN().getName() (get the issuer Principal DN)
- check if this DN exists in your cacerts keystore (enumerate the cacerts keystore and get the
potential signer cert)
and get the associated PublicKey issuerPBK
- verify that DN's signature on your cert via oX509Certificate.verify(issuerPBK ...)

- Mitch

> My java app gets an X509 certificate out of an XML signature, and I
> want to verify that the certificate is signed by any one of several
[quoted text clipped - 10 lines]
>
> Steve

Reply to this Message

sickofspam@spam.com - 24 Apr 2004 06:56 GMT

> My java app gets an X509 certificate out of an XML signature, and I
> want to verify that the certificate is signed by any one of several
[quoted text clipped - 10 lines]
>
> Steve

Hi,
Have you looked at certpath API in JDK 1.4?

Reply to this Message

Certificate Verification - guidelines requested

Free Magazines