1*b1cdbd2cSJim JagielskiThe XML Security library has been modified, so that there is NO verification of 2*b1cdbd2cSJim Jagielskithe certificate during sign or verification operation. On Windows this was done 3*b1cdbd2cSJim Jagielskiin the function xmlSecMSCryptoX509StoreVerify (file src/mscrypto/x509vfy.c) and 4*b1cdbd2cSJim Jagielskion UNIX in xmlSecNssX509StoreVerify (file src/nss/x509vfy.c). 5*b1cdbd2cSJim Jagielski 6*b1cdbd2cSJim JagielskiThe implementation creates certificates from all of the X509Data children, such 7*b1cdbd2cSJim Jagielskias X509IssuerSerial and X509Certificate and stores them in a certificate store 8*b1cdbd2cSJim Jagielski(see xmlsec/src/mscrypto/x509.c:xmlSecMSCryptoX509DataNodeRead). It must then 9*b1cdbd2cSJim Jagielskifind the certificate containing the public key which is used for validation 10*b1cdbd2cSJim Jagielskiwithin that store. This is done in xmlSecMSCryptoX509StoreVerify. This function 11*b1cdbd2cSJim Jagielskihowever only takes those certificates into account which can be validated. This 12*b1cdbd2cSJim Jagielskiwas changed by the patch xmlsec1-noverify.patch, which prevents this certificate 13*b1cdbd2cSJim Jagielskivalidation. 14*b1cdbd2cSJim Jagielski 15*b1cdbd2cSJim JagielskixmlSecMSCryptoX509StoreVerify iterates over all certificates contained or 16*b1cdbd2cSJim Jagielskireferenced in the X509Data elements and selects one which is no issuer of any of 17*b1cdbd2cSJim Jagielskithe other certificates. This certificate is not necessarily the one which was 18*b1cdbd2cSJim Jagielskiused for signing but it must contain the proper validation key, which is 19*b1cdbd2cSJim Jagielskisufficient to validate the signature. See 20*b1cdbd2cSJim Jagielskihttp://www.w3.org/TR/xmldsig-core/#sec-X509Data 21*b1cdbd2cSJim Jagielskifor details. 22*b1cdbd2cSJim Jagielski 23*b1cdbd2cSJim JagielskiThere is a flag XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS that can be set 24*b1cdbd2cSJim Jagielskiin a xmlSecKeyInfoCtx (see function xmlSecNssKeyDataX509XmlRead, in file 25*b1cdbd2cSJim Jagielskisrc/nss/x509.c), which indicates that one can turn off the validation. However, 26*b1cdbd2cSJim Jagielskisetting it will cause that the validation key is not found. If the flag is set, 27*b1cdbd2cSJim Jagielskithen the key is not extracted from the certificate store which contains all the 28*b1cdbd2cSJim Jagielskicertificates of the X509Data elements. In other words, the certificates which 29*b1cdbd2cSJim Jagielskiare delivered within the XML signature are not used when looking for suitable 30*b1cdbd2cSJim Jagielskivalidation key. 31*b1cdbd2cSJim Jagielski 32*b1cdbd2cSJim Jagielski 33