search

PeculiarVentures / PKI.js

PKI.js is a pure JavaScript library implementing the formats that are used in PKI applications (signing, encryption, certificate requests, OCSP and TSP requests/responses). It is built on WebCrypto (Web Cryptography API) and requires no plug-ins.
http://pkijs.org
Other
1.25k stars 204 forks source link

Validation of certificate chain with `SignedData.verify` always returns true #332

Closed vicpara closed 2 years ago

vicpara commented 2 years ago

I am trying to validate the certificate chain of a signature as shown in the example: https://github.com/PeculiarVentures/PKI.js/tree/master/examples/PDFExample .

It seems that the SignedData.verify function returns true regardless of what certificates are provided in the chain. https://github.com/PeculiarVentures/PKI.js/blob/8904acd43a2c360dfe27b5895c2cccc57f88c069/examples/PDFExample/es6.js#L64 .

Can anyone provide more insights on how to achieve this certificate chain validation?

Thank you, Victor

microshine commented 2 years ago

@vicpara Do you use checkChain parameter?

const result = await signedData.verify({
  // ... parameters
  checkChain: true,
})

https://github.com/PeculiarVentures/PKI.js/blob/master/src/SignedData.js#L627

vicpara commented 2 years ago

The signature I am trying to validate is applied to the PDF file by Adobe Acrobat using a certificate generated by Adobe as part of their wizzard. The PDF file generally validates fine in Adobe Acrobat.

I tried with checkChain: true and I get an error as string: "Validation of signer's certificate failed".
Setting additionally extendedMode: true, gets me the following error as json:

{
  "date": "2021-09-01T15:43:34.378Z",
  "code": 5,
  "message": "Validation of signer's certificate failed: No valid certificate paths found",
  "signatureVerified": null,
  "signerCertificate": {
    "tbs": "3082026EA003020102020A52DAA2B99E899534D5D6300D06092A864886F70D01010B0500307131193017060355040313104F6C6573697320416C6573696F6E6B6131123010060355040A130959754D6920446F637331123010060355040B130959754D6920446F6373311F301D06092A864886F70D01090116106F6C6573697340676D61696C2E636F6D310B300906035504061302564E301E170D3231303330393230303431335A170D3236303330393230303431335A307131193017060355040313104F6C6573697320416C6573696F6E6B6131123010060355040A130959754D6920446F637331123010060355040B130959754D6920446F6373311F301D06092A864886F70D01090116106F6C6573697340676D61696C2E636F6D310B300906035504061302564E30820122300D06092A864886F70D01010105000382010F003082010A0282010100D6879053B0A05AA74D8E22584B1D3364EA0B6BBA404245315863F7462F3A4E933C071FAB31CE3873433A584C922881B8A640A232D29F20C0D31B06449BEEF4BECE716B7BC351D52788D533666D609BC497C5177CF7F311C739AEBCC07C9CE843340BF1EBD9CD2D09B088582FA2C3D8A5665B7211EE637CB56E8F7A44B6B045426BCA7B4FAA29FA892D210EAEFD9AA765292BC25D0C76B54E07DF0C40E1B5AE6EE593C17FFC7B19A42CF74A064A095BC87C284E90AB4CE2BBE1D5CD2A53B67953E816388881699955460E8D0A11F41B52DEBF8638628570E2FF559CC26FEA347D311CCAD90A4B5E3DBAA3E9B371182F08B5693B3184F8DC5A3D8012269F5FECAB0203010001A320301E300F06092A864886F72F01010A04020500300B0603551D0F040403020780",
    "serialNumber": {
      "blockName": "INTEGER",
      "blockLength": 12,
      "error": "",
      "warnings": [],
      "valueBeforeDecode": "020A52DAA2B99E899534D5D6",
      "idBlock": {
        "blockName": "identificationBlock",
        "blockLength": 1,
        "error": "",
        "warnings": [],
        "valueBeforeDecode": "",
        "isHexOnly": false,
        "valueHex": "",
        "tagClass": 1,
        "tagNumber": 2,
        "isConstructed": false
      },
      "lenBlock": {
        "blockName": "lengthBlock",
        "blockLength": 1,
        "error": "",
        "warnings": [],
        "valueBeforeDecode": "",
        "isIndefiniteForm": false,
        "longFormUsed": false,
        "length": 10
      },
      "valueBlock": {
        "blockName": "IntegerValueBlock",
        "blockLength": 10,
        "error": "",
        "warnings": [
          "Too big Integer for decoding, hex only"
        ],
        "valueBeforeDecode": "",
        "isHexOnly": true,
        "valueHex": "52DAA2B99E899534D5D6",
        "valueDec": 0
      }
    },
    "signature": {
      "algorithmId": "1.2.840.113549.1.1.11",
      "algorithmParams": {
        "blockName": "NULL",
        "blockLength": 2,
        "error": "",
        "warnings": [],
        "valueBeforeDecode": "0500",
        "idBlock": {
          "blockName": "identificationBlock",
          "blockLength": 1,
          "error": "",
          "warnings": [],
          "valueBeforeDecode": "",
          "isHexOnly": false,
          "valueHex": "",
          "tagClass": 1,
          "tagNumber": 5,
          "isConstructed": false
        },
        "lenBlock": {
          "blockName": "lengthBlock",
          "blockLength": 1,
          "error": "",
          "warnings": [],
          "valueBeforeDecode": "",
          "isIndefiniteForm": false,
          "longFormUsed": false,
          "length": 0
        },
        "valueBlock": {
          "blockName": "baseBlock",
          "blockLength": 0,
          "error": "",
          "warnings": [],
          "valueBeforeDecode": ""
        }
      }
    },
    "issuer": {
      "typesAndValues": [
        {
          "type": "2.5.4.3",
          "value": {
            "blockName": "PrintableString",
            "blockLength": 18,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "13104F6C6573697320416C6573696F6E6B61",
            "idBlock": {
              "blockName": "identificationBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": false,
              "valueHex": "",
              "tagClass": 1,
              "tagNumber": 19,
              "isConstructed": false
            },
            "lenBlock": {
              "blockName": "lengthBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isIndefiniteForm": false,
              "longFormUsed": false,
              "length": 16
            },
            "valueBlock": {
              "blockName": "SimpleStringValueBlock",
              "blockLength": 16,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": true,
              "valueHex": "4F6C6573697320416C6573696F6E6B61",
              "value": "TEST USER"
            }
          }
        },
        {
          "type": "2.5.4.10",
          "value": {
            "blockName": "PrintableString",
            "blockLength": 11,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "130959754D6920446F6373",
            "idBlock": {
              "blockName": "identificationBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": false,
              "valueHex": "",
              "tagClass": 1,
              "tagNumber": 19,
              "isConstructed": false
            },
            "lenBlock": {
              "blockName": "lengthBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isIndefiniteForm": false,
              "longFormUsed": false,
              "length": 9
            },
            "valueBlock": {
              "blockName": "SimpleStringValueBlock",
              "blockLength": 9,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": true,
              "valueHex": "59754D6920446F6373",
              "value": "Operations"
            }
          }
        },
        {
          "type": "2.5.4.11",
          "value": {
            "blockName": "PrintableString",
            "blockLength": 11,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "130959754D6920446F6373",
            "idBlock": {
              "blockName": "identificationBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": false,
              "valueHex": "",
              "tagClass": 1,
              "tagNumber": 19,
              "isConstructed": false
            },
            "lenBlock": {
              "blockName": "lengthBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isIndefiniteForm": false,
              "longFormUsed": false,
              "length": 9
            },
            "valueBlock": {
              "blockName": "SimpleStringValueBlock",
              "blockLength": 9,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": true,
              "valueHex": "59754D6920446F6373",
              "value": "Operations"
            }
          }
        },
        {
          "type": "1.2.840.113549.1.9.1",
          "value": {
            "blockName": "IA5String",
            "blockLength": 18,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "16106F6C6573697340676D61696C2E636F6D",
            "idBlock": {
              "blockName": "identificationBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": false,
              "valueHex": "",
              "tagClass": 1,
              "tagNumber": 22,
              "isConstructed": false
            },
            "lenBlock": {
              "blockName": "lengthBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isIndefiniteForm": false,
              "longFormUsed": false,
              "length": 16
            },
            "valueBlock": {
              "blockName": "SimpleStringValueBlock",
              "blockLength": 16,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": true,
              "valueHex": "6F6C6573697340676D61696C2E636F6D",
              "value": "test@example.com"
            }
          }
        },
        {
          "type": "2.5.4.6",
          "value": {
            "blockName": "PrintableString",
            "blockLength": 4,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "1302564E",
            "idBlock": {
              "blockName": "identificationBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": false,
              "valueHex": "",
              "tagClass": 1,
              "tagNumber": 19,
              "isConstructed": false
            },
            "lenBlock": {
              "blockName": "lengthBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isIndefiniteForm": false,
              "longFormUsed": false,
              "length": 2
            },
            "valueBlock": {
              "blockName": "SimpleStringValueBlock",
              "blockLength": 2,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": true,
              "valueHex": "564E",
              "value": "VN"
            }
          }
        }
      ]
    },
    "notBefore": {
      "type": 0,
      "value": "2021-03-09T20:04:13.000Z"
    },
    "notAfter": {
      "type": 0,
      "value": "2026-03-09T20:04:13.000Z"
    },
    "subject": {
      "typesAndValues": [
        {
          "type": "2.5.4.3",
          "value": {
            "blockName": "PrintableString",
            "blockLength": 18,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "13104F6C6573697320416C6573696F6E6B61",
            "idBlock": {
              "blockName": "identificationBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": false,
              "valueHex": "",
              "tagClass": 1,
              "tagNumber": 19,
              "isConstructed": false
            },
            "lenBlock": {
              "blockName": "lengthBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isIndefiniteForm": false,
              "longFormUsed": false,
              "length": 16
            },
            "valueBlock": {
              "blockName": "SimpleStringValueBlock",
              "blockLength": 16,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": true,
              "valueHex": "4F6C6573697320416C6573696F6E6B61",
              "value": "Test User"
            }
          }
        },
        {
          "type": "2.5.4.10",
          "value": {
            "blockName": "PrintableString",
            "blockLength": 11,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "130959754D6920446F6373",
            "idBlock": {
              "blockName": "identificationBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": false,
              "valueHex": "",
              "tagClass": 1,
              "tagNumber": 19,
              "isConstructed": false
            },
            "lenBlock": {
              "blockName": "lengthBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isIndefiniteForm": false,
              "longFormUsed": false,
              "length": 9
            },
            "valueBlock": {
              "blockName": "SimpleStringValueBlock",
              "blockLength": 9,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": true,
              "valueHex": "59754D6920446F6373",
              "value": "Operations"
            }
          }
        },
        {
          "type": "2.5.4.11",
          "value": {
            "blockName": "PrintableString",
            "blockLength": 11,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "130959754D6920446F6373",
            "idBlock": {
              "blockName": "identificationBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": false,
              "valueHex": "",
              "tagClass": 1,
              "tagNumber": 19,
              "isConstructed": false
            },
            "lenBlock": {
              "blockName": "lengthBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isIndefiniteForm": false,
              "longFormUsed": false,
              "length": 9
            },
            "valueBlock": {
              "blockName": "SimpleStringValueBlock",
              "blockLength": 9,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": true,
              "valueHex": "59754D6920446F6373",
              "value": "Operations"
            }
          }
        },
        {
          "type": "1.2.840.113549.1.9.1",
          "value": {
            "blockName": "IA5String",
            "blockLength": 18,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "16106F6C6573697340676D61696C2E636F6D",
            "idBlock": {
              "blockName": "identificationBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": false,
              "valueHex": "",
              "tagClass": 1,
              "tagNumber": 22,
              "isConstructed": false
            },
            "lenBlock": {
              "blockName": "lengthBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isIndefiniteForm": false,
              "longFormUsed": false,
              "length": 16
            },
            "valueBlock": {
              "blockName": "SimpleStringValueBlock",
              "blockLength": 16,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": true,
              "valueHex": "6F6C6573697340676D61696C2E636F6D",
              "value": "test@test.com"
            }
          }
        },
        {
          "type": "2.5.4.6",
          "value": {
            "blockName": "PrintableString",
            "blockLength": 4,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "1302564E",
            "idBlock": {
              "blockName": "identificationBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": false,
              "valueHex": "",
              "tagClass": 1,
              "tagNumber": 19,
              "isConstructed": false
            },
            "lenBlock": {
              "blockName": "lengthBlock",
              "blockLength": 1,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isIndefiniteForm": false,
              "longFormUsed": false,
              "length": 2
            },
            "valueBlock": {
              "blockName": "SimpleStringValueBlock",
              "blockLength": 2,
              "error": "",
              "warnings": [],
              "valueBeforeDecode": "",
              "isHexOnly": true,
              "valueHex": "564E",
              "value": "VN"
            }
          }
        }
      ]
    },
    "subjectPublicKeyInfo": {
      "kty": "RSA",
      "n": "1oeQU7CgWqdNjiJYSx0zZOoLa7pAQkUxWGP3Ri86TpM8Bx-rMc44c0M6WEySKIG4pkCiMtKfIMDTGwZEm-70vs5xa3vDUdUniNUzZm1gm8SXxRd89_MRxzmuvMB8nOhDNAvx69nNLQmwiFgvosPYpWZbchHuY3y1bo96RLawRUJryntPqin6iS0hDq79mqdlKSvCXQx2tU4H3wxA4bWubuWTwX_8exmkLPdKBkoJW8h8KE6Qq0ziu-HVzSpTtnlT6BY4iIFpmVVGDo0KEfQbUt6_hjhihXDi_1Wcwm_qNH0xHMrZCktePbqj6bNxGC8ItWk7MYT43Fo9gBImn1_sqw",
      "e": "AQAB"
    },
    "signatureAlgorithm": {
      "algorithmId": "1.2.840.113549.1.1.11",
      "algorithmParams": {
        "blockName": "NULL",
        "blockLength": 2,
        "error": "",
        "warnings": [],
        "valueBeforeDecode": "0500",
        "idBlock": {
          "blockName": "identificationBlock",
          "blockLength": 1,
          "error": "",
          "warnings": [],
          "valueBeforeDecode": "",
          "isHexOnly": false,
          "valueHex": "",
          "tagClass": 1,
          "tagNumber": 5,
          "isConstructed": false
        },
        "lenBlock": {
          "blockName": "lengthBlock",
          "blockLength": 1,
          "error": "",
          "warnings": [],
          "valueBeforeDecode": "",
          "isIndefiniteForm": false,
          "longFormUsed": false,
          "length": 0
        },
        "valueBlock": {
          "blockName": "baseBlock",
          "blockLength": 0,
          "error": "",
          "warnings": [],
          "valueBeforeDecode": ""
        }
      }
    },
    "signatureValue": {
      "blockName": "BIT STRING",
      "blockLength": 261,
      "error": "",
      "warnings": [],
      "valueBeforeDecode": "038201010060AE70EAAAF6F836A30B1136FFD9962EA513BABB32B68A602CFB3DC4D8E07F65DDC4F84E26699B201874C3D4578C0A3C99640600C727CE8B67A1C4339704DAB1DE5168955B2EB9A7A48259DDE878012FA3DD3819ACA837CDDFF7636BBE3D6BA5B561950F30181AB65E045911FFA88CDF3A7F221286BCD12D43E650088A2104C300213203EC288E8FCB3EFAFFEEFA0822DE69701405A2488EB77F86E7EFA59D3EDD9011F2D9E0E6B698C2779CE4DE2B06D690888870A39F704A27FEEA9A46FBB05F27D724BC461162C0FFCA6A689DCF3532A39961294CA3D542F82B04E196ADE7D4870398CF11B10762B1DC36C66218D07F783CFE78106E265512423E80A9EC2F",
      "idBlock": {
        "blockName": "identificationBlock",
        "blockLength": 1,
        "error": "",
        "warnings": [],
        "valueBeforeDecode": "",
        "isHexOnly": false,
        "valueHex": "",
        "tagClass": 1,
        "tagNumber": 3,
        "isConstructed": false
      },
      "lenBlock": {
        "blockName": "lengthBlock",
        "blockLength": 3,
        "error": "",
        "warnings": [],
        "valueBeforeDecode": "",
        "isIndefiniteForm": false,
        "longFormUsed": true,
        "length": 257
      },
      "valueBlock": {
        "blockName": "BitStringValueBlock",
        "blockLength": 257,
        "error": "",
        "warnings": [],
        "valueBeforeDecode": "",
        "isIndefiniteForm": false,
        "value": [],
        "isHexOnly": false,
        "valueHex": "60AE70EAAAF6F836A30B1136FFD9962EA513BABB32B68A602CFB3DC4D8E07F65DDC4F84E26699B201874C3D4578C0A3C99640600C727CE8B67A1C4339704DAB1DE5168955B2EB9A7A48259DDE878012FA3DD3819ACA837CDDFF7636BBE3D6BA5B561950F30181AB65E045911FFA88CDF3A7F221286BCD12D43E650088A2104C300213203EC288E8FCB3EFAFFEEFA0822DE69701405A2488EB77F86E7EFA59D3EDD9011F2D9E0E6B698C2779CE4DE2B06D690888870A39F704A27FEEA9A46FBB05F27D724BC461162C0FFCA6A689DCF3532A39961294CA3D542F82B04E196ADE7D4870398CF11B10762B1DC36C66218D07F783CFE78106E265512423E80A9EC2F",
        "unusedBits": 0,
        "isConstructed": false
      }
    },
    "version": 2,
    "extensions": [
      {
        "extnID": "1.2.840.113583.1.1.10",
        "extnValue": {
          "blockName": "OCTET STRING",
          "blockLength": 4,
          "error": "",
          "warnings": [],
          "valueBeforeDecode": "04020500",
          "idBlock": {
            "blockName": "identificationBlock",
            "blockLength": 1,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "",
            "isHexOnly": false,
            "valueHex": "",
            "tagClass": 1,
            "tagNumber": 4,
            "isConstructed": false
          },
          "lenBlock": {
            "blockName": "lengthBlock",
            "blockLength": 1,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "",
            "isIndefiniteForm": false,
            "longFormUsed": false,
            "length": 2
          },
          "valueBlock": {
            "blockName": "OctetStringValueBlock",
            "blockLength": 2,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "",
            "isIndefiniteForm": false,
            "value": [
              {
                "blockName": "NULL",
                "blockLength": 2,
                "error": "",
                "warnings": [],
                "valueBeforeDecode": "0500",
                "idBlock": {
                  "blockName": "identificationBlock",
                  "blockLength": 1,
                  "error": "",
                  "warnings": [],
                  "valueBeforeDecode": "",
                  "isHexOnly": false,
                  "valueHex": "",
                  "tagClass": 1,
                  "tagNumber": 5,
                  "isConstructed": false
                },
                "lenBlock": {
                  "blockName": "lengthBlock",
                  "blockLength": 1,
                  "error": "",
                  "warnings": [],
                  "valueBeforeDecode": "",
                  "isIndefiniteForm": false,
                  "longFormUsed": false,
                  "length": 0
                },
                "valueBlock": {
                  "blockName": "baseBlock",
                  "blockLength": 0,
                  "error": "",
                  "warnings": [],
                  "valueBeforeDecode": ""
                }
              }
            ],
            "isHexOnly": true,
            "valueHex": "0500",
            "isConstructed": false
          }
        }
      },
      {
        "extnID": "2.5.29.15",
        "extnValue": {
          "blockName": "OCTET STRING",
          "blockLength": 6,
          "error": "",
          "warnings": [],
          "valueBeforeDecode": "040403020780",
          "idBlock": {
            "blockName": "identificationBlock",
            "blockLength": 1,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "",
            "isHexOnly": false,
            "valueHex": "",
            "tagClass": 1,
            "tagNumber": 4,
            "isConstructed": false
          },
          "lenBlock": {
            "blockName": "lengthBlock",
            "blockLength": 1,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "",
            "isIndefiniteForm": false,
            "longFormUsed": false,
            "length": 4
          },
          "valueBlock": {
            "blockName": "OctetStringValueBlock",
            "blockLength": 4,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "",
            "isIndefiniteForm": false,
            "value": [
              {
                "blockName": "BIT STRING",
                "blockLength": 4,
                "error": "",
                "warnings": [],
                "valueBeforeDecode": "03020780",
                "idBlock": {
                  "blockName": "identificationBlock",
                  "blockLength": 1,
                  "error": "",
                  "warnings": [],
                  "valueBeforeDecode": "",
                  "isHexOnly": false,
                  "valueHex": "",
                  "tagClass": 1,
                  "tagNumber": 3,
                  "isConstructed": false
                },
                "lenBlock": {
                  "blockName": "lengthBlock",
                  "blockLength": 1,
                  "error": "",
                  "warnings": [],
                  "valueBeforeDecode": "",
                  "isIndefiniteForm": false,
                  "longFormUsed": false,
                  "length": 2
                },
                "valueBlock": {
                  "blockName": "BitStringValueBlock",
                  "blockLength": 2,
                  "error": "",
                  "warnings": [],
                  "valueBeforeDecode": "",
                  "isIndefiniteForm": false,
                  "value": [],
                  "isHexOnly": false,
                  "valueHex": "80",
                  "unusedBits": 7,
                  "isConstructed": false
                }
              }
            ],
            "isHexOnly": true,
            "valueHex": "03020780",
            "isConstructed": false
          }
        },
        "parsedValue": {
          "blockName": "BIT STRING",
          "blockLength": 4,
          "error": "",
          "warnings": [],
          "valueBeforeDecode": "03020780",
          "idBlock": {
            "blockName": "identificationBlock",
            "blockLength": 1,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "",
            "isHexOnly": false,
            "valueHex": "",
            "tagClass": 1,
            "tagNumber": 3,
            "isConstructed": false
          },
          "lenBlock": {
            "blockName": "lengthBlock",
            "blockLength": 1,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "",
            "isIndefiniteForm": false,
            "longFormUsed": false,
            "length": 2
          },
          "valueBlock": {
            "blockName": "BitStringValueBlock",
            "blockLength": 2,
            "error": "",
            "warnings": [],
            "valueBeforeDecode": "",
            "isIndefiniteForm": false,
            "value": [],
            "isHexOnly": false,
            "valueHex": "80",
            "unusedBits": 7,
            "isConstructed": false
          }
        }
      }
    ]
  },
  "signerCertificateVerified": false
}
microshine commented 2 years ago

You've got No valid certificate paths found. I think the problem is in trusted or CA certificates.

If your SignedData doesn't have all required certificates you need to get them from PDF file and put them to signedData.certificates. Also SignedData requires trustedCerts for chain validation. Set your Trusted (Root) certificates to trustedCerts parameter.

vicpara commented 2 years ago

Thank you for your message and for looking into it.
I am setting the trustedCerts correctly but that didn't seem to make much of a difference.
In regards to the required certificates in the SignedData I am a bit confused as it does show the tbs data at the top of my previous message. The problem also seem to exist in the PDFExample of this repository. Any CA bundle would lead to validation as true.

microshine commented 2 years ago

I've got two passed tests.

With valid certificate path

image

With changed signature value for the signing certificate

image

vicpara commented 2 years ago

Thanks for double checking. Finally managed to understand what's going on and get the code to work.

When validating a signature that was actually issued by an intermediate CA (my prod setup) the validation passes.

When trying to validate a signature that was issued by a self signed certificate (RootCA > Signer) the validation fails no matter what I do. The two certificates do pass the validation with openssl: openssl verify -verbose -CAfile CA.crt signer.crt .

For the self signed scenario, is there a way to validate that the signature was either created by a pair with a corresponding signing certificate or, alternatively created by a certificate signed by the RootCA.

Thank you so much for your help so far.