Does XMLSigner.sign() function removes the subject details of the digital certificate even if the input certificate file has the subject details in it?

kudhru commented 7 years ago

Hi

It looks like that the XMLSigner.sign() function removes the subject details of the digital certificate even if the input certificate file has the subject details in it.

For example, if my certificate file is the following: subject=/C=IN/ST=KA/L=Bangalore/O=Public AUA/OU=Staging Services/CN=Public AUA for Staging Services issuer=/C=IN/ST=KA/L=Bangalore/O=Public AUA/OU=Staging Services/CN=Root Public AUA for Staging Services -----BEGIN CERTIFICATE----- MIIDuDCCAqCgAwIBAgIGA7J+eqryMA0GCSqGSIb3DQEBBQUAMIGNMQswCQYDVQQG EwJJTjELMAkGA1UECBMCS0ExEjAQBgNVBAcTCUJhbmdhbG9yZTETMBEGA1UEChMK UHVibGljIEFVQTEZMBcGA1UECxMQU3RhZ2luZyBTZXJ2aWNlczEtMCsGA1UEAxMk Um9vdCBQdWJsaWMgQVVBIGZvciBTdGFnaW5nIFNlcnZpY2VzMB4XDTE2MDUyNDE0 NDAzMVoXDTIwMDUyNDE0NDAzMVowgYgxCzAJBgNVBAYTAklOMQswCQYDVQQIEwJL QTESMBAGA1UEBxMJQmFuZ2Fsb3JlMRMwEQYDVQQKEwpQdWJsaWMgQVVBMRkwFwYD VQQLExBTdGFnaW5nIFNlcnZpY2VzMSgwJgYDVQQDEx9QdWJsaWMgQVVBIGZvciBT dGFnaW5nIFNlcnZpY2VzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA o4XxOsjK58Ud+tQd06Mk8Rd0qoyjA/3u+y0YVYEF6RgT8Ge1uVdTkIcVYaHyXuuH UPLLqGW1hPfVtn81UVIMGyrw5+t1c30wpGv3UJ6GCFu0sPGgG5NwkVbIUt2xgT/O r/kGzHjUJJy4Y6URSkZiDLDQQWRXvui5ZwwsYRJ8LhT0pSUwan1raG5Vl01GmlWV qsrCmnObuoYkN85iwG4/ERGshkgFCPak8B/jH3GPZSi1+FJLmCqMI1xxmTvf0kZb 7ejm2IZFTo6ecYWJ1vylkzUI553RxVbnHCNZvFe3AyaKMyFlknFR0Fkl5+9Lpxz+ VOajbCjicg7jIYCw76/xgQIDAQABoyEwHzAdBgNVHQ4EFgQUJHLir1/Tel8v/6Ou IXpLS0JH8jIwDQYJKoZIhvcNAQEFBQADggEBAFE15qMGIlp8+M306FbhDEvo1vzx N2Pfvg/f92NXH59d2XZ/wuHxugL8qfcM5xkqsDeIRVxRdISpwiIWlqTitn6lenF8 5bvPQ09T/b09dVz/LxwU2Cm6+6H5/HZSoLtCKBOuRzAKQdxczpyfaqv9caFC+Leg PQIm2HCwOM0A4KzhYcFhumGeyCbyVZsSQcJE7bYc/IHkR2erup7h5BACOZ/a+hHL PQok/uGvtEsR3roydNcNlR8Ja6Wc4eUf7kisTuZTxwRJI9DPVimbs0VAqhnsnVWA K3X4+6sFUq5WfHS4wTRhrR93JvEV5LlQ6UCXYOQMvTii8l07qxkDiysVsLQ= -----END CERTIFICATE-----

the signed data does not have the X509SubjectName tag in it. Is this expected? I have to particularly make sure that the subject is there in the signed data in one of my applications.

kislyuk commented 7 years ago

Yes, this is expected. The details are still there. If you have a file like this:

and save it as cert.pem, you can still see all the details with openssl x509 -in cert.pem -text -noout.

kudhru commented 7 years ago

Thanks. So, the API to which I am sending the certificate info requires the subject details explicitly. I am adding the subject tag after calling the XMLSigner.sign() function. Will this cause any issues in certificate verification? I am sorry I am very less conversant with certificate verification etc. Sorry, if this is a trivial question.

kislyuk commented 7 years ago

Give it a try, you should still be able to verify the signature you signed.

kudhru commented 7 years ago

thnx!

XML-Security / signxml

Does XMLSigner.sign() function removes the subject details of the digital certificate even if the input certificate file has the subject details in it? #79