Hi,
I use the 'xmlSecKeyDataXmlRead' and 'xmlSecKeyDataXmlWrite' functions
to save and load X509 certificate in XML, but I get a strange behavior.
When I write my certificate stored in the xmlSecKeyDataPtr section of
the xmlSecKeyPtr, everything is ok, and I get the following XML (Notice
that I want the SubjectName an IssuerSerial to be present):
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<dsig:X509Data xmlns:dsig="http://www.w3.org/2000/09/xmldsig#";>
<dsig:X509Certificate>MIIDHTCCAt0CAQEwCQYHKoZIzjgEAzB6MQswCQYDVQQGEwJGUjEPMA0GA1UECBMGRnJhbmNlMRUwEwYDVQQHEwxTY2hpbHRpZ2hlaW0xDDAKBgNVBAoTAzRKUzEjMCEGA1UECxMaRm91ciBKJ3MgRGV2ZWxvcG1lbnQgVG9vbHMxEDAOBgNVBAMTB2RzYXJvb3QwHhcNMDgwNjA1MTMwMDI1WhcNMTgwNjAzMTMwMDI1WjB2MQswCQYDVQQGEwJGUjEPMA0GA1UECBMGRnJhbmNlMRUwEwYDVQQHEwxTY2hpbHRpZ2hlaW0xDDAKBgNVBAoTAzRKUzEjMCEGA1UECxMaRm91ciBKJ3MgRGV2ZWxvcG1lbnQgVG9vbHMxDDAKBgNVBAMTA2RzYTCCAbcwggEsBgcqhkjOOAQBMIIBHwKBgQCvfbNJkDmPgfY1AkKjmRL+VJVaEpPwKzh8DqeGHw1JWsYN4NJf3rMNllirBCi2x8eGQvMMWAj7fSVK1PqrS9JukDLLbG+KJvXLTV14GfOS6r4aIasWErHPfpPHsBOYZ1s6jJlxFDdx7tJ4GgEhkJCMEJhEMT2MKxKzQdGxo0G9iwIVAODmx7JjZo0gBYr/8en+fR9f0phpAoGBAKzpjrrNlrz8/4pawEMEMnxKHMqqJGAak2Fyu4F8VW41ZULGGaLWulqPK5OVkve/+ZHrsxG3Uieyp7BOlhyVpuIt3XmCZ2WGdAv2NPAdw7RDcyQJE1KmgN0hrXHFs5oa5jxlVEOkq12JFJqNov8StlkxoPML/96kQczSm22hN4V+A4GEAAKBgHqtp0BncScT9M9/uzpCApR33m+SfQOWomYVqd177fz17O6vnFmtRM0V6sRMs0Fi+cVaa8zEcASbuJ3sGRZo2qNjXMeAg6Vm368XNKwtV3O39hvtOdO/b/HaU53oG4CEWi9koNRked4grQRxjFjabGJaMaXYO91KsaMnWoe3ijldMAkGByqGSM44BAMDLwAwLAIUK+PpNxfdEvV9ePeTt5zfDPS8NAoCFDC6gUfseNz6IYkJ0k1lurDSx9UN</dsig:X509Certificate>
<dsig:X509SubjectName>CN=dsa,OU=Four J's Development
Tools,O=4JS,L=Schiltigheim,ST=France,C=FR</dsig:X509SubjectName>
<dsig:X509IssuerSerial>
<dsig:X509IssuerName>CN=dsaroot,OU=Four J's Development
Tools,O=4JS,L=Schiltigheim,ST=France,C=FR</dsig:X509IssuerName>
<dsig:X509SerialNumber>1</dsig:X509SerialNumber>
</dsig:X509IssuerSerial>
</dsig:X509Data>
Then when I read it back with 'xmlSecKeyDataXmlRead', and if flag
XMLSEC_KEYINFO_FLAGS_X509DATA_STOP_ON_UNKNOWN_CERT is set, I must set
the certificate in the key store to allow the system to find the real
certificate corresponding to X509SubjectName, and to X509IssuerSerial.
And that's OK for me too.
But the strange thing is that when the function returns, I have 3
certificates in the xmlSecKeyData part of the xmlSecKeyPtr. I was
expecting only one certificate, because all entries of the X509Data
represent the same certificate. I investigated a bit, and found out that
the 'xmlSecOpenSSLX509DataNodeRead' function looks for the certificate
in the key store in case of X509SubjectName and X509IssuerSerial. But
shouldn't it first check in the data part of the xmlSecKeyPtr it is
currently reading, if there is already a certificate that could match ?
Actually, the problem is that I write one certificate, but when I read
it back, I have 3 times the same certificate.
Regards,
Frank
_______________________________________________
xmlsec mailing list
xmlsec@aleksey.com
http://www.aleksey.com/mailman/listinfo/xmlsec
