I've tried this on the command line already. If I add all of the certificates as untrusted (--untrusted pem), and obviously still use the trusted root (--trusted-pem), then xmlsec verifies the signature perfectly with no spurious errors.<br>
<br>Thank you for taking an interest though.<br><br><div class="gmail_quote">On Thu, Feb 21, 2008 at 8:18 PM, Roumen Petrov <<a href="mailto:xmlsec@roumenpetrov.info">xmlsec@roumenpetrov.info</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">Paul Keeler wrote:<br>
> Still no success I'm afraid. I'm starting to think that the only option I'm<br>
> left with is to (within my application) manually parse the signed document<br>
> and add all of the certificates to the untrusted store.<br>
><br>
</div>> [SNIP]<br>
The valid path must begin with certificates issued by a trust anchor.<br>
So if whole certificate chain is in untrusted store certificate cannot<br>
be validated.<br>
<font color="#888888"><br>
<br>
Roumen<br>
<br>
</font></blockquote></div><br>