[xmlsec] RES: Trying to check sign
Renato Tegon Forti
re.tf at acm.org
Wed Jun 6 04:42:34 PDT 2012
>> This means that xmlsec (or to be precise, openssl) needs to verify the
certificate and it can't find the next certificate in the chain.
Thanks for answer.
One more question: what is the example
(http://www.aleksey.com/xmlsec/api/xmlsec-examples.html) that implement
"Online XML Digital Signature Verifer"?
I want study code implementation of it!
Thanks
-----Mensagem original-----
De: Aleksey Sanin [mailto:aleksey at aleksey.com]
Enviada em: terça-feira, 5 de junho de 2012 23:51
Para: Renato Tegon Forti
Cc: xmlsec at aleksey.com
Assunto: Re: [xmlsec] Trying to check sign
This means that xmlsec (or to be precise, openssl) needs to verify the
certificate and it can't find the next certificate in the chain.
Aleksey
On 6/5/12 1:58 PM, Renato Tegon Forti wrote:
> Hi,
>
>
>
> I have one file that I want check sig (using KEYINFO node), I know
> that the signature is valid, but tool returns me:
>
>
>
> I use DTD, see xml below, please!
>
>
>
> ----------------------------------------------------------------------
> --------------------------
>
>
>
> func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=360:obj=x509-sto
> re:subj=X509_verify_cert:error=4:crypto
> library function failed:subj=/C=BR/O=ICP-Brasil/OU=ID -
> 1083312/OU=Autenticado por Certisign Certificadora
> Digital/OU=Assinatura Tipo A1/OU=(EM BRANCO)/OU=(EM
> BRANCO)/CN=MEDIATECH INFORMATICA
> LTDA/emailAddress=contato at tecnomidia.com.br;err=20;msg=unable
> <mailto:LTDA/emailAddress=contato at tecnomidia.com.br;err=20;msg=unable>
> to get local issuer certificate
>
> func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=408:obj=x509-sto
> re:subj=unknown:error=71:certificate
> verification failed:err=20;msg=unable to get local issuer certificate
>
> func=xmlSecOpenSSLEvpSignatureVerify:file=signatures.c:line=346:obj=rs
> a-sha1:subj=EVP_VerifyFinal:error=18:data
> do not match:signature do not match
>
> RESULT: Signature is INVALID
>
> ---------------------------------------------------
>
> = VERIFICATION CONTEXT
>
> == Status: invalid
>
> == flags: 0x00000000
>
> == flags2: 0x00000000
>
> == Key Info Read Ctx:
>
> = KEY INFO READ CONTEXT
>
> == flags: 0x00000000
>
> == flags2: 0x00000000
>
> == enabled key data: all
>
> == RetrievalMethod level (cur/max): 0/1
>
> == TRANSFORMS CTX (status=0)
>
> == flags: 0x00000000
>
> == flags2: 0x00000000
>
> == enabled transforms: all
>
> === uri: NULL
>
> === uri xpointer expr: NULL
>
> == EncryptedKey level (cur/max): 0/1
>
> === KeyReq:
>
> ==== keyId: rsa
>
> ==== keyType: 0x00000001
>
> ==== keyUsage: 0x00000002
>
> ==== keyBitsSize: 0
>
> === list size: 0
>
> == Key Info Write Ctx:
>
> = KEY INFO WRITE CONTEXT
>
> == flags: 0x00000000
>
> == flags2: 0x00000000
>
> == enabled key data: all
>
> == RetrievalMethod level (cur/max): 0/1
>
> == TRANSFORMS CTX (status=0)
>
> == flags: 0x00000000
>
> == flags2: 0x00000000
>
> == enabled transforms: all
>
> === uri: NULL
>
> === uri xpointer expr: NULL
>
> == EncryptedKey level (cur/max): 0/1
>
> === KeyReq:
>
> ==== keyId: NULL
>
> ==== keyType: 0x00000001
>
> ==== keyUsage: 0xffffffff
>
> ==== keyBitsSize: 0
>
> === list size: 0
>
> == Signature Transform Ctx:
>
> == TRANSFORMS CTX (status=2)
>
> == flags: 0x00000000
>
> == flags2: 0x00000000
>
> == enabled transforms: all
>
> === uri: NULL
>
> === uri xpointer expr: NULL
>
> === Transform: c14n
> (href=http://www.w3.org/TR/2001/REC-xml-c14n-20010315)
>
> === Transform: rsa-sha1
> (href=http://www.w3.org/2000/09/xmldsig#rsa-sha1)
>
> === Transform: membuf-transform (href=NULL)
>
> == Signature Method:
>
> === Transform: rsa-sha1
> (href=http://www.w3.org/2000/09/xmldsig#rsa-sha1)
>
> == Signature Key:
>
> == KEY
>
> === method: RSAKeyValue
>
> === key type: Private
>
> === key name: test-rsa
>
> === key usage: -1
>
> === rsa key: size = 1024
>
> == SignedInfo References List:
>
> === list size: 1
>
> = REFERENCE VERIFICATION CONTEXT
>
> == Status: succeeded
>
> == URI: "#NFe35101003593968000167550030000101640000000003"
>
> == Reference Transform Ctx:
>
> == TRANSFORMS CTX (status=2)
>
> == flags: 0x00000000
>
> == flags2: 0x00000000
>
> == enabled transforms: all
>
> === uri:
>
> === uri xpointer expr:
> #NFe35101003593968000167550030000101640000000003
>
> === Transform: xpointer
> (href=http://www.w3.org/2001/04/xmldsig-more/xptr)
>
> === Transform: enveloped-signature
> (href=http://www.w3.org/2000/09/xmldsig#enveloped-signature)
>
> === Transform: c14n
> (href=http://www.w3.org/TR/2001/REC-xml-c14n-20010315)
>
> === Transform: sha1 (href=http://www.w3.org/2000/09/xmldsig#sha1)
>
> === Transform: membuf-transform (href=NULL)
>
> == Digest Method:
>
> === Transform: sha1 (href=http://www.w3.org/2000/09/xmldsig#sha1)
>
> == Manifest References List:
>
> === list size: 0
>
>
>
> ----------------------------------------------------------------------
> --------------------------
>
>
>
> Anyone can help-me to understand what I make wrong!
>
> What this exactly can mean: “unable to get local issuer certificate”
>
>
>
> This is my xml file ( the DTD is correct?):
>
>
>
> ----------------------------------------------------------------------
> --------------------------
>
>
>
> <?xml version="1.0" encoding="UTF-8"?>
>
> <!DOCTYPE test [
>
> <!ATTLIST infNFe Id ID #IMPLIED>
>
> ]>
>
> <nfeProc xmlns="http://www.portalfiscal.inf.br/nfe" versao="1.10">
>
> <NFe xmlns="http://www.portalfiscal.inf.br/nfe"><infNFe
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> Id="NFe35101003593968000167550030000101640000000003"
> versao="1.10"><ide><cUF>35</cUF><cNF>000000000</cNF><natOp>VENDA MERC
> C/ PGTO ST C/
> SUBSTITUIDO</natOp><indPag>1</indPag><mod>55</mod><serie>3</serie><nNF
> >10164</nNF><dEmi>2010-10-20</dEmi><dSaiEnt>2010-10-20</dSaiEnt><tpNF>
> 1</tpNF><cMunFG>3550308</cMunFG><tpImp>1</tpImp><tpEmis>1</tpEmis><cDV
> >3</cDV><tpAmb>1</tpAmb><finNFe>1</finNFe><procEmi>0</procEmi><verProc
> >1.4.0</verProc></ide><emit><CNPJ>03593968000167</CNPJ><xNome>Mediatec
> h Informatica LTDA</xNome><xFant>Mediatech Informatica
> LTDA</xFant><enderEmit><xLgr>CORREIA DE
> MELO</xLgr><nro>085</nro><xBairro>BOM
> RETIRO</xBairro><cMun>3550308</cMun><xMun>SAO
> PAULO</xMun><UF>SP</UF><CEP>01123020</CEP><cPais>1058</cPais><xPais>BR
> ASIL</xPais><fone>1133521199</fone></enderEmit><IE>115633812110</IE></
> emit><dest><CNPJ>11253910000100</CNPJ><xNome>AYSSO
> SYSTEMS LTDA EPP</xNome><enderDest><xLgr>RUA DOZE DE
> NOVEMBRO</xLgr><nro>180</nro><xCpl>APT
> 183</xCpl><xBairro>CENTRO</xBairro><cMun>3501608</cMun><xMun>AMERICANA
> </xMun><UF>SP</UF><CEP>13465490</CEP><cPais>1058</cPais><xPais>BRASIL<
> /xPais><fone>1936459994</fone></enderDest><IE/></dest><det
> nItem="1"><prod><cProd>1160900000000001720000</cProd><cEAN/><xProd>MID
> IA
> DIGITAL
> CD/DVD</xProd><NCM>85234011</NCM><CFOP>5405</CFOP><uCom>PC.</uCom><qCo
> m>100.0000</qCom><vUnCom>2.1500</vUnCom><vProd>215.00</vProd><cEANTrib
> /><uTrib>PC.</uTrib><qTrib>100.0000</qTrib><vUnTrib>2.1500</vUnTrib><v
> Frete>20.00</vFrete></prod><imposto><ICMS><ICMS60><orig>0</orig><CST>6
> 0</CST><vBCST>215.00</vBCST><vICMSST>0.00</vICMSST></ICMS60></ICMS><IP
> I><cEnq>999</cEnq><IPINT><CST>53</CST></IPINT></IPI><PIS><PISAliq><CST
> >01</CST><vBC>215.00</vBC><pPIS>0.65</pPIS><vPIS>1.40</vPIS></PISAliq>
> </PIS><COFINS><COFINSAliq><CST>01</CST><vBC>215.00</vBC><pCOFINS>3.00<
> /pCOFINS><vCOFINS>6.45</vCOFINS></COFINSAliq></COFINS></imposto></det>
> <total><ICMSTot><vBC>20.00</vBC><vICMS>0.00</vICMS><vBCST>0.00</vBCST>
> <vST>0.00</vST><vProd>215.00</vProd><vFrete>20.00</vFrete><vSeg>0.00</
> vSeg><vDesc>0.00</vDesc><vII>0.00</vII><vIPI>0.00</vIPI><vPIS>1.40</vP
> IS><vCOFINS>6.45</vCOFINS><vOutro>0.00</vOutro><vNF>235.00</vNF></ICMS
> Tot></total><transp><modFrete>0</modFrete><transporta><CNPJ>0728188600
> 0138</CNPJ><xNom
e
>Correio
> - Sedex</xNome><IE>ISENTO</IE><xEnder>Rua Correia de Melo,
>111</xEnder><xMun>Sao
>
Paulo</xMun><UF>SP</UF></transporta><vol><qVol>1</qVol><esp>CX.</esp><pesoL>
1.000</pesoL><pesoB>1.000</pesoB></vol></transp><cobr><fat><nFat>10164</nFat
><vOrig>235.00</vOrig><vLiq>235.00</vLiq></fat><dup><nDup>001</nDup><dVenc>2
010-10-20</dVenc><vDup>235.00</vDup></dup></cobr><infAdic><infCpl>Pedidos:
> 48033</infCpl></infAdic></infNFe><Signature
>
>xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><Canonicalizatio
>nMethod
>Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/><Signature
>Method
>Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference
>
>URI="#NFe35101003593968000167550030000101640000000003"><Transforms><Tra
>nsform
>Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><Tra
>nsform
>Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/></Transfor
>ms><DigestMethod
>Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>vj4p6F
>tqkZen6fsHlcyag8R2hF0=</DigestValue></Reference></SignedInfo><Signature
>Value>Jymbikn/5F8aUYQA6CaZmLYY9plO4KNfyu/M4TZP5l+3fy/pjwpkIsaeV1LXXyo7n
>WLdpvruhCXy
>
> ID2ptAjzIWOJ/vp1YW94e0Yy7yfBijQNkew+FI1G7GKKt7T/UUIPRrXqWwo7EA8ZpCYSoW
> ktWqHZ
>
> iU7j7iJone1nLdNJNjY=</SignatureValue><KeyInfo><X509Data><X509Certifica
> te>MIIGuzCCBaOgAwIBAgIQCbCeZ64fHJPeNqAkc06I8TANBgkqhkiG9w0BAQUFADB0MQs
> wCQYDVQQG
>
> EwJCUjETMBEGA1UEChMKSUNQLUJyYXNpbDEtMCsGA1UECxMkQ2VydGlzaWduIENlcnRpZm
> ljYWRv
>
> cmEgRGlnaXRhbCBTLkEuMSEwHwYDVQQDExhBQyBDZXJ0aXNpZ24gTXVsdGlwbGEgRzMwHh
> cNMTAw
>
> NzI5MDAwMDAwWhcNMTEwNzI4MjM1OTU5WjCCAQsxCzAJBgNVBAYTAkJSMRMwEQYDVQQKFA
> pJQ1At
>
> QnJhc2lsMRUwEwYDVQQLFAxJRCAtIDEwODMzMTIxODA2BgNVBAsUL0F1dGVudGljYWRvIH
> BvciBD
>
> ZXJ0aXNpZ24gQ2VydGlmaWNhZG9yYSBEaWdpdGFsMRswGQYDVQQLFBJBc3NpbmF0dXJhIF
> RpcG8g
>
> QTExFDASBgNVBAsUCyhFTSBCUkFOQ08pMRQwEgYDVQQLFAsoRU0gQlJBTkNPKTEjMCEGA1
> UEAxMa
>
> TUVESUFURUNIIElORk9STUFUSUNBIExUREExKDAmBgkqhkiG9w0BCQEWGWNvbnRhdG9AdG
> Vjbm9t
>
> aWRpYS5jb20uYnIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM8txkPNL6gjEjSW4T
> umyO0w
>
> zBGmxNtCqU9DFNWQD1TWIbXaYduxoxnYEwNXrehla2YDslXUiM45SWvlmjlWoVV9T7F07a
> OGGysP
>
> aNLJW/y3CMq7Qrvsh+h30INqV8WWYXKHlmfLz4eNf8Di4xQvgm+7yxvkGHXXjxkWn6utBW
> tJAgMB
>
> AAGjggMyMIIDLjCBrQYDVR0RBIGlMIGioDgGBWBMAQMEoC8ELTE5MDExOTY3MTEyMDk3Mz
> g4MDUw
>
> MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMKAXBgVgTAEDAqAOBAxKQUlSIFNaQVBJUk+gGQ
> MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMKAXBgVgTAEDAqAOBAxKQUlSIFNaQVBJUk+YFY
> MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMKAXBgVgTAEDAqAOBAxKQUlSIFNaQVBJUk+EwB
>
> AwOgEAQOMDM1OTM5NjgwMDAxNjegFwYFYEwBAwegDgQMMDAwMDAwMDAwMDAwgRljb250YX
> RvQHRl
>
>
Y25vbWlkaWEuY29tLmJyMAkGA1UdEwQCMAAwHwYDVR0jBBgwFoAUhLBCMzSjQiWlKJc+g+t38OhP
>
> wlQwDgYDVR0PAQH/BAQDAgXgMFUGA1UdIAROMEwwSgYGYEwBAgELMEAwPgYIKwYBBQUHAg
> EWMmh0
>
> dHA6Ly9pY3AtYnJhc2lsLmNlcnRpc2lnbi5jb20uYnIvcmVwb3NpdG9yaW8vZHBjMIIBJQ
> YDVR0f
>
> BIIBHDCCARgwXKBaoFiGVmh0dHA6Ly9pY3AtYnJhc2lsLmNlcnRpc2lnbi5jb20uYnIvcm
> Vwb3Np
>
> dG9yaW8vbGNyL0FDQ2VydGlzaWduTXVsdGlwbGFHMy9MYXRlc3RDUkwuY3JsMFugWaBXhl
> VodHRw
>
> Oi8vaWNwLWJyYXNpbC5vdXRyYWxjci5jb20uYnIvcmVwb3NpdG9yaW8vbGNyL0FDQ2VydG
> lzaWdu
>
> TXVsdGlwbGFHMy9MYXRlc3RDUkwuY3JsMFugWaBXhlVodHRwOi8vcmVwb3NpdG9yaW8uaW
> NwYnJh
>
> c2lsLmdvdi5ici9sY3IvQ2VydGlzaWduL0FDQ2VydGlzaWduTXVsdGlwbGFHMy9MYXRlc3
> RDUkwu
>
> Y3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjCBoAYIKwYBBQUHAQEEgZMwgZ
> AwKAYI
>
> KwYBBQUHMAGGHGh0dHA6Ly9vY3NwLmNlcnRpc2lnbi5jb20uYnIwZAYIKwYBBQUHMAKGWG
> h0dHA6
>
> Ly9pY3AtYnJhc2lsLmNlcnRpc2lnbi5jb20uYnIvcmVwb3NpdG9yaW8vY2VydGlmaWNhZG
> 9zL0FD
>
> X0NlcnRpc2lnbl9NdWx0aXBsYV9HMy5wN2MwDQYJKoZIhvcNAQEFBQADggEBAGI9MCc6WV
> mz919C
>
> QLDB8E0R8HxfGyiz2uB14lPBDsueTJmJmlykQdnboMiyMGTocprEGsQxeI7a57BEUDVc0f
> SzNCCb
>
> SOnQOp9Uswri8pTw8fQG9OAkh1LCC9haTsNNMKbTHCciO7MUh34XkHuj4A0NIWG1aCynws
> tRFWb8
>
> 97OZJJCc0IRvDs7yDJhgOwPmv3trFmwlfMU7n20pXtM9hKiI8o6h/0GwR6SyA1Yj4fZXfX
> xVENH4
>
> EjhIHR8Yrmre2JE2I+hFjyQaNPnAEztQEa0Cae2l3O0Q0tkM1x8EkiKFrnDggpc7gSwtLC
> EjhIHR8Yrmre2JE2I+wrkQBu
>
> jhie131VyDTuXLx9k082PLs=</X509Certificate></X509Data></KeyInfo></Signa
> ture></NFe>
>
>
>
> <protNFe
> versao="1.10"><infProt><tpAmb>1</tpAmb><verAplic>SP_NFE_PL_005e</verAp
> lic><chNFe>35101003593968000167550030000101640000000003</chNFe><dhRecb
> to>2010-10-20T17:48:15</dhRecbto><nProt>135100546996360</nProt><digVal
> >vj4p6FtqkZen6fsHlcyag8R2hF0=</digVal><cStat>100</cStat><xMotivo>Autor
> izado o uso da NF-e</xMotivo></infProt></protNFe>
>
> </nfeProc>
>
>
>
> ----------------------------------------------------------------------
> --------------------------
>
>
>
> Thanks a lot
>
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
> xmlsec mailing list
> xmlsec at aleksey.com
> http://www.aleksey.com/mailman/listinfo/xmlsec
More information about the xmlsec
mailing list