1

I'd like to use XMLDSIG for verifying that a .config file has not been tampered with. I also want to be able to verify the signature chain so that I can trust the signature.

I've got three certificates in the chain:

Root CA -> Intermediate Signing CA -> Signing Key

I check that the file is signed with a key that is issued by the intermediate CA.

I'd like to do this without installing any certificates in the user's Windows certificate store. These are self-signed certificates, so not every user is going to want me installing them in their Root store. I don't have a problem with installing them in my root store.

I have the original .CER files -- they're included in the Signature block, and I can include them with the verification code. I can build a certificate chain from this by using X509ChainPolicy.ExtraStore.

If the certificates are not installed in the root store, and I verify the chain, then X509Chain.Build returns false, and the chain has a X509ChainStatusFlags.UntrustedRoot in it.

Can I add trusted certificates just for the duration of this operation?

Community
  • 1
  • 1
Roger Lipscombe
  • 89,048
  • 55
  • 235
  • 380
  • Stupid question, but you have a physical copy of all signing certs in the trust chain, right? They're just not installed, correct? – x0n Apr 10 '12 at 15:15
  • Yeah. I copied them into the signature block, but I can also easily include them with the verification code. I just don't want to install a root CA on every user's machine. – Roger Lipscombe Apr 10 '12 at 15:27

1 Answers1

0

Assuming you have physical copies of the public keys of ALL signing certs in the trust chain, then this is possible by using the OpenSSL command line tool.

http://www.madboa.com/geek/openssl/#verify-standard

It's a bit of a steep learning curve at first, but a very powerful utility.

If you don't have the signing certs, then you cannot verify anything. That would be the same as trying to verify a human signature without having seen the original. You have nothing to compare to, so how could you verify the authenticity?

Update

There's something here perhaps that could help you:

http://social.msdn.microsoft.com/Forums/eu/clr/thread/1966a6e8-b6f4-44d1-9102-ec3a26426789

x0n
  • 51,312
  • 7
  • 89
  • 111