swedenconnect / signature-validation Goto Github PK

Currently the results reports "invalidSigningCert" if there is no XAdES reference available.

This should only be set IF this is an ETSI AdES signature AND the references is missing or in error.

Fix should be applied to "XMLSignatureElementValidatorImpl" row 216 and 458

There is a dependency on xalan via sign service pdf commons. This is being updated but not released.

Once this is fixed, we must update the dependency here

Several limited implementations of certificate and signature validation would benefit from a CRL checker with a CRL cache that does not require cache storage on the hard disk.

A recent implementation of an In memory CRL cache was made in another project. That implementation should be imported to this library.

The OCSP validation checker does not accurately handle the situation where the OCSP response is signed by the CA certificate and where the OCSP response totally omits inclusion of any "certs" in the BasicOCSPResponse".

Original RFC 2560 OCSP specified that OCSP nonce should be stored as the extValue bytes and most OCSP clients today, including this one create OCSP requests this way.

However, clarifications in RFC 6960 makes it clear that the OCSP nonce should be encoded in an OCTETSTRING before being DER encoded as extension data.

The code should be updated to always wrap nonce data in a DER encoded OCTETSTRING. This wrapping should use a 30 byte nonce causing the wrapped nonce to be 32 bytes, making sure that it works against RFC 8954 compliant responders.

The signature validation report indicates "TOTAL-FAILED" result if no chain is found.
This should be changed to "INDETERMINATE" and an indication that the validity of the signature could not be determined.