help signing metadata

[Cantor, Scott]

On 10/25/11 10:52 AM, "Jonathan Bricker" <jbricker at exacttarget.com> wrote:

>I want to check that the certificates are good ( i.e. not expired or
>revoked) and from a list of acceptable CA certs.  I'm trying to find out
>how to do that.  Checking signatures seems way to do it rather than
>checking certs at runtime.

That still says nothing about nested signatures or anything like that,
which was the basis of your original error. Without nested signatures
there should be *one* CA cert since there's one signature involved.

It would be very unusual, and most likely an error, to allow for a bunch
of CAs in the verification of a given metadata signer, because there is
right now no signer name involved. You would be essentially saying "any
certificate issued by these CAs can sign the metadata". That would be, to
use a technical term, very bad in the case of most CAs.

I think what you really mean is that you want to collect up metadata
signed by a bunch of different certificates and somehow verify all of it
at once. There's no way I can think of to do that because of the super
signature needed. You can impose a filter that verifies the super
signature OR you can impose a filter that identifies all the CAs and
requires that the signing certificates all contain the entityID being
signed to maintain the necessary security, but you can't do both at the
moment.

We just don't cater to models where entities are signing their own
metadata, because it's circular. And we assume that if you're going to do
that, you'd rather pull the metadata directly from the endpoints so that
it's fresh. In that scenario, you would use the Dynamic provider. In that
case, you don't have the super signature problem since the metadata isn't
aggregated.

I'm basically still just guessing at your intent here.

-- Scott