<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/7/15 6:50 PM, Willem D'Haeseleer
wrote:<br>
</div>
<blockquote
cite="mid:CAFfzYXdwm0jweVQ7nA50uH6QK7Ks2DsBJoU+Kv0iTT2W4z_F0Q@mail.gmail.com"
type="cite">
<div dir="ltr">Additionally. Should the X509Certificate contain
any newlines, or should it be a string ? <br>
</div>
</blockquote>
<br>
I don't think it matters, but newlines are certainly easier to look
at :-)<br>
<br>
However, in testing your cert with openssl, I did discover the
problem. The cert marked for encryption contains a DSA key. That's
not supported for encryption, it's simply just not defined. It
pretty much has to be an RSA key, for v2. (For v3 we hope at some
point to support EC keys for encryption per XML Encryption 1.1, via
EC Diffie-Hellman).<br>
<br>
So you just need to get/generate a cert with an RSA key for
encryption and put that in the metadata instead.<br>
<br>
Your metadata encryption cert decoded by openssl:<br>
<br>
<tt>Certificate:</tt><tt><br>
</tt><tt> Data:</tt><tt><br>
</tt><tt> Version: 3 (0x2)</tt><tt><br>
</tt><tt> Serial Number:</tt><tt><br>
</tt><tt> d2:0b:e8:4e:cb:e0:28:bc</tt><tt><br>
</tt><tt> Signature Algorithm: dsa_with_SHA256</tt><tt><br>
</tt><tt> Issuer: C=CA, ST=British Columbia, L=Vancouver,
O=OrigamiTest, OU=Dev,
<a class="moz-txt-link-abbreviated" href="mailto:CN=local.origami42.com/emailAddress=willem@origamilogic.com">CN=local.origami42.com/emailAddress=willem@origamilogic.com</a></tt><tt><br>
</tt><tt> Validity</tt><tt><br>
</tt><tt> Not Before: Oct 7 21:46:39 2015 GMT</tt><tt><br>
</tt><tt> Not After : Nov 6 21:46:39 2015 GMT</tt><tt><br>
</tt><tt> Subject: C=CA, ST=British Columbia, L=Vancouver,
O=OrigamiTest, OU=Dev,
<a class="moz-txt-link-abbreviated" href="mailto:CN=local.origami42.com/emailAddress=willem@origamilogic.com">CN=local.origami42.com/emailAddress=willem@origamilogic.com</a></tt><tt><br>
</tt><tt> Subject Public Key Info:</tt><tt><br>
</tt><tt> Public Key Algorithm: dsaEncryption</tt><tt><br>
</tt><tt> DSA Public Key:</tt><tt><br>
</tt><tt> pub: </tt><tt><br>
</tt><tt>
70:86:c3:83:54:54:49:14:ca:d8:17:2a:e6:12:0e:</tt><tt><br>
</tt><tt>
12:f3:7e:3e:82:f1:9b:57:cc:d7:56:f3:40:ed:9e:</tt><tt><br>
</tt><tt>
2e:89:2e:a7:34:1e:21:25:30:94:dd:66:31:03:e5:</tt><tt><br>
</tt><tt>
0d:06:5e:5d:da:a9:18:67:bc:75:68:a1:d9:ba:61:</tt><tt><br>
</tt><tt>
c5:41:d2:02:00:93:aa:96:9d:22:00:73:65:53:a1:</tt><tt><br>
</tt><tt>
46:8f:85:02:63:a2:aa:66:4f:ab:84:bc:fc:<a class="moz-txt-link-freetext" href="fb:ec">fb:ec</a>:</tt><tt><br>
</tt><tt>
b9:d1:94:b6:8f:81:a5:33:d0:79:d0:6d:44:7b:bd:</tt><tt><br>
</tt><tt>
92:e9:73:da:78:18:be:71:c1:63:48:d1:de:e7:88:</tt><tt><br>
</tt><tt> 7a:e5:78:d6:de:ba:5e:31</tt><tt><br>
</tt><tt> P: </tt><tt><br>
</tt><tt>
00:9d:84:ce:03:2c:9e:ce:f4:92:46:df:ac:33:70:</tt><tt><br>
</tt><tt>
fe:48:28:11:e1:ae:2b:50:89:69:c8:8a:89:3d:83:</tt><tt><br>
</tt><tt>
33:4f:46:cc:40:65:f2:f6:6f:fd:85:24:5b:c1:0a:</tt><tt><br>
</tt><tt>
f1:e8:f7:0a:86:2a:92:9c:fa:17:46:a3:2e:20:a9:</tt><tt><br>
</tt><tt>
74:eb:59:77:c0:ff:b7:15:6a:dd:d9:87:1d:14:8d:</tt><tt><br>
</tt><tt>
ba:82:76:2c:c5:80:0d:75:40:84:1e:97:f0:4b:f8:</tt><tt><br>
</tt><tt>
af:65:c7:f2:62:9b:5b:ec:85:85:b1:e5:37:57:b1:</tt><tt><br>
</tt><tt>
8b:73:ea:9f:0f:72:e2:0e:a4:78:fa:33:ee:ba:0a:</tt><tt><br>
</tt><tt> 64:3a:44:d9:bd:8d:df:58:57</tt><tt><br>
</tt><tt> Q: </tt><tt><br>
</tt><tt>
00:bd:07:<a class="moz-txt-link-freetext" href="fb:eb:18:77:21:24:c4:10:cf:db:5b:d4">fb:eb:18:77:21:24:c4:10:cf:db:5b:d4</a>:</tt><tt><br>
</tt><tt> 77:a6:<a class="moz-txt-link-freetext" href="fb:6a:a6:53">fb:6a:a6:53</a></tt><tt><br>
</tt><tt> G: </tt><tt><br>
</tt><tt>
26:6b:1d:02:db:af:4f:04:1a:90:c0:66:fd:b0:e0:</tt><tt><br>
</tt><tt>
10:18:53:43:6d:fe:cf:a7:2b:03:7d:94:ff:60:43:</tt><tt><br>
</tt><tt>
5f:bb:d6:ee:29:b7:1e:ae:13:95:cb:43:d7:20:16:</tt><tt><br>
</tt><tt>
25:ca:20:4f:3a:67:7d:13:e8:2d:72:f1:ec:f8:d9:</tt><tt><br>
</tt><tt>
b5:05:b0:51:ff:11:47:a8:83:58:24:0f:d5:e5:a5:</tt><tt><br>
</tt><tt>
e8:5e:c0:93:de:25:d4:95:06:31:a9:59:31:5c:66:</tt><tt><br>
</tt><tt>
64:47:f6:ea:54:c0:66:04:c0:78:52:76:96:32:04:</tt><tt><br>
</tt><tt>
ea:79:a6:9d:bf:45:f5:e0:74:cc:1a:f6:8b:d4:6a:</tt><tt><br>
</tt><tt> 93:41:ef:03:b5:11:2d:15</tt><tt><br>
</tt><tt> X509v3 extensions:</tt><tt><br>
</tt><tt> X509v3 Subject Key Identifier: </tt><tt><br>
</tt><tt>
63:68:86:BA:C5:AF:92:01:35:1E:94:5D:68:C2:DA:95:42:BE:28:E9</tt><tt><br>
</tt><tt> X509v3 Authority Key Identifier: </tt><tt><br>
</tt><tt>
keyid:63:68:86:BA:C5:AF:92:01:35:1E:94:5D:68:C2:DA:95:42:BE:28:E9</tt><tt><br>
</tt><tt><br>
</tt><tt> X509v3 Basic Constraints: </tt><tt><br>
</tt><tt> CA:TRUE</tt><tt><br>
</tt><tt> Signature Algorithm: dsa_with_SHA256</tt><tt><br>
</tt><tt>
30:2d:02:14:3a:41:29:87:a2:bd:77:fe:3d:6a:6c:2c:0f:fe:</tt><tt><br>
</tt><tt>
1b:5d:78:80:1d:ce:02:15:00:88:80:66:5a:f8:c6:48:69:67:</tt><tt><br>
</tt><tt> 07:28:4e:88:cc:ff:5a:30:c4:13:4b</tt><tt><br>
</tt><tt><br>
</tt><tt><br>
</tt><tt><br>
</tt><br>
</body>
</html>