0

When you sign a SOAP message with a private key, how does the server know your public key in order to verify it?

I am connecting to a Datapower instance that sits in front of our actual Java web service. I keep getting signature not valid errors from the server, so it leads me to believe it has something to do with keys not being in sync.

1

When you sign a SOAP message with a private key, how does the server know your public key in order to verify it?

It has the public key. That’s the idea with the pair of keys. You keep the private one (that shows it’s really you) and the public key you give to everyone that needs it (in this case someone must install it on the server).

I keep getting signature not valid errors from the server, so it leads me to believe it has something to do with keys not being in sync.

Not necessarily. SOAP means XML and XML is tricky when it comes to digital signatures. Since the same XML document can have different physical structures, you need a canonical form first. Is signing and checking the signature done with a framework or manually? If you do it manually you need to have a canonical form for the messages first, otherwise even a single CR vs CRLF difference in line termination can give you a different hash.

1

If you are talking about WS-Security signatures, I believe that the certificate is passed along with your message. The signature will be verified against that assuming it trusts your cert.

WS-Security is a major pain. If you are getting signature invalid, my guess is that there is something wrong with they way it was signed. When I was last involved in this, we had issues with whitespace in the XML. What I recall was that the digest was generated from the indented message but what we actually sent was formatted differently and therefore could not be verified. Whitespace is significant in XML-signatures. My advice to you is to remove any non-content whitespace (tabs, spaces, newlines, etc.) from the XML prior to doing anything else.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.