Support omitting SigningCertificate property

[luisgoncalves]

Add new configuration option to skip adding the SigningCertificate property if the signing certificate (or its issuer/serial) is included in KeyInfo and KeyInfo is signed.

This is a bit against the recommendations (namely the baseline profile), but it may help in some cases.

Not including SigningCertificate is allowed by the spec if "incorporating the signing certificate within the ds:KeyInfo element and signing at least the signing certificate.".

More details:

• Question: How to Sign with Three References #288
• https://stackoverflow.com/questions/78803576/remove-signing-certificate-from-qualifying-properties-xades4j

[luisgoncalves]

@hanadderia a new release will be out soon. There's a new omitSigningCertificateProperty option in BasicSignatureOptions. It can only be enabled if the signing certificate (or its issuer/serial) is included in KeyInfo and KeyInfo is signed.

[hanadderia]

Hello @luisgoncalves,

Thank you for the swift update and for adding the omitSigningCertificateProperty option to the BasicSignatureOptions. We appreciate your effort in accommodating our request. The ability to enable this option when the signing certificate is included in KeyInfo and KeyInfo is signed will be incredibly helpful for our project.

Looking forward to the new release!

Best regards,

[luisgoncalves]

You're welcome. Let me know in case something is still off.

The new release should be up by now.

Best regards.

[hanadderia]

Thanks @luisgoncalves, It's working as expected.

<ds:Object>
    <xades:QualifyingProperties xmlns:xades="http://uri.etsi.org/01903/v1.3.2#" Target="#">
        <xades:SignedProperties xmlns:ns6="http://uri.etsi.org/01903/v1.4.1#" Id="_4cd24fac-f005-472b-be86-dd85b40c91bb-signedprops">
            <xades:SignedSignatureProperties>
                <xades:SigningTime>2024-08-09T00:00:00Z</xades:SigningTime>
            </xades:SignedSignatureProperties>
        </xades:SignedProperties>
    </xades:QualifyingProperties>
</ds:Object>

But, when enabled this property omitSigningCertificateProperty the verifier fails with the following error:
Signature doesn't follow any of the XAdES forms

[luisgoncalves]

@hanadderia I missed the last part of your previous message.

Right, I didn't add support for the verifier to process signatures without SigningCertificate. Perhaps I could do that.

Do you also mean that the target system rejects it?

[hanadderia]

Hello @luisgoncalves, No, the target system is accepting the signature, but the local verifier is not working.

Thanks that will help a lot.

[luisgoncalves]

Created #302 as a follow-up. It may be tricky to implement, so not sure if I'll end-up doing it.

[luisgoncalves]

@hanadderia I've implemented the follow-up ticket, to be able to validate signatures without SigningCertificate property but including the signing certificate in a KeyInfo element which is itself covered by the signature.