Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is my scenario:

A CA signs a certificate with its private key and sends it to a client via https response. From this response the client creates a X509Certificate2 class, that represents the certificate in .NET

X509Certificate2 myCert = new X509Certificate2(certBuffer);

I also have the CA's public key to verify the signature

RootCertificate.PublicKey.Key

I am now looking for a way to check if the signature is valid. How can I do that? The X509Certificate2 class doesn't seem to provide a way to access the signature field.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

X.509 certificate validation is a complex process. With .NET, you are supposed to use the X509Chain class to perform such a validation, which entails path building, verifying signatures, revocation status, and a gazillion of other things. See this answer for an example.

X509Certificate2 also has a Verify() method, but that one checks the certificate with regards to the machine defaults: the user's trust store, the user's policies... which may or may not map well to your specific case. To have full control on the process, use X509Chain.

(Extracting the signature value, and the exact byte sequence which is signed, is not overly complex if you know a bit of ASN.1/DER, but the point is that there is much more to certificate validation than mere signatures. Doing things manually is a path which I have personally walked several times, and it entails a lot of suffering. Using the implementation already provided by .NET will save you a lot of time; and that implementation is X509Chain.)

share|improve this answer
    
So did I understand correctly, that chain.Build() will among others perform a signature verification? I added the CA certificate to the chain and called Build(myCert). This method returned true and calling it with an invalid certificate returned false. Can that be prove enough? –  PogoMips Oct 2 '13 at 9:42
    
Yes, that's how this class is supposed to work. –  Tom Leek Oct 2 '13 at 10:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.