Signature certificate chain issue

[Main-Tomi]

Dear @phax,

I encountered a problem while using AS4IncomingHandler._parseMessage（）.
I used pull mode to request a message from customer, the soap format as follows:

<env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope">
	<env:Header>
		<eb:Messaging xmlns:eb="http://docs.oasis-open.org/ebxml-msg/ebms/v3.0/ns/core/200704/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" env:mustUnderstand="true" wsu:Id="_1fa7a8d7ac82957f8e5464d6de623bc36d5156ed66851d336f2e6266dfcb4be4d">
			<eb:UserMessage mpc="urn:fdc:ec">
				...
			</eb:UserMessage>
		</eb:Messaging>
		<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" env:mustUnderstand="true">
			<wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1" wsu:Id="X509-b1fa0fb2-8cb8-4e6e-8f05-5acec93d046a">MIITZzCCBj8wggQnoAMCAQICFAL252oIooLQTReSTRO/46CL8YTaMA0GCSqGSIb3DQEBCwUAMIGmMSYwJAYJKoZIhvcNAQkBFhd0YXh1ZC1saXNvQGVjLmV1cm9wYS5ldTEZMBcGA1UEAwwQREcgVEFYVUQgUk9PVCBDQTERMA8GA1UECwwIREcgVEFYVUQxHDAaBgNVBAoME0V1cm9wZWFuIENvbW1pc3Npb24xETAPBgNVBAcMCEJydXNzZWxzMRAwDgYDVQQIDAdCZWxnaXVtMQswCQYDVQQGEwJCRTAeFw0yMjA5MjkxMjE4NDZaFw00MjA5MjQxMjE4NDVaMIGmMSYwJAYJKoZIhvcNAQkBFhd0YXh1ZC1saXNvQGVjLmV1cm9wYS5ldTEZMBcGA1UEAwwQREcgVEFYVUQgUk9PVCBDQTERMA8GA1UECwwIREcgVEFYVUQxHDAaBgNVBAoME0V1cm9wZWFuIENvbW1pc3Npb24xETAPBgNVBAcMCEJydXNzZWxzMRAwDgYDVQQIDAdCZWxnaXVtMQswCQYDVQQGEwJCRTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIzBv5VC/AU37w9m59qzu2TH9d1CqedKmx7gVKEHbb7LZhsyO+Y2xBl8eqmYXSl/0DXG1ZdQIKNLMdrzJFI7KogR9M3ponOs197awvemXf/+9L191NDW7SfbtbEv/ELUkMG+v7dAu5sDXrubRd46URLADsWN/LbE09KGbvYz44T/XdcMXblenPI4JGWPYFTPt/XEDHfF7COcXTNQDVkIQCFe/UYnzZ/bEIOprVzop6LY2VdVMc+Z+DBQS8w2yjnjDthvGAezA11fQ5CcO+zgYOlbD8YccZWT8yXQUv1lTSNQ1KCY3efALopmmNKPbApOG/FnsFMyme5aZ9EkwU8n2swLbCRiLUcsgyn+PEFoxjIEiPbHQ1gcsUsqrlrNP2g2ZDKNmOkd/y6lLXnpO9lajS3b86yhbyRmw2upGxolgUWPmSGl1XRBOhfcLRRApIxqvqV5HIxKy+BtMUa9VfTED/cfyaCqePbpDceFSbBjCGPbjtYrp7yrps9GKOJzPMJABHpH09w9oZ5yOTT1sS5NBQK/TyouBWEFX16GjQ+JS/4BCaINlb04D//cToch8Nu7eRnd18X/rHOEG3eLY9ghbQs8LZSM4L3+WGH9nHE0o7pUeLIdHATbZdhUeO4mlzb6Aeij5SiPECZSNTO9Eb3fEKFcXlXNL493VYG0TyIcisQFAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUBW2y1fC/EsUx5igP3ZFRrWvn+AUwHQYDVR0OBBYEFAVtstXwvxLFMeYoD92RUa1r5/gFMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAFz6pdTym1OsyGIimEvjb9jnvYJNwFNqzjBx70wKaKUFL10RxSjHPqxwWAjC7vvdGK1kv6s2o40RQ3bWzePKLHTWS9Gl8VcfxOG94ahT7jUT++ArJf42jj7J+BvTAVJJUg4QyVi9ikPuWnhha7QznOiQ9Xn0KgIqfMb2RgDCHBuZmLFqrv9IHTd8Ezy6pin3N41XOuZ1M8AAZdLKfVPuVPfoSkInsmzFnuolzXzTZiFWpXrSBysVf05mzIYCzJyv96U3UrFuU9Qz3sRiWG0BgCoKgzoCCc6elQnY5rkspQy676Mu9NQ8+EbPrFMuHUIfa2OEL/67psQWKfhS1MLXsf0HZBRMKZ4opOLaZrWMygM3bJpepGDzzvParv9aVBya1usvuyeDH+GkVWlV3bxjMcQ2+YEytsC/UNIIVYidrjuuAxdq6WZhKp5cDkBewlns4HzeTyBjkXMyjkwSVLeUW4DcWFBRzga8U8pQeJH/2e9zbROABygE8qpfpq8+5fP158pO6LAwb+mcs3iSlD5j/vXC5T10/AqMH7FPqTU2OY4aNk/9cVQ1V+5cZsAh3bAu2Qe+aC+T5/JPpTBvTwm8paS6tzqnRK+5b6kUyhjVaopaVl3bbZVFcpFzhHOfbi1gWSBU7w+pTed9IdSQDbVVhoxau67ue6NFcHxchGTP/U0owggbnMIIEz6ADAgECAhQtkY0IdjIijkRX+eRt/NY+l67IOTANBgkqhkiG9w0BAQsFADCBpjEmMCQGCSqGSIb3DQEJARYXdGF4dWQtbGlzb0BlYy5ldXJvcGEuZXUxGTAXBgNVBAMMEERHIFRBWFVEIFJPT1QgQ0ExETAPBgNVBAsMCERHIFRBWFVEMRwwGgYDVQQKDBNFdXJvcGVhbiBDb21taXNzaW9uMREwDwYDVQQHDAhCcnVzc2VsczEQMA4GA1UECAwHQmVsZ2l1bTELMAkGA1UEBhMCQkUwHhcNMjIwOTI5MTU0ODA5WhcNNDIwOTI0MTIxODQ1WjCBpjEmMCQGCSqGSIb3DQEJARYXdGF4dWQtbGlzb0BlYy5ldXJvcGEuZXUxGTAXBgNVBAMMEERHIFRBWFVEIFBST0QgQ0ExETAPBgNVBAsMCERHIFRBWFVEMRwwGgYDVQQKDBNFdXJvcGVhbiBDb21taXNzaW9uMREwDwYDVQQHDAhCcnVzc2VsczEQMA4GA1UECAwHQmVsZ2l1bTELMAkGA1UEBhMCQkUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCEZ2bqBScnH0F+1qKwIY3nUI8mONhGxOpwgBBQV1wpeIuG9H13IwojKUdq/AYWYT8xPWxnrCOtgJHVvkuYw9tLG1Pa1KoP/NeJCsDf8M9TpCHLZNWF4XE6ToELe68efv2ye/O/6Hvw+0sxpJl83J34wr/I8mmLPdS9pj6VC/uVQpV/gl3djd+7m/+JLaculgJWNq4eHKO9m1h/EbnBerz4Nl3X6TJ/+9MvcjVQbJvEe/VuFt85/gzvnipM+WKstQIc5Y1G8eW/cIqfbcRPBbypo+oyjlHmI0zXqnuZOl22Zagfo8O0mpIKCqTjuYwkzbp7u2GyrhfIIvXvnnLKnXP9jTJd2sJFfC47qAYD3ix60GFn0QiupWeg7BZWuINCUwGh1BEJK04FJuhH7nL9TsVnUCFwENT2UR4BXlN4CyyZ69a/+QdymX7om38w8QHRw8huDxInQxB0vZvvNxcdIyN0mLVHnC/2rN0N+WzoJbx0pvhNhVVyi3AHo/Z2fMGjnAIwpznSO9Lrfy55kP6a927iSmkzPmlzfPgfrrAT3h9l+W1ZpOwmUGvT4uIzU+LMpRrq1Xpy7jxDp90qan/Bs5pq+Vg1EtakDdn12hg8J9rDdY/6ZX5BvV4lS+C4zE8Zz1bsWbfASsQ1mFKZIef1UTVODlZHiPa0kBXFjHdle7MSnQIDAQABo4IBCTCCAQUwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBQFbbLV8L8SxTHmKA/dkVGta+f4BTBUBggrBgEFBQcBAQRIMEYwRAYIKwYBBQUHMAKGOGh0dHA6Ly9wa2kudGF4dWQuc2VydmljZXMuZWMuZXVyb3BhLmV1L2RndGF4dWRyb290Y2EuY3J0MEkGA1UdHwRCMEAwPqA8oDqGOGh0dHA6Ly9wa2kudGF4dWQuc2VydmljZXMuZWMuZXVyb3BhLmV1L2RndGF4dWRyb290Y2EuY3JsMB0GA1UdDgQWBBSH0za3LY7Bvs5k7Nv+EToH0BTSmjAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBAImctU+cKEOpXxl2ay1i4g9Ias0WpXJfUyVLcKIudr730iN/vwz3rzNp+DEOxSznMyLRcwmwJH+l36Nlc/Wo3u0kUi37kY/240xIGy0zESnh79xrZYTEz1M5ujF1l78PCLoSy24mC42CamWQD8701FbTr0InADE3D01svSEAd95TtLzLPF19aIqvqT5bZHEeAJ+6j6xve5ThzchElSDvesGITC6RFql78xcm4j78yq4Uv981EsMnVgkw7gFzqpgmfxp1oT3DxK2kiFYn7BB0T5Az76fZB/9YWjWIbzv4LH3M8KjS2SubvneLTCaf5AO2v0pnc8qt4B31eSH7QtGRGBA1GdbKHGWqNPs04VL3+ohY2Bp7F7Dekd5+rvUVjLc5W87EwyCj0kjNUAx4xV36i4hdoUJx4sKO2ELPwEweUAvQCLmeazs85Dj1jCjxF0N8wgWUXL1VTqml1hOOIcG+Nt21wZ9gNyyEZI4NsYyhhEkgtX7OTb9K9iLcqSK0P22NHPBEZ6sQysKd4QJzFgQPvCmDCw3x4G8q+NWmkcyPNoZpp5vKNhFD5HTTeKjzZDM2P2QbeawOtobPvRfiL2bLTrWYpJaCz0P6hKQoqq4hsoBqdgIc/1EYyLhpA5vLiSmnSfjTbIpvJy7yLlDu5u1vAilRsuIhbBqdMyTiS8nf9zKJMIIGNTCCBB2gAwIBAgIUJ5E/QShDKhU8dBYBPiZsNy3uW94wDQYJKoZIhvcNAQELBQAwgaYxJjAkBgkqhkiG9w0BCQEWF3RheHVkLWxpc29AZWMuZXVyb3BhLmV1MRkwFwYDVQQDDBBERyBUQVhVRCBQUk9EIENBMREwDwYDVQQLDAhERyBUQVhVRDEcMBoGA1UECgwTRXVyb3BlYW4gQ29tbWlzc2lvbjERMA8GA1UEBwwIQnJ1c3NlbHMxEDAOBgNVBAgMB0JlbGdpdW0xCzAJBgNVBAYTAkJFMB4XDTI0MDMxNDEzMjUwMVoXDTI1MDQxNjEzMjUwMFowgaAxEjAQBgNVBAMMCXN0aS10YXh1ZDERMA8GA1UECwwIREcgVEFYVUQxFDASBgNVBAsMC1NQRUVEMm5nIFRMMRwwGgYDVQQKDBNFdXJvcGVhbiBDb21taXNzaW9uMREwDwYDVQQKDAhTUEVFRDJuZzERMA8GA1UEBwwIQnJ1c3NlbHMxEDAOBgNVBAgMB0JlbGdpdW0xCzAJBgNVBAYTAkJFMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmYmL+b7dS4T04qKQAuMFjRTCiwHOu6Fl3psmtFZpCz+G5hH4LYIT6u97sng0tBskynsT5YuH7okqY9yBg8IsbPPrdrhqAs3UhHtXGI5HuVfhleAn8RS8pP0wXNqnCu982r+auQHuRpQUO2lYsMfl7fOxOJxpG6IcFej66/1CGJqS28O0dcQ89i2eVaJLZbWD5aPjVj8oSdVQumUNRYG2dK7/AsUKW+e2DBwFgK+tYGsDiR7jMekGvFn/FpV9kfK5sLxJef7PvlNt0/Dxqdw1WImv/hqBEQuUkk0RItQNJe9ZvDnVnu7llooaUvPxpjSR42e7uiNTTJ+TeF66lGS/gwIDAQABo4IBXTCCAVkwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBSH0za3LY7Bvs5k7Nv+EToH0BTSmjCBjgYIKwYBBQUHAQEEgYEwfzBEBggrBgEFBQcwAoY4aHR0cDovL3BraS50YXh1ZC5zZXJ2aWNlcy5lYy5ldXJvcGEuZXUvZGd0YXh1ZHByb2RjYS5jcnQwNwYIKwYBBQUHMAGGK2h0dHA6Ly9wa2kudGF4dWQuc2VydmljZXMuZWMuZXVyb3BhLmV1L29jc3AwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMEkGA1UdHwRCMEAwPqA8oDqGOGh0dHA6Ly9wa2kudGF4dWQuc2VydmljZXMuZWMuZXVyb3BhLmV1L2RndGF4dWRwcm9kY2EuY3JsMB0GA1UdDgQWBBTN6WRtqCp2m/wJkr0jySTtSn4TuTAOBgNVHQ8BAf8EBAMCBPAwDQYJKoZIhvcNAQELBQADggIBACx1rB5R30//lFME69PQ8heFcWXBF0+bnFtF2X84yQrny/sPPK9pK+iuwqyUthvdeXbTenxO20spx4Y00Dr5wGMwwgz9NfypblUNdq8Nc2BFKODWp55YKkiTEdv6SVoZ7fjZke9s8xcaGVTx9Bq+uRT3leZbtSTyjSsJEAJzVwQFzT0JE3eq9cQ+SBc56Xy/eLKQ/G9+7rCax+n/tCpbGQt8Nr3osPAiQi4MQv6A8Xhn110IJEPhoBuXe9yX4/zZjGuT9dJ4AuFVG50CN3KMyfKtXoQRIZenuf78RZNtzVKsNBPfFu2R+nGn9C3ioISJvgbEIhVCngBGmnN6p7/tvzBBCOpy+O+U8b+UDNDud5kMHP1nuzYO0JHEK+Greg3prnqDtwrxVanRXEvD8JAZPhg98T/XDZAdq1vX9cyPLUm9hhUF/nVmdz+AitWlM8gbmz2uuqvMIqSFk9EcPD3fGEnlH9QexSKp2w7SoYBCdq/zKD5DcURociHUqpqGdJg3CVpC6h7zrU8kQcTtk24ieio/eMGGQo3m66d4tstjQyHgukcg8n82YljrVWUETuxryJrsH7DZHa9UgHUy8DMMB8psyTeqhjei0FWDOPdoItxqkUy0LA9HRJjTbI+Sz9Nri9R1g52RNdceeIJ7oLdkkdmlhqFAHsHT/p2N0PKLv7Ok</wsse:BinarySecurityToken>
			<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="SIG-2dc577d3-d66c-496d-ab02-b91162159502">
				<ds:SignedInfo>
					<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
						<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="env" />
					</ds:CanonicalizationMethod>
					<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
					<ds:Reference URI="#_2fa7a8d7ac82957f8e5464d6de623bc36d5156ed66851d336f2e6266dfcb4be4d">
						<ds:Transforms>
							<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
						</ds:Transforms>
						<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
						<ds:DigestValue>XxMFrw6WdkIOO7XSC89L6EqUiCotip2e8qx5P1sAqUE=</ds:DigestValue>
					</ds:Reference>
					<ds:Reference URI="#_1fa7a8d7ac82957f8e5464d6de623bc36d5156ed66851d336f2e6266dfcb4be4d">
						<ds:Transforms>
							<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
						</ds:Transforms>
						<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
						<ds:DigestValue>GF/M0QurroGdqJrTfX7SHMOTooX8JCgPBUF0vzFArrI=</ds:DigestValue>
					</ds:Reference>
					<ds:Reference URI="cid:message">
						<ds:Transforms>
							<ds:Transform Algorithm="http://docs.oasis-open.org/wss/oasis-wss-SwAProfile-1.1#Attachment-Content-Signature-Transform" />
						</ds:Transforms>
						<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
						<ds:DigestValue>5u+BfpSWlO82j5CxhjEzenl0Bbue2IOcX9BnyMjNQ+s=</ds:DigestValue>
					</ds:Reference>
				</ds:SignedInfo>
				<ds:SignatureValue>lceIen95Tw1LBVRZrj6keEvKvBwL9H2lAYCGlDf621KSWwgEghbZzQ9+auTrjTP5fKEs4g8V7fpDIauEV/ndYb/ytFSk3Yp29ramHm5aUcJSbjr9xUiCWcpIPxlODvQrwy7yjLBbA9Dwe53+KYqpIn6VZJj1+UZGOhN8UNz9DJFsnbgkC34SK3ag+2LsoAQASKhNq5kas2lJBr20DmCkigZJZJXnIuQTcSWw/slcBwiVICp8ADUMRnp25rCzDXoNZ9KoUpDxlcKLV+S5yqEz9B0/lLhst7tKPFjPynVM7KpkqaZDZfB9A8aXMq2mje9kgXsyjRpRLnW6gf2OezcfXQ==</ds:SignatureValue>
				<ds:KeyInfo Id="KI-4af27512-81a4-45a8-af2b-84e5cf748533">
					<wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsse11:TokenType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1" wsu:Id="STR-8f4a6f2b-15af-494f-ab34-cc02e935e8d0">
						<wsse:Reference URI="#X509-b1fa0fb2-8cb8-4e6e-8f05-5acec93d046a" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1" />
					</wsse:SecurityTokenReference>
				</ds:KeyInfo>
			</ds:Signature>
		</wsse:Security>
	</env:Header>
	<env:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="_2fa7a8d7ac82957f8e5464d6de623bc36d5156ed66851d336f2e6266dfcb4be4d" />
</env:Envelope>

it was signed with a certificate chain(From BinarySecurityToken), when I use the method(AS4IncomingHandler._parseMessage) to parse the result, it encountered an exception:

This error indicates that I did not add the public key to the trust key repository, but in fact, I have added the certificate at the bottom of the certificate chain to the trust key repository. The problem was only resolved after I added the root certificate to the trust key repository.

In my understanding, when a certificate chain appears, we usually use the lowest level certificate as the object we use, like signature and encryption.And the root certificates are often not compliant with security standards because their validity period is relatively long and they are easily hacked.
Is it better to replace the verification of the certificate chain with the lowest level certificate verification?

[phax]

This is a very good point to discuss.
Basically this all depends on the trust model your application is using.
E.g. in the context of Peppol they have their own root certificate and for them it is sufficient to trust a single issuer.
In other context, with a shared root or CA certificate, you need additional checks to verify if a certificate is present.

If trusting of the intermediate CA is not suitable, you need to provide the full certificate path in the trust store, because otherwise the application has no way to verify if the intermediate certificate is trustworthy or not.

That's why phase4 differentiates between keystore and truststore. The keystore only contains the private key (eventually with the full chain), whereas the truststore contains only the public parts of all trusted certificates but no secrets. That's why it is not problematic (from my point of view), that a trust store contains trusted root certificates, because keystores and truststores need to be assessed differently from a security point of view. Hope that makes some sense ;-)