Validate certificates from received XML document

Question

Hi,
I'm new to the Cryto API and have read the Java Cert Path API Prog. Guide. But I'm still not crystal clear on some details.
(1) In the code below, at (a), which certificate should I put in the selector? Note that the document may contain a chain of X509Certificates, but PKIBuilderParam seems to take only one cert via X509CertSelector
(2) Is CertPath validation still needed? (At point (b).) I think it is not needed as we build the CP already, but then I'm not sure.
(3) The code runs successfully but the "cp" list is empty. Is that normal? Note: the truststore key store contains the certificate found in the document.
(4) Do I miss anything else?
Thanks a lot!
Here is what my code looks like:
// The XML has certs in the XML signature. (We collect them using
// Apache XML Security library)
ArrayList<X509Certificate> certList = obj.getX509Certificates();
X509CertSelector selector = new X509CertSelector();
selector.setCertificate(certList.get(0)); // (a)
PKIXParameters params =
new PKIXBuilderParameters(trustStore, selector);
CertPathBuilder cpb = CertPathBuilder.getInstance("PKIX");
CertPath cp = cpb.build(params).getCertPath();
List certs = cp.getCertificates();
Iterator i = certs.iterator();
while (i.hasNext()) {
X509Certificate c = (X509Certificate) i.next();
System.out.println(c);
// (b)
CertPathValidator cpv = CertPathValidator.getInstance("PKIX");
CertPathValidatorResult cpvResult = cpv.validate(cp, params);

Answer 1

(1) In the code below, at (a), which certificate
should I put in the selector? Note that the document
may contain a chain of X509Certificates, but
PKIBuilderParam seems to take only one cert via
X509CertSelectorYou should put the end-entity (the signer's) certificate in the X509CertSelector.
(2) Is CertPath validation still needed? (At point
(b).) I think it is not needed as we build the CP
already, but then I'm not sure.No, it is not needed. A PKIX CertPathBuilder will return a chain that has been validated.
(3) The code runs successfully but the "cp" list is
empty. Is that normal? Note: the truststore key store
contains the certificate found in the document.This means that the certificate you are trying to validate is already trusted
(is this the case?, if not you should not include it as a trust anchor),
so there is no path to build (the path returned has length of 0).
--Sean