XMLSig: validating an XML document incl. all certificates

Question

Hello,
I have created a XML document signed with a certificate. I have added whole certification chain (first entry the users certificate, last CA) in the document:
X509Data x509d = kif.newX509Data(Arrays.asList(myChain));
ki = kif.newKeyInfo(Collections.singletonList(x509d));
...The document validates perfectly with XMLSignature.validate method but I am not sure if this method validates the certificates. I suppose not.
Are there any standard processes to validate X509 certification chain from XML-signed document? Or do I have to retrive and verify all certificates myself? If so how? I have my very own KeySelector but I do not have idea how to use it to retreive my certificates:
    private static class X509CertKeySelector extends KeySelector {
        @SuppressWarnings({"LoopStatementThatDoesntLoop"})
        public KeySelectorResult select(KeyInfo keyInfo,
                                        KeySelector.Purpose purpose,
                                        AlgorithmMethod method,
                                        XMLCryptoContext context)
                throws KeySelectorException {
            if (keyInfo == null) {
                throw new KeySelectorException("Null KeyInfo object!");
            List list = keyInfo.getContent();
            for (Object aList : list) {
                XMLStructure xmlStructure = (XMLStructure) aList;
                if (xmlStructure instanceof X509Data) {
                    try {
                        X509Data xd = (X509Data) xmlStructure;
                        X509Certificate[] certs = (X509Certificate[]) xd.getContent().toArray(new X509Certificate[0]);
                        return new X509CertChainSelectorResult(certs);
                    } catch (ClassCastException e) {
                        throw new KeySelectorException("X509Data must contain X509 certificate list", e);
                } else {
                    throw new KeySelectorException("KeyInfo doesn`t contain X509Data");
            throw new KeySelectorException("No KeyValue element found!");
    private static class X509CertChainSelectorResult implements KeySelectorResult {
        private X509Certificate[] certificates;
        X509CertChainSelectorResult(X509Certificate[] certs) {
            this.certificates = certs;
            for (X509Certificate c: certificates) {
                System.out.println(c);
        public X509Certificate[] getCertificates() {
            return certificates;
        public Key getKey() {
            if (certificates != null && certificates.length > 0) {
                PublicKey publicKey = certificates[0].getPublicKey();
                return publicKey;
            } else
                return null;
    }ps - the certificates are stored in BASE64 encoding, I would prefer something "nicer" XMLSig allows to store certificates in the XML-way... whats the trick to store the certification chain in the XML human-readable format?

Answer 1

Verifying
the chain (with the root certificate in a secure
store) is only part of the whole verifying process.
You also need to verify that the signature is over
the correct data, and that the correct
transformations have taken place. This is missing
from the documentation. You might also need a CRL or
other way to revoke certificates, depending on the
usage of the library.Thank you but what you mean with correct data and transformation? XMLDigSig will do it for me, wont it? You are abolutely right with CRLs, in my TODO list... :-D