You probably want *both* enveloped and exclC14N transforms. Otherwise, you will be modifying the signed data when you add signature and this is why you get the digest mismatch error.
Best, Aleksey On 11/20/12 3:38 AM, Tim Tassonis wrote: > Hello List > > I have to create a signed soap message to an application that expects a > reference with transport xmlSecTransformExclC14NId and not enveloped > transport. > > I always get an error "invalid data:data and digest do not match". > > What I did was: > > signNode = xmlSecTmplSignatureCreateNsPref(doc, \ > xmlSecTransformExclC14NId, \ > xmlSecTransformRsaSha1Id, \ > NULL, \ > "ds"); > > xmlAddChild(xmlDocGetRootElement(doc), signNode); > > refNode = xmlSecTmplSignatureAddReference(signNode, \ > xmlSecTransformSha512Id, \ > NULL, \ > NULL, \ > NULL); > > xmlSecTmplReferenceAddTransform(refNode,xmlSecTransformExclC14NId); > > /* > xmlSecTmplReferenceAddTransform(refNode,xmlSecTransformEnvelopedId); > */ > > keyInfoNode = xmlSecTmplSignatureEnsureKeyInfo(signNode, NULL); > > xmlSecTmplKeyInfoAddX509Data(keyInfoNode); > > dsigCtx = xmlSecDSigCtxCreate(NULL); > dsigCtx->signKey = xmlSecCryptoAppKeyLoad(key_file, \ > xmlSecKeyDataFormatPem, \ > key_pass, \ > NULL, \ > NULL); > xmlSecCryptoAppKeyCertLoad(dsigCtx->signKey,crt_file,xmlSecKeyDataFormatPem); > > > xmlSecKeySetName(dsigCtx->signKey, "private.key"); > > xmlSecDSigCtxSign(dsigCtx, signNode); > > (I do originally have all the checks for success of the operations in > place, I just removed them for brevity of this mail). > > > If I change xmlSecTransformExclC14NId to xmlSecTransformEnvelopedId in > xmlSecTmplReferenceAddTransform, verify3 reports success (but my > application doesn't accept it), but otherwise both verify3 and the > application report "invalid data:data and digest do not match". > > What am I doing wrong here? > > > Kind regards > Tim > _______________________________________________ > xmlsec mailing list > [email protected] > http://www.aleksey.com/mailman/listinfo/xmlsec _______________________________________________ xmlsec mailing list [email protected] http://www.aleksey.com/mailman/listinfo/xmlsec
