Kiren Siva Kiren Siva - 1 year ago 144
Java Question

Verify SOAP request using the X509 certificate

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML.

  1. BinarySecurityToken (X509PKIPathv1 certificate)

  2. DigestMethod

  3. DigestValue

  4. SignatureValue

  5. SecurityTokenReference

  6. Data (data that is send by
    client in SOAP body)

I have to verify the request using the certificate(.cer files) which is provided by the client (sender of the request).

What are the steps to validate the requests? I Googled but no hope. Please help me to understand the concept. Getting a basic idea will help me. I am from php background. No libraries are available for doing this. After a long research I am able to match
$certFile is the requester's certifiate. Now I am researching how to match
with what.

Answer Source

WS-Security headers can be verified by the following. I have written an utility for that. Have a look at it.


import javax.xml.crypto.dsig.XMLSignature;
import javax.xml.crypto.dsig.XMLSignatureFactory;
import javax.xml.crypto.dsig.dom.DOMValidateContext;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;

import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.xml.sax.InputSource;

public class WSUtil {
    public static void main(String[] args) throws Exception {

        String req = "SOAPMESSAGE";
        Document p = createXMLDocument(req);
        InputStream inStream = new FileInputStream("certificate.p12"); //Provide your certificate file

        KeyStore ks = KeyStore.getInstance("PKCS12");
        ks.load(inStream, "pass".toCharArray()); //Certificate password - pass

        String alias = ks.aliases().nextElement();
        X509Certificate certificate = (X509Certificate) ks.getCertificate(alias);

        validateSignature(p.getElementsByTagName("ds:Signature").item(0),p.getElementsByTagName("soapenv:Body").item(0),certificate.getPublicKey());//True if the message is valid

    public static Document createXMLDocument(String xmlString) throws Exception {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        DocumentBuilder builder;
        Document document = null;
        try {
            builder = factory.newDocumentBuilder();
            document = builder.parse(new InputSource(
                    new StringReader(xmlString)));
        } catch (Exception e) {
            throw e;
        return document;

    private static boolean validateSignature(Node signatureNode, Node bodyTag, PublicKey publicKey) {
        boolean signatureIsValid = false;
        try {
            // Create a DOM XMLSignatureFactory that will be used to unmarshal the
            // document containing the XMLSignature
            String providerName = System.getProperty
                    ("jsr105Provider", "");
            XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM",
                    (Provider) Class.forName(providerName).newInstance());

            // Create a DOMValidateContext and specify a KeyValue KeySelector
            // and document context
            DOMValidateContext valContext = new DOMValidateContext(new X509KeySelector(publicKey), signatureNode);
            valContext.setIdAttributeNS((Element) bodyTag, "", "Id");

            // Unmarshal the XMLSignature.
            XMLSignature signature = fac.unmarshalXMLSignature(valContext);
            // Validate the XMLSignature.
            signatureIsValid = signature.validate(valContext); 

        } catch (Exception ex) {

        return signatureIsValid;

Note You have to provide the SOAP message as it is. You shouldn't do any XML format or any empty space somewhere. The security added SOAP message is very sensitive. Even a space at the end will make the SOAP message as invalid. Hope this is helpful.