0
$\begingroup$

I'm validating the x509 signature of an XML document and I encounter the following error: "x509 certificate chain incomplete of leaf TP not found"

Any thoughts on what the impact is for a TLS connection?

$\endgroup$

closed as off-topic by e-sushi Nov 28 '16 at 1:48

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm or protocol works, you should look into asking on Stack Overflow instead." – e-sushi
If this question can be reworded to fit the rules in the help center, please edit the question.

0
$\begingroup$

No TLS impact.

Any thoughts on what the impact is for a TLS connection?

None, because you are verifying an XML document and not establishing a TLS connection at all.

"x509 certificate chain incomplete of leaf TP not found"

This means that you receive a certificate, but because you are missing one or more certificates in your trust store, the certificate itself cannot be verified.

If you cannot verify the certificate then anybody could have created the certificate and send you the signature. So even if the signature verifies against the certificate, the result is meaningless.

Now there are two things that can be wrong:

  1. you didn't establish any secure certificate to use with the sender of the XML document;
  2. the signature or trust store is missing one or more intermediate certificates.

The best generic solution is to make sure all intermediate certificates (up to the trust point) are included in the XML signature and make sure you trust the root certificate in your particular trust store.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.