I am currently writing my masters thesis in which I need to develop a licensing module for an application.
The license itself is a JSON Web Token which is signed using a RSA private key.
Since we have the requirement that resellers should also be able to create and sign valid licenses I thought about using a PKI where my company owns the root CA and creates an intermediate certificate for each reseller (so that they can sign their licenses). The root certificate will be part of the final binary ("hiding" the root certificate in that binary is a totally different story). In order for the application to verify the license it needs to check the license's signature and needs to verify the whole certificate chain - that means that the certificate chain (except the root certificate of course) needs to be part of the license.
To my actual question: Should I
- only sign the JSON Web Token and then append the certificate chain to the license or
- include the certificate chain into the JSON Web Token and then sign everything altogether?
I have read through some articles that say that one should not hash secrets / through some articles that discuss about MAC-then-encrypt vs encrypt-then-MAC, but none of them can be applied to my problem (since there is neither a secret, nor an encryption involved).
Even if it makes no difference whether I sign only the JWT or the combination of both (JWT + certificate chain) I need to provide some arguments that support and explain the final decision.