Authority-Information-Access code x509 PKCS12
https://stackoverflow.com/questions/58272826/get-chain-or-ca-issuer-from-x509-certificate-using-openssl-cli
https://www.leaderssl.com/articles/377-aia-fetching-technology-for-restoring-chain-of-certificates
Authority Information Access (AIA) is a special extension in SSL certificates that contains information about the issuer of the certificate. This extension helps fetch intermediate certificates from the issuing certification authority. In case if server does not provide intermediate certificates, they could be downloaded from the link contained in the AIA field. This approach allows saving the certificate chain and performing an SSL certificate check, even if the server incorrectly configured. If user's client supports AIA Fetching, then user does not even aware of server configuration errors.
AIA intermediate fetching technology is currently supported by following browsers: Google Chrome, Internet Explorer and Safari. However, the AIA technology used for restoring chain of certificates is often being criticized because it encourages wrong servers’ configuration. Certificate chain would work as expected, even if intermediate certificates are not installed on the server. The main advantage of this approach is convenience for users. Nowadays, not all browsers support AIA Fetching technology.
https://www.cryptopro.ru/forum2/default.aspx?g=posts&t=16909
Вы, вероятно, в вашем примере, состоящем из двух частей: отдельно построение и отдельно подпись, проверяете подпись раздельно, и для первой части у вас задается enableAIAcaIssuers, а для случая cades-подписи - нет. В случае enableAIAcaIssuers промежуточный сертификат скачивается и цепочка строится (1 часть примера), для второй части вы, вероятно, комментируете enableAIAcaIssuers и cades-подпись запускается без enableAIAcaIssuers, цепочка не строится. Задавайте везде enableAIAcaIssuers, если не передаете промежуточные в addSigner.
Кроме того, в последних версиях cades.jar у одного из методов addSigner (самого полного) есть параметр addCertificateChain, который означает добавление построенной цепочки в подпись.
In practice, cert validation goes the other direction:
I have an end-entity certificate. Who signed it? Do I already trust them?
Oh, it's signed by a CA. Is this CA in my "trusted roots" list?
If yes, we're done (cert validation success)
If no, then who signed this CA certificate? Do I already trust them?
and so on until either you hit a trusted root (cert validation success), or you hit a self-signed cert that is not in your "trusted roots" list (cert validation fail).
https://security.stackexchange.com/questions/186068/x-509-certificate-chain-signatures-verification
Know this is a bit old and it's been resolved but I thought I'd add a little script I write to parse out the CA Issuer from the x509 output:
getcaissuer() {
openssl x509 -noout -text -in $1 | awk '/^[ \t]+CA Issuers[ \t]+-[ \t]+URI:/ { print gensub(/^.*URI:(.*)$/,"\\1","g",$0); }'
}
# usage: getcaissuer <certificate>
