Certificates and XML Signatures

Check Certificate Expiration

SAML metadata frequently contains X.509 certificates associated with signing or encryption keys.

ShibbDebugger can identify these certificates and inspect their expiration dates.

How to Use

1. Select Check Certificate Expiration.
2. Upload an XML file containing SAML metadata.
3. Click Execute Command.
4. Review the detected certificate expiration information.

Certificates Examined

The command searches for KeyDescriptor elements and their embedded X509Certificate values.

Example:

<md:KeyDescriptor use="signing">
  <ds:KeyInfo>
    <ds:X509Data>
      <ds:X509Certificate>
        BASE64_CERTIFICATE_DATA
      </ds:X509Certificate>
    </ds:X509Data>
  </ds:KeyInfo>
</md:KeyDescriptor>

The example omits surrounding namespace declarations.

Certificate Usage

The use attribute may describe the intended certificate purpose.

Common values include:

Expiration Analysis

ShibbDebugger reads the certificate's X.509 notAfter date.

The date is displayed in UTC.

Example

Certificate (signing) expires on:
December 31, 2027 at 23:59 UTC — ✓ Valid

For a certificate that has expired:

Certificate (signing) expires on:
January 01, 2024 at 00:00 UTC — ❌ Expired

These dates are illustrative.

Remaining Days

For an unexpired certificate, the tool calculates the remaining whole days.

Example:

✓ Valid (120 days remaining)

This is based on the server's current UTC time.

Duplicate Certificates

The command attempts to identify repeated certificate text using SHA-256 and consolidate duplicate entries.

If a certificate appears under multiple uses, the report can list those uses together.

Important Limitations

The certificate expiration command does not perform full PKI validation.

It does not independently verify:

• Certificate revocation
• Certificate chain trust
• The issuing certificate authority
• Subject identity
• Cryptographic signature validity
• SAML metadata trust policy
• Whether an expiring certificate is actively used

The command primarily inspects expiration dates.

Also, X.509 expiration does not necessarily determine whether a SAML federation will accept a key. Federation metadata trust policies and key rollover practices must be considered separately.

Check XML Signature

XML Digital Signatures are commonly used to protect the integrity and authenticity of SAML metadata.

ShibbDebugger's signature command inspects signature-related XML elements.

How to Use

1. Select Check XML Signature.
2. Upload a signed XML document.
3. Click Execute Command.
4. Review the signature information.

Information Extracted

The command searches for an XML Digital Signature element:

<ds:Signature>
  ...
</ds:Signature>

It then attempts to extract:

Example XML Structure

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  <ds:SignedInfo>
    <ds:SignatureMethod
      Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
    <ds:Reference URI="">
      <ds:DigestMethod
        Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    </ds:Reference>
  </ds:SignedInfo>
  <ds:SignatureValue>
    BASE64_SIGNATURE_DATA
  </ds:SignatureValue>
</ds:Signature>

This is a simplified structural illustration, not a complete valid signed XML document.

Understanding Results

When a Signature element exists, the command reports that a signature was found and extracts available details.

If none is found, it reports:

❌ No XML signature found.

Critical Distinction: Inspection vs. Verification

The current implementation does not cryptographically validate XML signatures.

It does not:

• Verify the SignatureValue against a trusted public key
• Recalculate reference digests
• Validate canonicalization results
• Validate certificate trust
• Confirm the signed content matches the received content
• Detect all XML signature wrapping attacks

Although the generated result may use the phrase "structurally valid," the implementation only checks for a Signature element and extracts certain fields.

A signature's presence does not prove that it is valid.

Recommended Validation Workflow

1. Inspect the signature's presence and declared algorithms.
2. Check embedded certificates.
3. Verify the certificate or metadata signing key through your federation's trust process.
4. Use a dedicated XML signature verifier to validate the cryptographic signature and referenced content.
5. Confirm that the application processes the same XML elements that were verified.

Recommended Use

Use ShibbDebugger for initial certificate and signature inspection.

For production federation trust decisions, rely on properly configured SAML and XML Digital Signature validation tools.

Important: A displayed signature value is not evidence of successful cryptographic verification.