If you receive a Path Build Exception error this indicates that either the certificate path is not complete - in that a valid certificate path could not be found from the end-entity (signer) certificate to a trusted root certificate, or that there was another issue with one or more certificates in the path e.g. an expired certificate or a rule violation
Check the Logs
Where is the log file?
The EzSign log file should contain the actual reason for the failure. e.g.
Path Build Exception: Path Build: Path building failed. Could not find issuer for : CN=BANK001001, OU=Engineering, O=Krestfield Ltd, C=GB
This will give the reason for the path build failure
Incomplete Paths
Errors such as the following:
Path Build Exception: Path Build: Path building failed. Could not find issuer for : CN=BANK001001, OU=Engineering, O=Krestfield Ltd, C=GB
Are caused because either the root certificate is not present in the channel or the signature itself does not contain the required intermediate certificates
To determine which, you may copy the Signature data sent, and paste into the Signature Toolkit tool. This will display the certificates included in the signature which can then be analysed
You can install the root certificate (or any other certificates required, including the intermediate CA certificates) via the Management Utility, choosing the Import Certificate option
Once all the required certificates have been installed, restart EzSign and attempt the verification again
Note: This may not be an error condition at all. The siganture being verified may have been signed by a rougue or spoofed certificate and EzSign is rejecting it for this reason
Rule Violation
Errors such as the following:
Path Build Exception: The key size of the certificate CN=BANK001001, OU=Engineering, O=Krestfield Ltd, C=GB is 2048 bits. This is less than the minimum key size of 4096 bits specified
Are due to the rules specified in the configuration, or within the custom path checker (if enabled)
In this specific case, the following property:
channel.1.verify.minKeySize=4096
Requires that the certificate must have a key size of at least 4096 bits
The property can be relaxed (e.g. to 2048) but the rule may be in place for a specific security reason, in which case the signature has been rejected intentionally
Other settings that perform checks on the path and siganture are shown below:
channel.1.verify.signedAttribsRequired=true
channel.1.verify.denyWeakSignatureHash=false
channel.1.verify.denyWeakCertificateHash=false
channel.1.verify.relaxRootCertExtensionChecks=false
channel.1.verify.relaxAllCertExtensionChecks=false
channel.1.verify.nonRepudiationRequired=true
channel.1.verify.caBasicConstraintsRequired=true
channel.1.verify.minKeySize=2048
channel.1.verify.maxKeySize=8192
