Verifying signature using multi cert PEM

[niwsa]

When verifying a xml document you can pass the following options to the SignedXml constructor to customize the verify process:
publicCert - [optional] your certificate as a string, a string of multiple certs in PEM format, or a Buffer

I have a few queries related to signature validation:

• When trying to verify xml signature using multi cert PEM does the order of certs inside PEM matter ? i.e Should the actual certificate used to sign the xml come first ?
• Also would getCertFromKeyInfo returning a multi cert PEM work in a similar manner ?

[cjbarth]

IIRC, the certs will be tried in order until either one of them verifies (success) or there are no more certificates to try (failure). The only affect the order would have would be on performance, but even that would likely be negligible in most scenarios.

[niwsa]

Thanks @cjbarth for the reply. For some reason this was not working as expected for us. I will try to come up with a reproducible test case for this.

[srd90]

Seems that you found solution for this case with: boxyhq/saml20#572