title: XML Digital Signature validation
body: <p>I was trying to validate an XML signature. </p>
  
  <p>The validation according to this <a href="http://www.j2ee.me/webservices/docs/2.0/tutorial/doc/XMLDigitalSignatureAPI8.html" rel="nofollow noreferrer">tutorial</a> works fine.</p>
  
  <p>But I also tried to a second approach. To verify it with the <a href="http://java.sun.com/javase/6/docs/api/java/security/Signature.html#verify%28byte[]%29" rel="nofollow noreferrer">verify method</a> of the Signature class 
  I extracted the signature and the certificate from the xml file, and I did the following:</p>
  
  <pre><code>    public static boolean checkSignedFile(byte[] data, byte[] sigToVerify,
          byte[] cert, String algorithm) throws CertificateException,
          NoSuchAlgorithmException, InvalidKeyException, SignatureException {
      CertificateFactory cf = CertificateFactory.getInstance("X.509");
      Certificate c = (Certificate) cf
              .generateCertificate(new ByteArrayInputStream(cert));
      PublicKey pk = c.getPublicKey();
      Signature sig;
      boolean verifies = false;
      sig = Signature.getInstance(algorithm);
      sig.initVerify(pk);
      sig.update(data);
      verifies = sig.verify(sigToVerify);
      return verifies;
  }
  </code></pre>
  
  <p>the result was false. The signature did not verify. What could be the reason for that?</p>