title: How can I establish trust in a X.509 certificate issued by an intermediary?
body: <p>I have an XML document that is digitally signed. I use the XML Digital Signature API to verify the signature. But this document is a SAML 2.0 Assertion that will be used for single sign-on into our web application. As such I need to establish trust in the X.509 certificate used to sign the XML document.</p>
  
  <p>The code I am using to try and establish this trust is:</p>
  
  <pre><code>String filename = System.getProperty("java.home") + "/lib/security/cacerts".replace('/', File.separatorChar);
  FileInputStream is = new FileInputStream(filename);
  KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
  String password = "changeit";
  keystore.load(is, password.toCharArray());
  
  PKIXParameters params = new PKIXParameters(keystore);
  params.setRevocationEnabled(false);
  
  CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
  CertPath certPath = certFactory.generateCertPath(Arrays.asList(signatureCertificate));
  
  CertPathValidator certPathValidator = CertPathValidator.getInstance(CertPathValidator.getDefaultType());
  CertPathValidatorResult result = certPathValidator.validate(certPath, params);
  
  PKIXCertPathValidatorResult pkixResult = (PKIXCertPathValidatorResult) result;
  TrustAnchor ta = pkixResult.getTrustAnchor();
  X509Certificate cert = ta.getTrustedCert();
  </code></pre>
  
  <p>When run the call to <code>certPathValidator.validate()</code> throws a <code>CertPathValidatorException</code> with the message <code>Path does not chain with any of the trust anchors</code>.</p>
  
  <p>Examining the certificate, it says it has been issued by <code>OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign,OU=VeriSign International Server CA - Class 3,OU=VeriSign\, Inc.,O=VeriSign Trust Network</code>.
  This is not one of the trust anchors in the JDK's cacerts key store.</p>
  
  <p>However, using IE to inspect a similar certificate's trust chain I see that <code>www.verisign.com/CPS Incorp.</code>'s was issued by <code>VeriSign Class 3 Public Primary CA</code>, which does appear to be one of the trust anchors in the JDK's cacerts key store.</p>
  
  <p>My question: how can I get Java to validate this certificate?</p>