Cover a certification-path BinarySecurityToken in both directions

The PHP side can now advertise its whole path as a #X509PKIPathv1 token, and the
inbound half had only ever been read back by our own writer.

The PHP->Java row is what settles the byte order the middleware emits. Our reader
derives the end-entity from issuer linkage and therefore accepts either direction,
so it cannot arbitrate; WSS4J can, and it refuses a leaf-first path with "CA key
usage check failed: keyCertSign bit is not set", having read the first certificate
as the issuer. Anchor first is accepted, which is how ITU-T X.509 defines a
PkiPath.

The Java->PHP row needs the oracle to emit one, which is WSS4J's
setUseSingleCertificate(false), wired as signature.certificatePath and the
?certpath= query parameter. It writes the same order, CA then leaf, and includes
the anchor rather than stopping at the intermediates.

Author: veewee

oracle/src/main/java/org/phpsoap/interop/OracleServer.java

@@ -233,7 +233,7 @@ private static String attachJson(Attachments.ReceiveResult result) {
     /**
      * Builds a per-request {@link ScenarioConfig} from query parameters, defaulting to the matrix happy
      * flow. Recognised params mirror the CLI config keys, e.g.
-     * {@code ?keyref=SubjectKeyIdentifier&sigalg=RSA_SHA512&encdata=AES256_CBC&enckey=RSA_OAEP&oaep=SHA256
+     * {@code ?keyref=SubjectKeyIdentifier&sigalg=RSA_SHA512&certpath=true&encdata=AES256_CBC&enckey=RSA_OAEP&oaep=SHA256
      * &c14n=INCLUSIVE&disableBsp=true&ts=false}.
      */
     private static ScenarioConfig configFrom(URI uri) {
@@ -245,6 +245,9 @@ private static ScenarioConfig configFrom(URI uri) {
         if (q.containsKey("sigalg")) {
             config.signatureAlgorithm = q.get("sigalg");
         }
+        if (q.containsKey("certpath")) {
+            config.signatureCertificatePath = Boolean.parseBoolean(q.get("certpath"));
+        }
         if (q.containsKey("sigalias")) {
             config.signatureKeyAlias = q.get("sigalias");
         }

oracle/src/main/java/org/phpsoap/interop/ScenarioConfig.java

@@ -34,6 +34,14 @@ public final class ScenarioConfig {
     /** XML-DSig signature algorithm: RSA_SHA256 (default), RSA_SHA512 or ECDSA_SHA256. */
     public String signatureAlgorithm = "RSA_SHA256";
 
+    /**
+     * When true the signer puts the whole certification path in the wsse:BinarySecurityToken as an
+     * ASN.1 SEQUENCE OF Certificate (#X509PKIPathv1) instead of the leaf certificate alone
+     * (#X509v3), which is WSS4J's setUseSingleCertificate(false). Mirrors the PHP
+     * Outbound\Signature::withCertificatePath() opt-in so both emitters can be cross-tested.
+     */
+    public boolean signatureCertificatePath = false;
+
     /**
      * Keystore alias the signer uses. Defaults to the RSA java-server key; the ECDSA-SHA256 rows select the
      * EC leaf (ec-client) so the signature algorithm and key type agree.
@@ -100,6 +108,8 @@ public static ScenarioConfig fromProperties(Properties props) {
                 props.getProperty("signature.keyReference", config.signatureKeyReference).trim();
         config.signatureAlgorithm =
                 props.getProperty("signature.algorithm", config.signatureAlgorithm).trim();
+        config.signatureCertificatePath =
+                boolProp(props, "signature.certificatePath", config.signatureCertificatePath);
         config.canonicalization =
                 props.getProperty("signature.canonicalization", config.canonicalization).trim();
         config.dataEncryptionAlgorithm =

oracle/src/main/java/org/phpsoap/interop/Signer.java

@@ -72,6 +72,9 @@ String sign(String xml) throws Exception {
             signature.setSignatureAlgorithm(signatureAlgorithm(config.signatureAlgorithm));
             signature.setDigestAlgo(WSConstants.SHA256);
             signature.setSigCanonicalization(canonicalizationUri(config.canonicalization));
+            // A path token carries the leaf plus the CA certificates from the keystore entry, so a peer that
+            // will not complete the chain itself gets the intermediates handed to it.
+            signature.setUseSingleCertificate(!config.signatureCertificatePath);
 
             signature.getParts().add(
                     new WSEncryptionPart(WSConstants.ELEM_BODY, soapNamespace(document), "Content"));

tests/Support/Wsse.php

@@ -9,6 +9,7 @@
 use Soap\Psr18WsseMiddleware\Algorithm\SignatureMethod;
 use Soap\Psr18WsseMiddleware\KeyStore\Certificate;
 use Soap\Psr18WsseMiddleware\KeyStore\ClientCertificate;
+use Soap\Psr18WsseMiddleware\KeyStore\Pkcs12Bundle;
 use Soap\Psr18WsseMiddleware\WSSecurity\Outbound;
 use Soap\Psr18WsseMiddleware\WSSecurity\Part;
 use Soap\Psr18WsseMiddleware\WSSecurity\SecurityProfile;
@@ -28,6 +29,7 @@ final class Wsse
      * Sign the sample with the given knobs and return the signed XML.
      *
      * @param list<Part>|null $parts override the signed parts (default Body + Timestamp)
+     * @param bool $certificatePath advertise the whole certification path as a #X509PKIPathv1 token
      */
     public static function sign(
         ?SoapVersion $soapVersion = null,
@@ -39,11 +41,17 @@ public static function sign(
         ?string $inputXml = null,
         int $timestampTtl = 300,
         bool $inclusivePrefixes = false,
+        bool $certificatePath = false,
     ): string {
         $soapVersion ??= SoapVersion::Soap12;
         $document = Document::fromXmlString($inputXml ?? Oracle::sampleEnvelope());
         $context = new WsseContext($document, $soapVersion, new SecurityProfile());
-        $clientCertificate = ClientCertificate::fromFile($clientCertFile ?? Oracle::certPath('php-client.pem'));
+        // A certificate path comes from the PKCS#12 bundle, which is the only shipped material that carries the
+        // CA alongside the leaf; the PEM signing identity has no chain to offer.
+        $bundle = $certificatePath ? Pkcs12Bundle::fromFile(Oracle::certPath('php-client.p12'), 'changeit') : null;
+        $clientCertificate = $bundle !== null
+            ? ClientCertificate::fromPkcs12($bundle)
+            : ClientCertificate::fromFile($clientCertFile ?? Oracle::certPath('php-client.pem'));
 
         (new Outbound\Timestamp($timestampTtl))($context);
 
@@ -60,6 +68,9 @@ public static function sign(
         if ($inclusivePrefixes) {
             $signature = $signature->withInclusivePrefixes();
         }
+        if ($bundle !== null) {
+            $signature = $signature->withCertificatePath($bundle->chain);
+        }
         $signature($context);
 
         return $document->toXmlString();

tests/Wsse/SignatureInteropTest.php

@@ -43,6 +43,20 @@ public function test_php_signed_happy_flow_is_accepted_by_wss4j(): void
         self::assertJsonStringEqualsJsonString('{"valid":true}', $response['body']);
     }
 
+    public function test_php_signed_certificate_path_is_accepted_by_wss4j(): void
+    {
+        // The BinarySecurityToken carries the leaf and the CA as one ASN.1 SEQUENCE OF Certificate
+        // (#X509PKIPathv1) instead of the leaf alone. This row is what settles the byte order: our own reader
+        // derives the end-entity from issuer linkage and so accepts either direction, while WSS4J refuses a
+        // leaf-first path outright ("CA key usage check failed: keyCertSign bit is not set" -- it reads the
+        // first certificate as the issuer). Anchor first, as ITU-T X.509 defines a PkiPath, is what passes.
+        $signed = Wsse::sign(certificatePath: true);
+
+        $response = Oracle::post('/verify', $signed);
+
+        self::assertValid($response, 'WSS4J should verify a PHP signature advertising a certification path');
+    }
+
     public function test_php_signed_soap11_is_accepted_by_wss4j(): void
     {
         $signed = Wsse::sign(
@@ -129,6 +143,18 @@ public function test_wss4j_signed_ecdsa_sha256_is_accepted_by_php(): void
         $this->phpVerify($javaSigned, [Part::body(), Part::timestamp()]);
     }
 
+    public function test_wss4j_signed_certificate_path_is_accepted_by_php(): void
+    {
+        // WSS4J's own path emitter (setUseSingleCertificate(false)), so the inbound half is validated against a
+        // real peer's encoder rather than only against ours. It writes the order we write: the CA first, then
+        // the java-server leaf.
+        $javaSigned = Oracle::post('/sign?certpath=true', Oracle::sampleEnvelope())['body'];
+
+        $this->phpVerify($javaSigned, [Part::body(), Part::timestamp()]);
+
+        self::assertStringContainsString('X509PKIPathv1', $javaSigned);
+    }
+
     /**
      * @return iterable<string, array{string}>
      */