SBI (L0) DeviceInfo/JWS validation fails with 403 Forbidden - Exception in trust root validation (x5c / certificate chain / what to sign)

Developer
1

Context / Setup

  • MOSIP server: 1.2.0.x (running on another machine for local testing)
  • Custom SBI service: Qt-based (implements discover / deviceInfo / rCapture)
  • Signing: RS256 JWS created manually using OpenSSL EVP APIs on Windows
  • Goal: Pass SBI signed-response validation during testing

What I did (per MOSIP “Mock Registration MDS” doc)

  1. Created a Device Partner in PMP.
  2. Used CA_CERT_UTILITY create-certs.sh to generate:
  • RootCA.cer, IntermediateCA.cer, Client.cer, Client.key
  1. Uploaded certs to PMP in order:
  • RootCA → IntermediateCA → Client
  1. In PMP, clicked “View Certificate” and copied the displayed certificate text into a file:
  • mosip-signed.crt (MOSIP-signed partner certificate shown by PMP)
  1. Generated device certificate/keystore:
  • Device.key, Device.csr, signed-Device.crt, Device.p12

My SBI signing attempts

  • I generate JWS with header like:
    • { "alg":"RS256", "typ":"JWT", "x5c":[ ... ] }
  • Tried these x5c variants:
    1. [ signed-Device.crt ]
    2. [ signed-Device.crt, mosip-signed.crt ]
    3. [ mosip-signed.crt ] and also tried signing with Client.key
  • Result in all cases: 403 Forbidden / Exception in trust root validation

Questions

  1. For SBI L0 testing, which key/certificate should be used to sign:
  • deviceInfo response JWT?
  • rCapture data JWT and the digitalId JWT inside the payload?
    Should it be Device private key or Partner/Client private key?
  1. What is the expected x5c content for MOSIP/RegClient validation?
  • Only mosip-signed.crt?
  • Device leaf (signed-Device.crt) + issuer (mosip-signed.crt)?
  • Full chain including MOSIP root/PMS certificates?
  1. Is it expected that the PMP “View Certificate” output (mosip-signed.crt) is issued by MOSIP PMS, and if so:
  • How does trust root validation succeed on the client side?
  • Does Registration Client sync the needed CA chain from master.ca_cert_store automatically?
  • Are restarts/sync steps required?
  1. For a local/test environment, what is the minimum required CA store content/configuration to avoid trust root validation failures?
2

Additionally, the ctk logs

2025-12-09 07:13:29,042 [http-nio-8099-exec-3] INFO [i.m.k.a.d.h.ValidateTokenHelper].getPublicKey.222 : offline verification for environment profile. UserName: test_1
2025-12-09 07:13:29,045 [http-nio-8099-exec-3] INFO [i.m.k.a.d.h.ValidateTokenHelper].buildMosipUser.299 : user (offline verification done): test_1
{“@timestamp”:“2025-12-09T07:13:29.063Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“c2097d2c69609dc0f8201b941e20ae30”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/getSbiProject/sbi31ca1147207b49e1aacabf7494097631”,“bytesSent”:600,“timeTaken”:0.024,“appName”:“compliance-toolkit-service”,“req.userAgent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36”,“req.xForwardedFor”:“172.17.0.2,10.42.0.0”,“req.referer”:“https://compliance.sandbox.test.mosip.net/",“req.method”:“GET”,“req.remoteHost”:"10.42.1.11”}
2025-12-09 07:13:29,075 [http-nio-8099-exec-6] INFO [i.m.k.a.d.h.ValidateTokenHelper].getPublicKey.222 : offline verification for environment profile. UserName: test_1
2025-12-09 07:13:29,077 [http-nio-8099-exec-6] INFO [i.m.k.a.d.h.ValidateTokenHelper].buildMosipUser.299 : user (offline verification done): test_1
{“@timestamp”:“2025-12-09T07:13:29.092Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“ae55cc7c55b36dd6f851b2d32cc82f80”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/getCollection/sbi26e73a2ae9654487ac0947cf48eaf38c”,“bytesSent”:403,“timeTaken”:0.019,“appName”:“compliance-toolkit-service”,“req.userAgent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36”,“req.xForwardedFor”:“172.17.0.2,10.42.0.0”,“req.referer”:“https://compliance.sandbox.test.mosip.net/",“req.method”:“GET”,“req.remoteHost”:"10.42.1.11”}
2025-12-09 07:13:29,112 [http-nio-8099-exec-5] INFO [i.m.k.a.d.h.ValidateTokenHelper].getPublicKey.222 : offline verification for environment profile. UserName: test_1
2025-12-09 07:13:29,115 [http-nio-8099-exec-5] INFO [i.m.k.a.d.h.ValidateTokenHelper].buildMosipUser.299 : user (offline verification done): test_1
{“@timestamp”:“2025-12-09T07:13:29.132Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“891e3b46b1bc9d50e21654a7cebc998d”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/getTestCasesForCollection/sbi26e73a2ae9654487ac0947cf48eaf38c”,“bytesSent”:1248,“timeTaken”:0.024,“appName”:“compliance-toolkit-service”,“req.userAgent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36”,“req.xForwardedFor”:“172.17.0.2,10.42.0.0”,“req.referer”:“https://compliance.sandbox.test.mosip.net/",“req.method”:“GET”,“req.remoteHost”:"10.42.1.11”}
2025-12-09 07:13:29,143 [http-nio-8099-exec-1] INFO [i.m.k.a.d.h.ValidateTokenHelper].getPublicKey.222 : offline verification for environment profile. UserName: test_1
2025-12-09 07:13:29,145 [http-nio-8099-exec-1] INFO [i.m.k.a.d.h.ValidateTokenHelper].buildMosipUser.299 : user (offline verification done): test_1
2025-12-09 07:13:29,149 [http-nio-8099-exec-1] INFO [i.m.k.l.l.i.Slf4jLoggerImpl].info.32 : sessionId - idType - id - addTestRunTestRunDto(id=null, collectionId=sbi26e73a2ae9654487ac0947cf48eaf38c, runDtimes=2025-12-09T07:13:26.112, executionDtimes=null, runConfigurationJson=null, executionStatus=null, runStatus=null)
2025-12-09 07:13:29,179 [http-nio-8099-exec-1] INFO [i.m.k.a.d.h.ValidateTokenHelper].buildMosipUser.299 : user (offline verification done): service-account-mosip-toolkit-client
2025-12-09 07:13:29,206 [http-nio-8099-exec-1] ERROR [i.m.k.l.l.i.Slf4jLoggerImpl].error.27 : sessionId - idType - id - In getOrgName method of ResourceCacheService401 Unauthorized
2025-12-09 07:13:29,207 [http-nio-8099-exec-1] INFO [i.m.k.l.l.i.Slf4jLoggerImpl].info.32 : sessionId - idType - id - Orgname could not be fetched from PartnerManagerHelper,returning default value.
2025-12-09 07:13:29,261 [http-nio-8099-exec-1] INFO [i.m.k.l.l.i.Slf4jLoggerImpl].info.32 : sessionId - idType - id - outputEntityTestRunEntity(id=sbi263148ea92561c48e1b7d8f5d2ee7351e, collectionId=sbi26e73a2ae9654487ac0947cf48eaf38c, runDtimes=2025-12-09T07:13:26.112, executionDtimes=null, runConfigurationJson=null, partnerId=test_1, orgName=Not_Available, executionStatus=incomplete, runStatus=failure, crBy=ts1316@cmi-tech.com, crDtimes=2025-12-09T07:13:29.208306, updBy=null, updDtimes=null, isDeleted=false, delTime=null)
{“@timestamp”:“2025-12-09T07:13:29.265Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“fe5c9cd670dcf593b3519e569efd5e4a”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/addTestRun”,“bytesSent”:384,“timeTaken”:0.124,“appName”:“compliance-toolkit-service”,“req.userAgent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36”,“req.xForwardedFor”:“172.17.0.2,10.42.0.0”,“req.referer”:“https://compliance.sandbox.test.mosip.net/",“req.method”:“POST”,“req.remoteHost”:"10.42.1.11”}
2025-12-09 07:13:29,288 [http-nio-8099-exec-9] INFO [i.m.k.a.d.h.ValidateTokenHelper].getPublicKey.222 : offline verification for environment profile. UserName: test_1
2025-12-09 07:13:29,292 [http-nio-8099-exec-9] INFO [i.m.k.a.d.h.ValidateTokenHelper].buildMosipUser.299 : user (offline verification done): test_1
2025-12-09 07:13:29,302 [http-nio-8099-exec-9] INFO [i.m.k.l.l.i.Slf4jLoggerImpl].info.32 : sessionId - idType - id - JSON is as expected. All mandatory values are available and they all have valid expected values.
{“@timestamp”:“2025-12-09T07:13:29.304Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“41ae47bed0dd15a34b92dde0cc62414e”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/validateRequest”,“bytesSent”:422,“timeTaken”:0.018,“appName”:“compliance-toolkit-service”,“req.userAgent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36”,“req.xForwardedFor”:“172.17.0.2,10.0.2.14”,“req.referer”:“https://compliance.sandbox.test.mosip.net/",“req.method”:“POST”,“req.remoteHost”:"10.42.1.11”}
2025-12-09 07:13:29,333 [http-nio-8099-exec-4] INFO [i.m.k.a.d.h.ValidateTokenHelper].getPublicKey.222 : offline verification for environment profile. UserName: test_1
2025-12-09 07:13:29,335 [http-nio-8099-exec-4] INFO [i.m.k.a.d.h.ValidateTokenHelper].buildMosipUser.299 : user (offline verification done): test_1
2025-12-09 07:13:29,342 [http-nio-8099-exec-4] INFO [i.m.k.l.l.i.Slf4jLoggerImpl].info.32 : sessionId - idType - id - JSON is as expected. All mandatory values are available and they all have valid expected values.
2025-12-09 07:13:29,344 [http-nio-8099-exec-4] ERROR [i.m.k.l.l.i.Slf4jLoggerImpl].error.27 : sessionId - idType - id - In SBIValidator - Illegal base64 character 2e
2025-12-09 07:13:29,383 [http-nio-8099-exec-4] ERROR [i.m.k.l.l.i.Slf4jLoggerImpl].error.27 : sessionId - idType - id - In SignatureValidator - 403 Forbidden
{“@timestamp”:“2025-12-09T07:13:29.385Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“fc535693149497b43df34ff5eebe220f”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/validateResponse”,“bytesSent”:734,“timeTaken”:0.054,“appName”:“compliance-toolkit-service”,“req.userAgent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36”,“req.xForwardedFor”:“172.17.0.2,10.0.2.14”,“req.referer”:“https://compliance.sandbox.test.mosip.net/",“req.method”:“POST”,“req.remoteHost”:"10.42.1.11”}
2025-12-09 07:13:29,399 [http-nio-8099-exec-8] INFO [i.m.k.a.d.h.ValidateTokenHelper].getPublicKey.222 : offline verification for environment profile. UserName: test_1
2025-12-09 07:13:29,400 [http-nio-8099-exec-8] INFO [i.m.k.a.d.h.ValidateTokenHelper].buildMosipUser.299 : user (offline verification done): test_1
2025-12-09 07:13:29,427 [http-nio-8099-exec-8] INFO [i.m.k.a.d.h.ValidateTokenHelper].buildMosipUser.299 : user (offline verification done): service-account-mosip-toolkit-client
2025-12-09 07:13:29,452 [http-nio-8099-exec-8] ERROR [i.m.k.l.l.i.Slf4jLoggerImpl].error.27 : sessionId - idType - id - In getOrgName method of ResourceCacheService401 Unauthorized
2025-12-09 07:13:29,452 [http-nio-8099-exec-8] INFO [i.m.k.l.l.i.Slf4jLoggerImpl].info.32 : sessionId - idType - id - Orgname could not be fetched from PartnerManagerHelper,returning default value.
{“@timestamp”:“2025-12-09T07:13:29.478Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“43403dd268ce0809d0d2f4eb432a31bc”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/addTestRunDetails”,“bytesSent”:30534,“timeTaken”:0.082,“appName”:“compliance-toolkit-service”,“req.userAgent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36”,“req.xForwardedFor”:“172.17.0.2,10.42.0.0”,“req.referer”:“https://compliance.sandbox.test.mosip.net/",“req.method”:“POST”,“req.remoteHost”:"10.42.1.11”}
2025-12-09 07:13:29,492 [http-nio-8099-exec-7] INFO [i.m.k.a.d.h.ValidateTokenHelper].getPublicKey.222 : offline verification for environment profile. UserName: test_1
2025-12-09 07:13:29,494 [http-nio-8099-exec-7] INFO [i.m.k.a.d.h.ValidateTokenHelper].buildMosipUser.299 : user (offline verification done): test_1
{“@timestamp”:“2025-12-09T07:13:29.506Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“dd05f02cb750f0064457ab82f97ca6c2”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/updateTestRun”,“bytesSent”:406,“timeTaken”:0.016,“appName”:“compliance-toolkit-service”,“req.userAgent”:“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36”,“req.xForwardedFor”:“172.17.0.2,10.42.0.0”,“req.referer”:“https://compliance.sandbox.test.mosip.net/",“req.method”:“PUT”,“req.remoteHost”:"10.42.1.11”}
2025-12-09 07:13:33,099 [http-nio-8099-exec-10] INFO [i.m.k.a.d.f.CorsFilter].doFilterInternal.44 : origin null
2025-12-09 07:13:33,099 [http-nio-8099-exec-2] INFO [i.m.k.a.d.f.CorsFilter].doFilterInternal.44 : origin null
2025-12-09 07:13:33,099 [http-nio-8099-exec-10] INFO [i.m.k.a.d.f.CorsFilter].doFilterInternal.45 : requesturl http://10.42.1.138:8099/v1/toolkit/actuator/health
2025-12-09 07:13:33,099 [http-nio-8099-exec-2] INFO [i.m.k.a.d.f.CorsFilter].doFilterInternal.45 : requesturl http://10.42.1.138:8099/v1/toolkit/actuator/health
{“@timestamp”:“2025-12-09T07:13:33.104Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“-”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/actuator/health”,“bytesSent”:487,“timeTaken”:0.006,“appName”:“compliance-toolkit-service”,“req.userAgent”:“kube-probe/1.22”,“req.xForwardedFor”:“-”,“req.referer”:“-”,“req.method”:“GET”,“req.remoteHost”:“10.0.2.14”}
{“@timestamp”:“2025-12-09T07:13:33.104Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“-”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/actuator/health”,“bytesSent”:487,“timeTaken”:0.006,“appName”:“compliance-toolkit-service”,“req.userAgent”:“kube-probe/1.22”,“req.xForwardedFor”:“-”,“req.referer”:“-”,“req.method”:“GET”,“req.remoteHost”:“10.0.2.14”}
2025-12-09 07:13:35,594 [http-nio-8099-exec-3] INFO [i.m.k.a.d.f.CorsFilter].doFilterInternal.44 : origin null
2025-12-09 07:13:35,595 [http-nio-8099-exec-3] INFO [i.m.k.a.d.f.CorsFilter].doFilterInternal.45 : requesturl http://10.42.1.138:8099/v1/toolkit/actuator/prometheus
{“@timestamp”:“2025-12-09T07:13:35.601Z”,“level”:“ACCESS”,“level_value”:70000,“traceId”:“-”,“statusCode”:200,“req.requestURI”:“/v1/toolkit/actuator/prometheus”,“bytesSent”:21705,“timeTaken”:0.008,“appName”:“compliance-toolkit-service”,“req.userAgent”:“Prometheus/2.38.0”,“req.xForwardedFor”:“-”,“req.referer”:“-”,“req.method”:“GET”,“req.remoteHost”:“10.42.1.77”}

3

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.