Skip to main content

pki verify-sign

This command verifies whether the listed issuer has signed the listed issued certificate.

This command returns five fields of information:

  • signature_match: was the key of the issuer used to sign the issued.

  • path_match: the possible issuer appears in the valid certificate chain of the issued.

  • key_id_match: does the key id of the issuer match the key_id of the subject.

  • subject_match: does the subject name of the issuer match the issuer subject of the issued.

  • trust_match: if someone trusted the parent issuer, is the chain provided sufficient to trust the child issued.

Usage​

Usage: bao pki verify-sign <parent> <child>

  • <parent> is the fully name-spaced path to the issuer certificate which will be used to verify the <child> certificate

  • <child> is the fully name-spaced path to the potential child-certificate to be verified

A fully namespaced path looks like, for instance, 'ns1/mount1/issuer/issuerName/json'.

Example​

$ bao pki verify-sign pki_root/issuer/root pki_int/issuer/FirstDepartment
issuer:pki_root/issuer/root
issued:pki_int/issuer/FirstDepartment

field              value
-----              -----
subject_match      true
path_match         true
trust_match        true
key_id_match       true
signature_match    true