refactor SAML2 metadata signature-filter to use a TrustStore implementation to get trusted X509 certificates

4 files changed, 142 insertions, 90 deletions

diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/api/utils/IPvp2CredentialProvider.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/api/utils/IPvp2CredentialProvider.java
index a564efb2..acd565a1 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/api/utils/IPvp2CredentialProvider.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/api/utils/IPvp2CredentialProvider.java
@@ -1,11 +1,14 @@
 package at.gv.egiz.eaaf.modules.pvp2.api.utils;
 
+import java.security.KeyStore;
+import java.security.Provider;
 import java.security.cert.X509Certificate;
 import java.util.List;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import at.gv.egiz.eaaf.core.impl.data.Pair;
 import at.gv.egiz.eaaf.modules.pvp2.api.credential.EaafX509Credential;
 import at.gv.egiz.eaaf.modules.pvp2.exception.CredentialsNotAvailableException;
 
@@ -51,5 +54,15 @@ public interface IPvp2CredentialProvider {
   @Nonnull
   List<X509Certificate> getTrustedCertificates()
       throws CredentialsNotAvailableException;
+  
+  
+  /**
+   * Get the {@link KeyStore} that is used in this {@link IPvp2CredentialProvider}.
+   * 
+   * @return KeyStore {@link Pair} of {@link KeyStore} and JCE {@link Provider} 
+   *     if a special provider is in use
+   */
+  @Nonnull
+  Pair<KeyStore, Provider> getKeyStore();
 
 }
\ No newline at end of file
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/utils/AbstractCredentialProvider.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/utils/AbstractCredentialProvider.java
index 26a5c5f6..e17e625e 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/utils/AbstractCredentialProvider.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/utils/AbstractCredentialProvider.java
@@ -32,6 +32,12 @@ import java.util.List;
 import javax.annotation.Nonnull;
 import javax.annotation.PostConstruct;
 
+import org.apache.commons.lang3.StringUtils;
+import org.apache.xml.security.algorithms.JCEMapper;
+import org.opensaml.security.credential.UsageType;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.io.ResourceLoader;
+
 import at.gv.egiz.eaaf.core.api.idp.IConfiguration;
 import at.gv.egiz.eaaf.core.exceptions.EaafConfigurationException;
 import at.gv.egiz.eaaf.core.exceptions.EaafException;
@@ -44,13 +50,6 @@ import at.gv.egiz.eaaf.modules.pvp2.api.utils.IPvp2CredentialProvider;
 import at.gv.egiz.eaaf.modules.pvp2.exception.CredentialsNotAvailableException;
 import at.gv.egiz.eaaf.modules.pvp2.exception.SamlSigningException;
 import at.gv.egiz.eaaf.modules.pvp2.impl.opensaml.EaafKeyStoreX509CredentialAdapter;
-
-import org.apache.commons.lang3.StringUtils;
-import org.apache.xml.security.algorithms.JCEMapper;
-import org.opensaml.security.credential.UsageType;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.core.io.ResourceLoader;
-
 import lombok.extern.slf4j.Slf4j;
 
 @Slf4j
@@ -256,6 +255,11 @@ public abstract class AbstractCredentialProvider implements IPvp2CredentialProvi
 
   }
 
+  public Pair<KeyStore, Provider> getKeyStore() {
+    return keyStore;
+    
+  }
+  
   @PostConstruct
   private void initialize() throws Exception {
     try {
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/SimpleMetadataSignatureVerificationFilter.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/SimpleMetadataSignatureVerificationFilter.java
index ef09e5c4..5a97924f 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/SimpleMetadataSignatureVerificationFilter.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/SimpleMetadataSignatureVerificationFilter.java
@@ -23,15 +23,14 @@
 
 package at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata;
 
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.List;
 
 import javax.annotation.Nonnull;
 
-import at.gv.egiz.eaaf.core.exceptions.EaafException;
-import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2MetadataException;
-import at.gv.egiz.eaaf.modules.pvp2.exception.SamlMetadataSignatureException;
-
 import org.opensaml.saml.common.SignableSAMLObject;
 import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
@@ -40,13 +39,18 @@ import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.xmlsec.signature.support.SignatureException;
 import org.opensaml.xmlsec.signature.support.SignatureValidator;
 
+import at.gv.egiz.eaaf.core.exceptions.EaafConfigurationException;
+import at.gv.egiz.eaaf.core.exceptions.EaafException;
+import at.gv.egiz.eaaf.core.impl.credential.EaafKeyStoreUtils;
+import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2MetadataException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.SamlMetadataSignatureException;
 import lombok.extern.slf4j.Slf4j;
 
 @Slf4j
 public class SimpleMetadataSignatureVerificationFilter extends AbstractMetadataSignatureFilter {
 
   private final String metadataUrl;
-  private final List<BasicX509Credential> trustedCredential = new ArrayList<>();
+  private final KeyStore trustedCredential;
 
   private static final String ERROR_07 = "internal.pvp.07";
   private static final String ERROR_12 = "internal.pvp.12";
@@ -61,13 +65,13 @@ public class SimpleMetadataSignatureVerificationFilter extends AbstractMetadataS
    * SAML2 metadata with {@link EntitiesDescriptor} <b>are not supported.</b>
    * </p>
    *
-   * @param credentials Trust X509 certificates
+   * @param keyStore TrustStore that contains trusted X509 certificates
    * @param metadataUrl Metadata URL for logging purposes
    */
-  public SimpleMetadataSignatureVerificationFilter(@Nonnull List<BasicX509Credential> credentials,
+  public SimpleMetadataSignatureVerificationFilter(@Nonnull KeyStore keyStore,
       @Nonnull String metadataUrl) {
     this.metadataUrl = metadataUrl;
-    this.trustedCredential.addAll(credentials);
+    this.trustedCredential = keyStore;
 
   }
 
@@ -121,7 +125,7 @@ public class SimpleMetadataSignatureVerificationFilter extends AbstractMetadataS
 
     // perform cryptographic signature verification
     boolean isTrusted = false;
-    for (final BasicX509Credential cred : trustedCredential) {
+    for (final BasicX509Credential cred : getTrustedCertificates()) {
       log.trace("Validating signature with credential: {} ... ",
           cred.getEntityCertificate().getSubjectDN());
       try {
@@ -140,7 +144,31 @@ public class SimpleMetadataSignatureVerificationFilter extends AbstractMetadataS
       throw new SamlMetadataSignatureException(metadataUrl, ERROR_MSG_SIGNOTVALID);
 
     }
+  }
+  
+  private List<BasicX509Credential> getTrustedCertificates() throws EaafConfigurationException {
+    try {
+      final List<X509Certificate> certs =
+          EaafKeyStoreUtils.readCertsFromKeyStore(trustedCredential);
+      if (certs.isEmpty()) {
+        log.warn("No trusted metadata-signing certificates in configuration");
+        throw new EaafConfigurationException("module.eidasauth.02",
+            new Object[] { "No trusted metadata-signing certificates" });
+
+      }
+
+      final List<BasicX509Credential> result = new ArrayList<>();
+      for (final X509Certificate cert : certs) {
+        result.add(new BasicX509Credential(cert));
 
+      }
+      return result;
+
+    } catch (final KeyStoreException e) {
+      throw new EaafConfigurationException("module.eidasauth.01",
+          new Object[] { "Trusted metadata-signing certificates", e.getMessage() }, e);
+
+    }
   }
 
 }
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/test/java/at/gv/egiz/eaaf/modules/pvp2/test/metadata/MetadataResolverTest.java b/eaaf_modules/eaaf_module_pvp2_core/src/test/java/at/gv/egiz/eaaf/modules/pvp2/test/metadata/MetadataResolverTest.java
index da417ec7..1cbc2f14 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/test/java/at/gv/egiz/eaaf/modules/pvp2/test/metadata/MetadataResolverTest.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/test/java/at/gv/egiz/eaaf/modules/pvp2/test/metadata/MetadataResolverTest.java
@@ -2,6 +2,9 @@ package at.gv.egiz.eaaf.modules.pvp2.test.metadata;
 
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
@@ -10,21 +13,6 @@ import java.util.List;
 
 import javax.xml.transform.TransformerException;
 
-import at.gv.egiz.eaaf.core.impl.http.IHttpClientFactory;
-import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IPvp2MetadataProvider;
-import at.gv.egiz.eaaf.modules.pvp2.exception.CredentialsNotAvailableException;
-import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2InternalErrorException;
-import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2MetadataException;
-import at.gv.egiz.eaaf.modules.pvp2.exception.SamlSigningException;
-import at.gv.egiz.eaaf.modules.pvp2.impl.metadata.PvpMetadataResolverFactory;
-import at.gv.egiz.eaaf.modules.pvp2.impl.opensaml.initialize.EaafOpenSaml3xInitializer;
-import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
-import at.gv.egiz.eaaf.modules.pvp2.impl.validation.TrustEngineFactory;
-import at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata.PvpEntityCategoryFilter;
-import at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata.SchemaValidationFilter;
-import at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata.SimpleMetadataSignatureVerificationFilter;
-import at.gv.egiz.eaaf.modules.pvp2.test.dummy.DummyCredentialProvider;
-
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang3.RandomStringUtils;
 import org.joda.time.DateTime;
@@ -68,6 +56,20 @@ import org.springframework.test.context.TestPropertySource;
 import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
 import org.w3c.dom.Element;
 
+import at.gv.egiz.eaaf.core.impl.http.IHttpClientFactory;
+import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IPvp2MetadataProvider;
+import at.gv.egiz.eaaf.modules.pvp2.exception.CredentialsNotAvailableException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2InternalErrorException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2MetadataException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.SamlSigningException;
+import at.gv.egiz.eaaf.modules.pvp2.impl.metadata.PvpMetadataResolverFactory;
+import at.gv.egiz.eaaf.modules.pvp2.impl.opensaml.initialize.EaafOpenSaml3xInitializer;
+import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
+import at.gv.egiz.eaaf.modules.pvp2.impl.validation.TrustEngineFactory;
+import at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata.PvpEntityCategoryFilter;
+import at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata.SchemaValidationFilter;
+import at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata.SimpleMetadataSignatureVerificationFilter;
+import at.gv.egiz.eaaf.modules.pvp2.test.dummy.DummyCredentialProvider;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
 import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -91,7 +93,8 @@ public class MetadataResolverTest {
   private PvpMetadataResolverFactory metadataResolverFactory;
   @Autowired
   private IHttpClientFactory httpClientFactory;
-  @Autowired private DummyCredentialProvider credentialProvider;
+  @Autowired
+  private DummyCredentialProvider credentialProvider;
 
   /**
    * JUnit class initializer.
@@ -183,16 +186,15 @@ public class MetadataResolverTest {
   }
 
   @Test
-  public void noCredentials() {
+  public void noCredentials() throws KeyStoreException {
     final String metadataUrl = "classpath:/data/pvp_metadata_moaid_test.xml";
 
-    final List<BasicX509Credential> credentials = new ArrayList<>();
-
+    final KeyStore keystore = KeyStore.getInstance("JKS");
     final List<MetadataFilter> filterList = new ArrayList<>();
     filterList.add(new SchemaValidationFilter(true));
 
     filterList.add(new SimpleMetadataSignatureVerificationFilter(
-        credentials,
+        keystore,
         metadataUrl));
 
     final MetadataFilterChain filterChain = new MetadataFilterChain();
@@ -212,20 +214,21 @@ public class MetadataResolverTest {
   }
 
   @Test
-  public void wrongCredentials() throws CertificateException {
+  public void wrongCredentials() throws CertificateException, KeyStoreException, NoSuchAlgorithmException, IOException {
     final String metadataUrl = "classpath:/data/pvp_metadata_moaid_test.xml";
 
-    final List<BasicX509Credential> credentials = new ArrayList<>();
+    final KeyStore keystore = KeyStore.getInstance("JKS");
+    keystore.load(null, "junit".toCharArray());
     final CertificateFactory fact = CertificateFactory.getInstance("X.509");
     final BasicX509Credential credential = new BasicX509Credential((X509Certificate) fact.generateCertificate(
         MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt")));
-    credentials.add(credential);
+    keystore.setCertificateEntry("1", credential.getEntityCertificate());
 
     final List<MetadataFilter> filterList = new ArrayList<>();
     filterList.add(new SchemaValidationFilter(true));
 
     filterList.add(new SimpleMetadataSignatureVerificationFilter(
-        credentials,
+        keystore,
         metadataUrl));
 
     final MetadataFilterChain filterChain = new MetadataFilterChain();
@@ -246,21 +249,22 @@ public class MetadataResolverTest {
 
   @Test
   public void validCredentialsInvalidSig() throws CertificateException, Pvp2MetadataException,
-      ResolverException {
+      ResolverException, KeyStoreException, NoSuchAlgorithmException, IOException {
     final String metadataUrl = "classpath:/data/pvp_metadata_moaid_test.xml";
 
-    final List<BasicX509Credential> credentials = new ArrayList<>();
+    final KeyStore keystore = KeyStore.getInstance("JKS");
+    keystore.load(null, "junit".toCharArray());
     final CertificateFactory fact = CertificateFactory.getInstance("X.509");
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt"))));
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/metadata_sig_cert.crt"))));
+    keystore.setCertificateEntry("1", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt")));
+    keystore.setCertificateEntry("2", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/metadata_sig_cert.crt")));
 
     final List<MetadataFilter> filterList = new ArrayList<>();
     filterList.add(new SchemaValidationFilter(true));
 
     filterList.add(new SimpleMetadataSignatureVerificationFilter(
-        credentials,
+        keystore,
         metadataUrl));
 
     final MetadataFilterChain filterChain = new MetadataFilterChain();
@@ -281,7 +285,8 @@ public class MetadataResolverTest {
   @Test
   public void metadataSignatureValidCredentials() throws CertificateException, Pvp2MetadataException,
       ResolverException, XMLParserException, UnmarshallingException, SamlSigningException,
-      CredentialsNotAvailableException, MarshallingException, TransformerException, IOException {
+      CredentialsNotAvailableException, MarshallingException, TransformerException, IOException,
+      KeyStoreException, NoSuchAlgorithmException {
 
     mockWebServer.shutdown();
     mockWebServer = new MockWebServer();
@@ -300,19 +305,20 @@ public class MetadataResolverTest {
         .setBody(SerializeSupport.nodeToString(metadataElement))
         .setHeader("Content-Type", "text/html;charset=utf-8"));
 
-    final List<BasicX509Credential> credentials = new ArrayList<>();
+    final KeyStore keystore = KeyStore.getInstance("JKS");
+    keystore.load(null, "junit".toCharArray());
     final CertificateFactory fact = CertificateFactory.getInstance("X.509");
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/metadata_sig_cert.crt"))));
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt"))));
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/junit_metadata_sig_cert.crt"))));
+    keystore.setCertificateEntry("1", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/metadata_sig_cert.crt")));
+    keystore.setCertificateEntry("2", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt")));
+    keystore.setCertificateEntry("3", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/junit_metadata_sig_cert.crt")));
 
     final List<MetadataFilter> filterList = new ArrayList<>();
     filterList.add(new SchemaValidationFilter(true));
     filterList.add(new SimpleMetadataSignatureVerificationFilter(
-        credentials,
+        keystore,
         mockServerUrl.url().toString()));
     filterList.add(new PvpEntityCategoryFilter(true));
 
@@ -332,7 +338,8 @@ public class MetadataResolverTest {
   @Test
   public void metadataSignatureValidCredentialsSecond() throws CertificateException, Pvp2MetadataException,
       ResolverException, XMLParserException, UnmarshallingException, SamlSigningException,
-      CredentialsNotAvailableException, MarshallingException, TransformerException, IOException {
+      CredentialsNotAvailableException, MarshallingException, TransformerException, IOException,
+      KeyStoreException, NoSuchAlgorithmException {
 
     final EntityDescriptor metadata = (EntityDescriptor) XMLObjectSupport.unmarshallFromInputStream(
         XMLObjectProviderRegistrySupport.getParserPool(),
@@ -347,19 +354,20 @@ public class MetadataResolverTest {
         .setBody(SerializeSupport.nodeToString(metadataElement))
         .setHeader("Content-Type", "text/html;charset=utf-8"));
 
-    final List<BasicX509Credential> credentials = new ArrayList<>();
+    final KeyStore keystore = KeyStore.getInstance("JKS");
+    keystore.load(null, "junit".toCharArray());
     final CertificateFactory fact = CertificateFactory.getInstance("X.509");
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/metadata_sig_cert.crt"))));
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt"))));
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/junit_metadata_sig_cert.crt"))));
+    keystore.setCertificateEntry("1", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/metadata_sig_cert.crt")));
+    keystore.setCertificateEntry("2", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt")));
+    keystore.setCertificateEntry("3", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/junit_metadata_sig_cert.crt")));
 
     final List<MetadataFilter> filterList = new ArrayList<>();
     filterList.add(new SchemaValidationFilter(true));
     filterList.add(new SimpleMetadataSignatureVerificationFilter(
-        credentials,
+        keystore,
         mockServerUrl.url().toString()));
     filterList.add(new PvpEntityCategoryFilter(true));
 
@@ -370,8 +378,6 @@ public class MetadataResolverTest {
         mockServerUrl.url().toString(),
         filterChain, "jUnit test", httpClientFactory.getHttpClient());
 
-
-
     final EntityDescriptor descr = mdResolver.getEntityDescriptor(metadata.getEntityID());
     Assert.assertNotNull("No EntityDescripter", descr);
 
@@ -385,11 +391,13 @@ public class MetadataResolverTest {
   @Test
   public void metadataSignatureValidCredentialsThird() throws CertificateException, Pvp2MetadataException,
       ResolverException, XMLParserException, UnmarshallingException, SamlSigningException,
-      CredentialsNotAvailableException, MarshallingException, TransformerException, IOException {
+      CredentialsNotAvailableException, MarshallingException, TransformerException, IOException,
+      KeyStoreException, NoSuchAlgorithmException {
 
     final EntityDescriptor metadata = (EntityDescriptor) XMLObjectSupport.unmarshallFromInputStream(
         XMLObjectProviderRegistrySupport.getParserPool(),
-        MetadataResolverTest.class.getResourceAsStream("/data/pvp_metadata_valid_with_entityCategory_egov.xml"));
+        MetadataResolverTest.class.getResourceAsStream(
+            "/data/pvp_metadata_valid_with_entityCategory_egov.xml"));
     metadata.setValidUntil(DateTime.now().plusDays(1));
     metadata.setSignature(null);
     metadata.setEntityID(RandomStringUtils.randomAlphabetic(10));
@@ -400,19 +408,20 @@ public class MetadataResolverTest {
         .setBody(SerializeSupport.nodeToString(metadataElement))
         .setHeader("Content-Type", "text/html;charset=utf-8"));
 
-    final List<BasicX509Credential> credentials = new ArrayList<>();
+    final KeyStore keystore = KeyStore.getInstance("JKS");
+    keystore.load(null, "junit".toCharArray());
     final CertificateFactory fact = CertificateFactory.getInstance("X.509");
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/metadata_sig_cert.crt"))));
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt"))));
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/junit_metadata_sig_cert.crt"))));
+    keystore.setCertificateEntry("1", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/metadata_sig_cert.crt")));
+    keystore.setCertificateEntry("2", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt")));
+    keystore.setCertificateEntry("3", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/junit_metadata_sig_cert.crt")));
 
     final List<MetadataFilter> filterList = new ArrayList<>();
     filterList.add(new SchemaValidationFilter(true));
     filterList.add(new SimpleMetadataSignatureVerificationFilter(
-        credentials,
+        keystore,
         mockServerUrl.url().toString()));
     filterList.add(new PvpEntityCategoryFilter(true));
 
@@ -423,8 +432,6 @@ public class MetadataResolverTest {
         mockServerUrl.url().toString(),
         filterChain, "jUnit test", httpClientFactory.getHttpClient());
 
-
-
     final EntityDescriptor descr = mdResolver.getEntityDescriptor(metadata.getEntityID());
     Assert.assertNotNull("No EntityDescripter", descr);
 
@@ -438,7 +445,8 @@ public class MetadataResolverTest {
   @Test
   public void metadataExpired() throws CertificateException, Pvp2MetadataException,
       ResolverException, XMLParserException, UnmarshallingException, SamlSigningException,
-      CredentialsNotAvailableException, MarshallingException, TransformerException, IOException {
+      CredentialsNotAvailableException, MarshallingException, TransformerException, IOException,
+      KeyStoreException, NoSuchAlgorithmException {
 
     final EntityDescriptor metadata = (EntityDescriptor) XMLObjectSupport.unmarshallFromInputStream(
         XMLObjectProviderRegistrySupport.getParserPool(),
@@ -452,24 +460,24 @@ public class MetadataResolverTest {
         .setBody(SerializeSupport.nodeToString(metadataElement))
         .setHeader("Content-Type", "text/html;charset=utf-8"));
 
-    final List<BasicX509Credential> credentials = new ArrayList<>();
+    final KeyStore keystore = KeyStore.getInstance("JKS");
+    keystore.load(null, "junit".toCharArray());
     final CertificateFactory fact = CertificateFactory.getInstance("X.509");
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/metadata_sig_cert.crt"))));
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt"))));
-    credentials.add(new BasicX509Credential((X509Certificate) fact.generateCertificate(
-        MetadataResolverTest.class.getResourceAsStream("/data/junit_metadata_sig_cert.crt"))));
+    keystore.setCertificateEntry("1", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/metadata_sig_cert.crt")));
+    keystore.setCertificateEntry("2", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/assertion_sig_cert.crt")));
+    keystore.setCertificateEntry("2", fact.generateCertificate(
+        MetadataResolverTest.class.getResourceAsStream("/data/junit_metadata_sig_cert.crt")));
 
     final List<MetadataFilter> filterList = new ArrayList<>();
     filterList.add(new SchemaValidationFilter(true));
     filterList.add(new SimpleMetadataSignatureVerificationFilter(
-        credentials,
+        keystore,
         mockServerUrl.url().toString()));
     filterList.add(new RequiredValidUntilFilter());
     filterList.add(new PvpEntityCategoryFilter(false));
 
-
     final MetadataFilterChain filterChain = new MetadataFilterChain();
     filterChain.setFilters(filterList);
 
@@ -484,7 +492,6 @@ public class MetadataResolverTest {
 
     }
 
-
   }
 
   @Test