Certificate dependency tree
SuperOffice Online Root Certificate Authority (CA) is the root container for all SuperOffice Online certificates.
Environmental certificates establish a trust for their environment of responsibility: Development, stage, or production. Each environmental certificate depends on the SuperOffice Online Root CA and cannot be used without it.
At the lowest level, the subject certificates establish trust for each environment’s login services.
- each environmental certificate has a dependency on each federated login certificate
- each federated login certificate depends on its corresponding environmental certificate
Supported trust types
There are 3 main types of certificate trust:- Chain
- Peer
- None
PeerTrust
TheSuperIdTokenHandler class is responsible for validating security tokens. By default, the handler is configured to use PeerTrust.
- The handler looks up the source certificate thumbprint in the application settings.
-
The handler tries to find a certificate with a matching thumbprint in the Trusted People certificate store of the local computer. The source thumbprint must be defined in the application configuration settings.
-
If a match is found, the next step is to validate the certificate.
If no certificate with a matching thumbprint is found, the ID4037 exception is thrown:
"ID4037: The key needed to verify the signature could not be resolved from the following security key identifier 'SecurityKeyIdentifier."This means that no certificate with a matching thumbprint was found. The only known reasons this might happen are:- The certificates are not configured correctly.
- There are hidden characters in the value field - such as an ”” character.
If you deploy your application in a restricted environment where you don’t have access to the certificate store, such as Azure or similar, you can override the default resolver to validate the JWT security token directly instead.