| === SMIMECheckSignature |
| |
| Verifies the s/mime signature of a message. The s/mime signing ensure that |
| the private key owner is the real sender of the message. To be checked by |
| this mailet the s/mime signature must contain the actual signature, the |
| signer's certificate and optionally a set of certificate that can be used to |
| create a chain of trust that starts from the signer's certificate and leads |
| to a known trusted certificate. |
| |
| This check is composed by two steps: firstly it's ensured that the signature |
| is valid, then it's checked if a chain of trust starting from the signer |
| certificate and that leads to a trusted certificate can be created. The first |
| check verifies that the the message has not been modified after the signature |
| was put and that the signer's certificate was valid at the time of the |
| signing. The latter should ensure that the signer is who he declare to be. |
| |
| The results of the checks perfomed by this mailet are wrote as a mail |
| attribute which default name is org.apache.james.SMIMECheckSignature (it can |
| be changed using the mailet parameter *mailAttribute*). After |
| the check this attribute will contain a list of SMIMESignerInfo object, one |
| for each message's signer. These objects contain the signer's certificate and |
| the trust path. |
| |
| Optionally, specifying the parameter *strip*, the signature of |
| the message can be stripped after the check. The message will become a |
| standard message without an attached s/mime signature. |
| |
| The configuration parameter of this mailet are summerized below. The firsts |
| defines the location, the format and the password of the keystore containing |
| the certificates that are considered trusted. Note: only the trusted certificate |
| entries are read, the key ones are not. |
| |
| |
| * keyStoreType (default: jks): Certificate store format . "jks" is the |
| standard java certificate store format, but pkcs12 is also quite common and |
| compatible with standard email clients like Outlook Express and Thunderbird. |
| * keyStoreFileName (default: JAVA_HOME/jre/lib/security/cacert): Certificate |
| store path. |
| * keyStorePassword (default: ""): Certificate store password. |
| |
| Other parameters configure the behavior of the mailet: |
| |
| * strip (default: false): Defines if the s/mime signature of the message |
| have to be stripped after the check or not. Possible values are true and |
| false. |
| * mailAttribute (default: org.apache.james.SMIMECheckSignature): |
| specifies in which attribute the check results will be written. |
| * onlyTrusted (default: true): Usually a message signature to be |
| considered by this mailet as authentic must be valid and trusted. Setting |
| this mailet parameter to "false" the last condition is relaxed and also |
| "untrusted" signature are considered will be considered as authentic. |
