# Recommendations JWS and x5c / X.509 certificate chains?

**URL:** <https://forums.swift.org/t/recommendations-jws-and-x5c-x-509-certificate-chains/58163>\
**Category:** Vapor\
**Tags:** vapor, server\
**Created:** [June 15, 2022, 9:44pm UTC](https://forums.swift.org/t/recommendations-jws-and-x5c-x-509-certificate-chains/58163 "2022-06-15T21:44:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![willft](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/willft/32/412_2.png) [@willft](https://forums.swift.org/u/willft)\
**Post date:** [June 15, 2022, 9:44pm UTC](https://forums.swift.org/t/recommendations-jws-and-x5c-x-509-certificate-chains/58163/1 "2022-06-15T21:44:13Z")

</div>

Are there any well known packages which provide support for verifying X.509 certificate chains? Specifically I’m looking to verify a JWS which has an `x5c` header. Any packages which support JWS decoding would also be very much appreciated!

I'm looking to build a Vapor-based server which runs on a Linux machine (first time with Vapor!) so the packages will need to support that.

For context: My initial use-case is for Apple's StoreKit 2 ([Apple Developer Documentation](https://developer.apple.com/documentation/appstoreserverapi/jwsdecodedheader)) transactions + notifications.

---

<div class="post-metadata">

**Author:** ![0xTim](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/0xtim/32/27968_2.png) [@0xTim](https://forums.swift.org/u/0xTim)\
**Post date:** [June 24, 2022, 3:06pm UTC](https://forums.swift.org/t/recommendations-jws-and-x5c-x-509-certificate-chains/58163/2 "2022-06-24T15:06:39Z")

</div>

I've spiked this in JWTKit. The code isn't pretty but it works. You can have a look at the PR at [Add JWS Support by 0xTim · Pull Request #75 · vapor/jwt-kit · GitHub](https://github.com/vapor/jwt-kit/pull/75)

If you add a dependency on JWTKit to use that branch, you can then use it something like:

```swift
struct Payload: JWTPayload {
    func verify(using signer: JWTSigner) throws {}
    let quantity: Int
    let productId: String
}
let receipt: Payload
do {
    receipt = try req.application.jwt.signers.verifyJWSWithX5C(receiptData.receiptData, as: Payload.self, rootCert: appleRootCert)
} catch {
    // If we failed, try the test store cert
    do {
        receipt = try req.application.jwt.signers.verifyJWSWithX5C(receiptData.receiptData, as: Payload.self, rootCert: testStoreCert)
    } catch {
        throw Abort(.badRequest, reason: "Token was invalid")
    }
}

```

---

<div class="post-metadata">

**Author:** ![willft](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/willft/32/412_2.png) [@willft](https://forums.swift.org/u/willft)\
**Post date:** [June 24, 2022, 4:04pm UTC](https://forums.swift.org/t/recommendations-jws-and-x5c-x-509-certificate-chains/58163/3 "2022-06-24T16:04:23Z")

</div>

@0xTim This is beyond awesome. Thank you so much!

I had to put this off due to the lack of a good library for this stuff. Now that this exists, I'll be able to put it on the docket for the next sprint in about 2 weeks. I'll let you know how it goes.

---

<div class="post-metadata">

**Author:** ![jsam](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@jsam](https://forums.swift.org/u/jsam)\
**Post date:** [May 1, 2023, 11:38pm UTC](https://forums.swift.org/t/recommendations-jws-and-x5c-x-509-certificate-chains/58163/4 "2023-05-01T23:38:14Z")

</div>

For those interested in a solution using the jwt-kit version 4.9.0 which merged in the discussed changes after some modifications, I came up with the following for validating App Store notification payloads:

```swift
let appleRootCertString = """
-----BEGIN CERTIFICATE-----
MIICQzCCAcmgAw...
6BgD56KyKA==
-----END CERTIFICATE-----
"""
let notification = try req.content.decode(SKSignedPayload.self)
let x5cVerifier = try X5CVerifier(rootCertificates: [appleRootCertString])
let payload = try x5cVerifier.verifyJWS(notification.signedPayload, as: SKNotificationPayload.self)

```

Thank you @0xTim and @willft for putting in the work to get this PR merged.