Names a certificate from ds:KeyInfo via a wsse:SecurityTokenReference/wsse:KeyIdentifier, rather than embedding it inline the way signature's x509Data does. Under signature that is the signing certificate the receiver verifies with; under encrypt it is the recipient's certificate, telling the receiver which of its own keys decrypts the message, and it is the only key-info mode there. With valueType=X509_V3 the certificate itself is embedded in the wsse:KeyIdentifier; with THUMBPRINT_SHA1 only its SHA-1 thumbprint is, and the receiver looks the matching certificate up in its own store.
Syntax
keyIdentifier: valueType: x509_v3
keyIdentifier:
valueType: x509_v3
Attributes
Name
Required
Default
Description
Examples
valueType
false
-
Whether the wsse:KeyIdentifier carries the full certificate (X509_V3) or only its SHA-1 thumbprint (THUMBPRINT_SHA1), in which case the receiver resolves the certificate from its own store instead of the message. When omitted, signature uses X509_V3 and encrypt uses THUMBPRINT_SHA1.
