References the signing certificate from ds:KeyInfo via a wsse:SecurityTokenReference/wsse:KeyIdentifier, instead of embedding the certificate inline (x509Data) or via a separate wsse:BinarySecurityToken (securityTokenReference). With valueType=X509_V3 the certificate itself is embedded in the wsse:KeyIdentifier; with THUMBPRINT_SHA1 only its SHA-1 thumbprint is, and the verifier looks the matching certificate up in its truststore.
Syntax
keyIdentifier: valueType: x509_v3
keyIdentifier:
valueType: x509_v3
Attributes
Name
Required
Default
Description
Examples
valueType
false
X509_V3
Whether the wsse:KeyIdentifier carries the full certificate (X509_V3) or only its SHA-1 thumbprint (THUMBPRINT_SHA1), in which case the verifier resolves the certificate from its truststore instead of the message.