validatedocument | Keyfactor Docs

Use the SignClient validatedocument command to request a document to be validated:

validatedocument <-workername WORKERNAME | -workerid WORKERID> [options]

Command Options

Option	Description
`-accesstoken`	Access token to use for JWT authentication. Can only be used with HTTP protocol. Cannot be specified at the same time as `-username`.
`-data <arg>`	Data to send to the Worker.
`-host <arg>`	Server name or IP address. Default: `localhost`
`-infile <file>`	File from where data is read to send to the Worker.
`-keyalias <arg>`	Alias of the key in the keystore to use for authentication.
`-keystore <arg>`	Keystore with private key and certificate for client certificate authentication.
`-keystorepwd <arg>`	Password for reading the keystore. If `-keystore` is specified but not `-keystorepwd`, the CLI instead prompts for the password.
`-metadata <arg>`	Additional metadata to send to the Signer. The parameters should be given in the format `KEY=VALUE`. This option can be provided multiple times.
`-password <arg>`	Password for authentication. If `-username` is specified but not `-password`, the CLI instead prompts for the password.
`-port <arg>`	Server port. Default: `8080` (for HTTP), `8442` for HTTPS, and `8443` for HTTPS with client authentication.
`-protocol <arg>`	Method of interacting with SignServer: `HTTP` or `WEBSERVICES`. Default: `WEBSERVICES`.
`-servlet <arg>`	URL to the webservice servlet. Default: `/signserver/signserverws/signserverws?wsdl`
`-truststore <arg>`	Keystore with trusted certificates to use with HTTPS.
`-truststorepwd <arg>`	Password for the keystore with trusted certificates. If `-truststore` is specified but not `-truststorepwd`, the CLI instead prompts for the password.
`-username <arg>`	Username for authentication.
`-workerid <arg>`	ID of Worker performing the operation.
`-workername <arg>`	Name of Worker performing the operation.

Example Use Cases

Validate a Signed XML

You can validate a signed XML document passed directly as a string on the command line. Uses the default WEBSERVICES protocol. Practical for quick tests or small inline payloads.

validatedocument -workername XMLValidator -data "<root><Signature..."

You can also validate a signed XML file by providing its path:

 validatedocument -workername XMLValidator -infile /tmp/signed.xml

Validate with the Truststore

Connects over HTTPS and validates the server certificate using a truststore. The worker is identified by ID rather than name.

validatedocument -workerid 2 -infile /tmp/signed.xml -truststore truststore.jks -truststorepwd changeit

Validate with HTTP Protocol

Explicitly uses the HTTP protocol instead of the default WEBSERVICES. Useful in environments where the web services endpoint is unavailable or undesirable.

validatedocument -workername XMLValidator -protocol HTTP -infile /tmp/signed.xml

Validate with Additional Metadata

Passes additional key-value metadata to the validator alongside the document. Used when the Worker is configured to accept or require extra input parameters.

validatedocument -workername XMLValidator -infile /tmp/signed.xml -metadata param1=value1 -metadata param2=value2

Validate with Servlet URL Path

Targets a Worker directly through its servlet URL path using the HTTP protocol, rather than specifying -workername or -workerid. Useful in non-standard deployments or when constructing URLs programmatically.

validatedocument -data "<root><Signature..." -servlet /signserver/worker/XMLValidator -protocol HTTP