使用PFX证书签名XML验证失败：Referenced ID不在DOM文档中

你的问题核心源于XML规范化配置不匹配和签名后错误的重新计算逻辑，同时ID引用验证问题也与这两点直接相关。

1. 规范化方法缺失命名空间参数导致签名不匹配 #

接收方示例中使用的http://www.w3.org/2001/10/xml-exc-c14n#（排他XML规范化）带有ec:InclusiveNamespaces节点，明确指定了需要包含的命名空间前缀（wsa ns soapenv）。而你生成的签名缺少该节点，会导致：

• 签名生成时，规范化过程会排除这些前缀对应的命名空间
• 接收方验证时，会包含这些命名空间进行规范化，最终计算的摘要与签名值不匹配

修复方法：添加InclusiveNamespaces参数 #

在设置CanonicalizationMethod后，手动添加对应子节点：

// 替换原规范化方法设置代码
signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlExcC14NTransformUrl;

// 创建InclusiveNamespaces节点
XmlDocument doc = new XmlDocument();
XmlElement inclusiveNsElement = doc.CreateElement("ec", "InclusiveNamespaces", "http://www.w3.org/2001/10/xml-exc-c14n#");
inclusiveNsElement.SetAttribute("PrefixList", "wsa ns soapenv");

// 将节点导入并添加到CanonicalizationMethod中
XmlNamespaceManager nsManager = new XmlNamespaceManager(doc.NameTable);
nsManager.AddNamespace("ds", SignedXml.XmlDsigNamespaceUrl);
XmlNode canonicalizationNode = signedXml.SignedInfo.GetXml().SelectSingleNode("//ds:CanonicalizationMethod", nsManager);
if (canonicalizationNode != null)
{
    canonicalizationNode.AppendChild(signedXml.Document.ImportNode(inclusiveNsElement, true));
}

2. 签名后修改并重新计算的逻辑破坏签名有效性 #

你代码中存在严重错误：第一次ComputeSignature后修改签名元素ID，再重新加载并清空References后重新计算签名。这会导致第二次计算的签名未包含任何被引用的内容（References已清空），自然无法通过验证。

修复方法：移除错误逻辑，提前设置Signature ID #

应在签名前直接指定Signature的ID，而非签名后修改：

// 移除以下错误代码块：
// XmlElement signatureElement = signedXml.GetXml();
// signatureElement.SetAttribute("Id", "Signature-1");
// SetPrefix("ds", signatureElement);
// signedXml.LoadXml(signatureElement);
// signedXml.SignedInfo.References.Clear();
// signedXml.ComputeSignature();
// string recomputedSignature = Convert.ToBase64String(signedXml.SignatureValue);
// ReplaceSignature(signatureElement, recomputedSignature);

// 替换为：在ComputeSignature前设置Signature ID
signedXml.Signature.Id = "Signature-1";

// 直接计算签名
signedXml.ComputeSignature();

// 获取签名元素并设置前缀
XmlElement signatureElement = signedXml.GetXml();
SetPrefix("ds", signatureElement);

3. ID引用验证问题的补充排查 #

针对XML ValidatorBuddy提示的Referenced ID is not in DOM document，需额外确认：

• 自定义的SignedXmlWithId类是否正确重写了GetIdElement方法，以识别你使用的自定义ID属性（而非仅默认的xml:id）
• 加载XML时保持PreserveWhitespace = true，避免空格干扰ID属性的识别
• AddReferencesToSignedXml方法中，每个Reference的Uri是否正确指向DOM中存在的ID（格式应为#目标元素ID）

修复后的核心代码片段 #

public string SignSoapMessageVersion3(string soapRequest, X509Certificate2 certificate, RSA privateKey)
{
    if (privateKey == null)
    {
        MessageBox.Show("private key is null");
    }

    XmlDocument soapEnvelope = new XmlDocument();
    soapEnvelope.PreserveWhitespace = true;
    soapEnvelope.LoadXml(soapRequest);

    SignedXmlWithId signedXml = new SignedXmlWithId(soapEnvelope);
    signedXml.SigningKey = privateKey;

    AddReferencesToSignedXml(signedXml);
    KeyInfo keyInfo = AddKeyInfoPFX(certificate, soapEnvelope);
    signedXml.KeyInfo = keyInfo;

    // 配置规范化方法并添加InclusiveNamespaces
    signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlExcC14NTransformUrl;
    XmlDocument doc = new XmlDocument();
    XmlElement inclusiveNsElement = doc.CreateElement("ec", "InclusiveNamespaces", "http://www.w3.org/2001/10/xml-exc-c14n#");
    inclusiveNsElement.SetAttribute("PrefixList", "wsa ns soapenv");
    XmlNamespaceManager nsManager = new XmlNamespaceManager(doc.NameTable);
    nsManager.AddNamespace("ds", SignedXml.XmlDsigNamespaceUrl);
    XmlNode canonicalizationNode = signedXml.SignedInfo.GetXml().SelectSingleNode("//ds:CanonicalizationMethod", nsManager);
    if (canonicalizationNode != null)
    {
        canonicalizationNode.AppendChild(signedXml.Document.ImportNode(inclusiveNsElement, true));
    }

    signedXml.SignedInfo.SignatureMethod = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
    // 提前设置Signature ID
    signedXml.Signature.Id = "Signature-1";

    // 导出预签名XML用于调试
    string xmlBeforeSigning = soapEnvelope.OuterXml;
    string filePathBeforeSigning = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.MyDocuments), "soap_message_before_signing.xml");
    System.IO.File.WriteAllText(filePathBeforeSigning, xmlBeforeSigning);

    // 计算签名
    signedXml.ComputeSignature();

    XmlElement signatureElement = signedXml.GetXml();
    SetPrefix("ds", signatureElement);

    // 插入签名到SOAP信封
    InsertSignatureIntoEnvelope(soapEnvelope, signatureElement);

    // 生成最终签名后的XML
    string signedSoapRequest;
    using (MemoryStream memoryStream = new MemoryStream())
    using (StreamWriter streamWriter = new StreamWriter(memoryStream, Encoding.UTF8))
    {
        XmlTextWriter xmlTextWriter = new XmlTextWriter(streamWriter);
        soapEnvelope.WriteTo(xmlTextWriter);
        xmlTextWriter.Flush();
        signedSoapRequest = Encoding.UTF8.GetString(memoryStream.ToArray());
    }

    return signedSoapRequest;
}

验证建议 #

1. 对比生成的签名XML与接收方示例，确保CanonicalizationMethod节点结构完全一致
2. 用Chilkat重新验证，此时签名应显示为有效
3. 用XML ValidatorBuddy验证时，确认被引用的ID元素在DOM中存在且可被正确识别

内容的提问来源于stack exchange，提问作者Daan1986