Caching in-app purchase receipt validation certificates

Question

In this documentation page, Microsoft recommends caching in-app purchase receipt validation certificates retrieved from their servers when performing receipt validation on the back-end. However, i think that some essential information is missing, namely:

• since each certificate is given by an ID specified in the receipt, how many certificates should we expect to exist? Would their cumulative size be prohibitive for in-memory caching only?
• cache invalidation: there doesn't seem to be any way to figure out if a certificate has been retired or has expired besides re-downloading the entire certificate, which then defeats the purpose of caching; can we thus expect that each certificate will always stay the same for all practical purposes, so once it's cached it never needs to be re-downloaded from MS servers?

I'd greatly appreciate if someone from Microsoft could officially clarify these aspects, otherwise caching seems to risky to use when validating those paid receipts.

Answer 1

Hi,

Regarding Cache Invalidation :

- the certificate has an expiration date you want to check the NotAfter property of X509Certificate2 (http://msdn.microsoft.com/en-us/library/system.security.cryptography.x509certificates.x509certificate2.aspx)

- the revocation of the certificate should be checked against CRL you want to check X509Chain.ChainPolicy.RevocationFlag and
 X509Chain.ChainPolicy.RevocationMode  (X509RevocationMode.Online)

http://msdn.microsoft.com/en-us/library/System.Security.Cryptography.X509Certificates.X509Chain.aspx

---

Cyprien Autexier

Answer 2

Hi,

Regarding Cache Invalidation :

- the certificate has an expiration date you want to check the NotAfter property of X509Certificate2 (http://msdn.microsoft.com/en-us/library/system.security.cryptography.x509certificates.x509certificate2.aspx)

- the revocation of the certificate should be checked against CRL you want to check X509Chain.ChainPolicy.RevocationFlag and
 X509Chain.ChainPolicy.RevocationMode  (X509RevocationMode.Online)

http://msdn.microsoft.com/en-us/library/System.Security.Cryptography.X509Certificates.X509Chain.aspx

---

Cyprien Autexier

I can't believe Microsoft issues certificates for IAP receipt validation which fail the X509Certificate2.Verify() method, i just tested it with the example receipt mentioned in the first post. So except the dates, there's nothing else relevant i can test, apparently. The certificate root doesn't seem to be trusted. Looks like i might as well use a forged certificate. Am i missing something?