Index: java/Regression.java
===================================================================
--- java/Regression.java	(revision 3a83fda45171c7785cdc30c073a4e1f2054a4b84)
+++ java/Regression.java	(revision 8f53997044b3e64696cc69adf4e820ef89f7ea7a)
@@ -18,4 +18,5 @@
 	new ReadCreds("e0-check-x509.der", "Acme-check-x509.pem", 1),
 	new ReadCreds("priv.xml", "issuer.pem", 6),
+	new ReadCreds("not_ss.xml", "not_ss.pem", 1),
 	new RocketsTest("Rockets test"),
 	new ExperimentTest("Experiment test"),
Index: java/net/deterlab/abac/Identity.java
===================================================================
--- java/net/deterlab/abac/Identity.java	(revision 3a83fda45171c7785cdc30c073a4e1f2054a4b84)
+++ java/net/deterlab/abac/Identity.java	(revision 8f53997044b3e64696cc69adf4e820ef89f7ea7a)
@@ -101,4 +101,11 @@
 	    throw new CertInvalidException(e.getMessage(), e);
 	}
+	catch (InvalidKeyException e) {
+	    // XXX: the cert is not signed by the key we provided.  Right now
+	    // we check each cert as if it were self-signed. Other signing
+	    // strategies are allowed here by default.  We expect outside
+	    // sources to validate ID certs if they expect different chains of
+	    // trust.
+	}
 	catch (GeneralSecurityException e) {
 	    throw new ABACException(e.getMessage(), e);
Index: java/regression/not_ss.pem
===================================================================
--- java/regression/not_ss.pem	(revision 8f53997044b3e64696cc69adf4e820ef89f7ea7a)
+++ java/regression/not_ss.pem	(revision 8f53997044b3e64696cc69adf4e820ef89f7ea7a)
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC+DCCAmECAg2pMA0GCSqGSIb3DQEBBAUAMIHRMQswCQYDVQQGEwJVUzETMBEG
+A1UECBMKQ2FsaWZvcm5pYTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxJzAlBgNV
+BAoTHkRFVEVSIE5ldHdvcmsgU2VjdXJpdHkgVGVzdGJlZDEeMBwGA1UECxMVQ2Vy
+dGlmaWNhdGUgQXV0aG9yaXR5MR4wHAYDVQQDExVib3NzLmlzaS5kZXRlcmxhYi5u
+ZXQxKzApBgkqhkiG9w0BCQEWHHRlc3RiZWQtb3BzQGlzaS5kZXRlcmxhYi5uZXQw
+HhcNMTAxMTA1MjIzNTEyWhcNMTMwODAxMjIzNTEyWjCBtTELMAkGA1UEBhMCVVMx
+EzARBgNVBAgTCkNhbGlmb3JuaWExJzAlBgNVBAoTHkRFVEVSIE5ldHdvcmsgU2Vj
+dXJpdHkgVGVzdGJlZDESMBAGA1UECxMJc3NseG1scnBjMS0wKwYDVQQDEyQ3MGY0
+ZGI1Yy1jN2Y1LTExZGMtYTIwNC0wMDA0MjNjMjhlNzYxJTAjBgkqhkiG9w0BCQEW
+FmZhYmVyQGlzaS5kZXRlcmxhYi5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBAPfkJKdY9YBblX5WbiEjdNOQuLgLmAMif57VQ+LVk505dihLgkZc25qQTJOQ
+16sWFqLrl04334kMHzDmLn74/af5rxDxipSc+fxXd3WNX20NnIP0XJFl+IpAt+me
+G5ksmisLOwD7Iw7upbgB9oIBV16ByFHo9I5uyqQ00SN5FvjVAgMBAAEwDQYJKoZI
+hvcNAQEEBQADgYEAjGn3aZtem7Me+uGpPw6xEs8pwd3EtJ9yLofr2EMOkUKYNTHL
+fVV8cqybBCYF+RH8UYZPk3oIYH0XCfa1dzEeOcEBmYqlhcDgM8Y0Wpfh5t590ScI
+h7nN7kzGIN0wpUG6sASNqQdXA8YxwpPE/XjLrE0QKT69bU2rZnBGqSYcpzY=
+-----END CERTIFICATE-----
Index: java/regression/not_ss.xml
===================================================================
--- java/regression/not_ss.xml	(revision 8f53997044b3e64696cc69adf4e820ef89f7ea7a)
+++ java/regression/not_ss.xml	(revision 8f53997044b3e64696cc69adf4e820ef89f7ea7a)
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<signed-credential>
+    <credential xml:id="ref0">
+	<type>abac</type>
+	<version>1.0</version>
+	<expires>2014-05-20T17:39:55Z</expires>
+	<rt0>0a778934b93d546406d195d18e4f208af11ea84a.test_attr&lt;-633aadf1753647ba60f28b7310f5a56cd32ab7e2</rt0>
+    </credential>
+    <signatures>
+	<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
+	    <SignedInfo>
+		<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+		<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+		<Reference URI="#ref0">
+		    <Transforms>
+			<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+		    </Transforms>
+		    <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+		    <DigestValue>PZhnlEVuQz0AEHrBFzEcuefhWB8=</DigestValue>
+		</Reference>
+	    </SignedInfo>
+	    <SignatureValue>wYIkXgDSnzeTVu/Cc2C2W5bib6w0SVzZcKSabls47Qr6rJMdNUKrO3YOV8fcHrbT
+9wsCrEq2v2d8kuueuzSjzXvZrgBBfXrMe83Z427F0todl5/IhQTgXtKyhYsKZEvU
+5C50FVKSs/spKCqcO95TYtzEZEAu6yCJV/Oa59TYt/4=</SignatureValue>
+	    <KeyInfo>
+	      <KeyValue>
+<RSAKeyValue>
+<Modulus>
+9+Qkp1j1gFuVflZuISN005C4uAuYAyJ/ntVD4tWTnTl2KEuCRlzbmpBMk5DXqxYW
+ouuXTjffiQwfMOYufvj9p/mvEPGKlJz5/Fd3dY1fbQ2cg/RckWX4ikC36Z4bmSya
+Kws7APsjDu6luAH2ggFXXoHIUej0jm7KpDTRI3kW+NU=
+</Modulus>
+<Exponent>
+AQAB
+</Exponent>
+</RSAKeyValue>
+</KeyValue>
+		<X509Data>
+		    
+		    
+		    
+		<X509Certificate>MIIC+DCCAmECAg2pMA0GCSqGSIb3DQEBBAUAMIHRMQswCQYDVQQGEwJVUzETMBEG
+A1UECBMKQ2FsaWZvcm5pYTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxJzAlBgNV
+BAoTHkRFVEVSIE5ldHdvcmsgU2VjdXJpdHkgVGVzdGJlZDEeMBwGA1UECxMVQ2Vy
+dGlmaWNhdGUgQXV0aG9yaXR5MR4wHAYDVQQDExVib3NzLmlzaS5kZXRlcmxhYi5u
+ZXQxKzApBgkqhkiG9w0BCQEWHHRlc3RiZWQtb3BzQGlzaS5kZXRlcmxhYi5uZXQw
+HhcNMTAxMTA1MjIzNTEyWhcNMTMwODAxMjIzNTEyWjCBtTELMAkGA1UEBhMCVVMx
+EzARBgNVBAgTCkNhbGlmb3JuaWExJzAlBgNVBAoTHkRFVEVSIE5ldHdvcmsgU2Vj
+dXJpdHkgVGVzdGJlZDESMBAGA1UECxMJc3NseG1scnBjMS0wKwYDVQQDEyQ3MGY0
+ZGI1Yy1jN2Y1LTExZGMtYTIwNC0wMDA0MjNjMjhlNzYxJTAjBgkqhkiG9w0BCQEW
+FmZhYmVyQGlzaS5kZXRlcmxhYi5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBAPfkJKdY9YBblX5WbiEjdNOQuLgLmAMif57VQ+LVk505dihLgkZc25qQTJOQ
+16sWFqLrl04334kMHzDmLn74/af5rxDxipSc+fxXd3WNX20NnIP0XJFl+IpAt+me
+G5ksmisLOwD7Iw7upbgB9oIBV16ByFHo9I5uyqQ00SN5FvjVAgMBAAEwDQYJKoZI
+hvcNAQEEBQADgYEAjGn3aZtem7Me+uGpPw6xEs8pwd3EtJ9yLofr2EMOkUKYNTHL
+fVV8cqybBCYF+RH8UYZPk3oIYH0XCfa1dzEeOcEBmYqlhcDgM8Y0Wpfh5t590ScI
+h7nN7kzGIN0wpUG6sASNqQdXA8YxwpPE/XjLrE0QKT69bU2rZnBGqSYcpzY=</X509Certificate>
+<X509SubjectName>emailAddress=faber@isi.deterlab.net,CN=70f4db5c-c7f5-11dc-a204-000423c28e76,OU=sslxmlrpc,O=DETER Network Security Testbed,ST=California,C=US</X509SubjectName>
+<X509IssuerSerial>
+<X509IssuerName>emailAddress=testbed-ops@isi.deterlab.net,CN=boss.isi.deterlab.net,OU=Certificate Authority,O=DETER Network Security Testbed,L=Marina del Rey,ST=California,C=US</X509IssuerName>
+<X509SerialNumber>3497</X509SerialNumber>
+</X509IssuerSerial>
+</X509Data>
+	    </KeyInfo>
+	</Signature>
+    </signatures>
+</signed-credential>
