Hi, so the JWS contains a chain of certificates (x509) in its x5c header. The first certificate contains the public key used to verify the signature of the JWS. What we need is a way to verify that the certificates are also trustworthy (i.e. signed by Apple and/or a trusted CA). You can find these certificates on their site https://www.apple.com/certificateauthority/.
All you need to do now is download them and, whenever you receive a JWS, validate them against the ones found in the x5c header. The site has both the intermediate and the root certificates. Good luck!
Topic:
App & System Services
SubTopic:
StoreKit
Tags: