CoseX5ChainMissing Error with mail adress in DN

[pleberer]

Environment

• c2patool version: 0.19.0
• Platform: macOS (Darwin 24.5.0)
• Certificate type: Certum S/MIME RSA 2048-bit

Description

C2PA signing fails with RSA certificates using PS256 algorithm, throwing CoseX5ChainMissing error, while identical workflow succeeds with the ECDSA test fixtures provided in c2pa-tools.

Steps to Reproduce

1. Create manifest with RSA certificate chain:

{
  "alg": "ps256",
  "private_key": "/path/to/rsa_private_key.pem",
  "sign_cert": "/path/to/cert_chain.pem"
}

2. Run signing command:

./c2patool image.png --manifest manifest.json --output signed.png --force

Expected Behavior

Image should be signed successfully with C2PA manifest embedded.

Actual Behavior

[ERROR c2pa::store] Signature that was just generated does not validate: CoseX5ChainMissing
Error: embedding manifest
Caused by: could not find signing certificate chain in COSE signature

Working Comparison

Identical workflow succeeds with the ECDSA test fixtures provided in c2pa-tools:

{
  "alg": "es256",
  "private_key": "/path/to/es256_private.key",
  "sign_cert": "/path/to/es256_certs.pem"
}

Certificate Details

RSA Certificate (failing)

• Algorithm: RSA 2048-bit
• Signature Algorithm: sha256WithRSAEncryption
• Extended Key Usage: E-mail Protection, TLS Web Client Authentication
• Key Usage: Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
• Chain: Leaf cert + Intermediate CA (no root)

ECDSA Test Fixture (working)

• Algorithm: ECDSA P-256
• Signature Algorithm: ecdsa-with-SHA256
• Extended Key Usage: E-mail Protection (critical)
• Key Usage: Digital Signature, Non Repudiation (critical)
• Chain: Leaf cert + Intermediate CA (no root)
• Issuer: C2PA Test Signing Cert

Analysis

The error suggests the COSE signature generation process fails to include the x5chain field when processing RSA certificates, while it correctly includes it for the ECDSA test fixtures. Both certificate chains have identical structure (leaf + intermediate CA).

Additional Context

• Certificate extraction and validation with OpenSSL works correctly for both certificate types
• Private keys are unencrypted and properly formatted
• Issue appears to be in COSE signature generation, not certificate validation
• The c2pa-tools ECDSA test fixtures work perfectly with the same c2patool version

Question

Is this a known limitation with RSA certificates in c2patool, or should RSA/PS256 be fully supported?