if (log.isDebugEnabled()) {
log.debug("Trying to verify the outer signature with a CVCA certificate, fp: "+CertTools.getFingerprintAsString(cert));
}
try {
// The CVCA certificate always contains the full key parameters, no need to du any EC curve parameter magic here
authreq.verify(cert.getPublicKey());
log.debug("Verified outer signature");
verifiedOuter = true;
// Yes we did it, we can move on to the next step because the outer signature was actually created with some old certificate
if (!ejbhelper.checkValidityAndSetUserPassword(admin, cert, username, password)) {
// If the CA certificate was not valid, we are not happy