obtained digitally signed document (or message) onto the mobile terminal. This verification consists of two parts: Verification of the document (or message) signature Validation of the associated PKI certificate of the signer The first step, that is, the actual verification of message signature, is done by corresponding modules (e.g., WS-security or XML-security) of the secure mobile application. After that, the signer's PKI certificate validation (or a complete certificate chain validation) is done by sending a Validate request message to the XKMS server. In this way, complex functionalities of certificate validation will be removed from the secure mobile application of the mobile terminal and delegated to the XKMS server. One of the main benefits in this case is that the secure mobile application does not need to implement a certificate revocation status check (either by downloading a corresponding Certificate Revocation List (CRL) or by implementing the Online Certificate Validation Protocol (OCSP)). In this way, this complex functionality is completely outsourced to the XKMS server. A possible scenario of validation of the received X.509v3 electronic certificate by using the secure mobile application and the XKMS protocol is described below (see Figure 11.6): 1. The mobile user receives a message with an XML Signature. The secure JAVA mobile phone application verifies the XML Signature by using a public Service Delivery Platforms key obtained from X.509v3 certificate. The next step is a validation of the user's certificate by using the ValidateRequest message of the XKMS proto- col. In this sense, the mobile application creates an XML ValidateRequest message. 2. The mobile application further creates a SOAP message in which a body part is the already created XML ValidateRequest message in the previous step. 3. The mobile user application sends the SOAP message to the XKMS server. Mobilephone user XKMS service PKI provider 1: Generation ValidateRequest XML message 2: Generation of SOAP message 3: Send SOAP val