note 53798 deleted from function.openssl-pkcs7-verify by nlopess
| From: | nlopess@php.net | Date: | Sun, 17 Jul 2005 17:38:36 +0000 |
| Subject: | note 53798 deleted from function.openssl-pkcs7-verify by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-92085@lists.php.net to get a copy of this message | ||
Note Submitter:
----
Sorry, my note above is incorrect -- I was fooled by the -1 return value for error not being
false.... take care not to test if(!openssl_pkcs7_verify(... since this will not catch the
"error" condition and accept the untested signature!!!
openssl_pkcs7_verify() just uses normal filepaths throughout. It's openssl_pkcs7_sign() that
uses the file:/// method. Here are a couple of working examples to clarify this confusion.
Signing...
if (
openssl_pkcs7_sign(
$filepathHeader,
$filepathHeaderSigned,
"file:///path/to/your/cert/signed/by/your/CA.pem", // signing cert
array("file:///path/to/your/private/key",""), // private key
array()
)
) {
echo "okay - in ".$filepathHeaderSigned."\n";
} else {
while ($msg = openssl_error_string()) echo $msg . "<br />\n";
}
Verifying....
$ret=openssl_pkcs7_verify (
$filepathSignedFile,
PKCS7_DETACHED
$output, // set to filepath that is to contain signing certs after successful run
array(
"/path/to/your/CA/public/certificate.pem"
)
);
if($ret !== TRUE) {
echo "no\n";
while ($msg = openssl_error_string()) echo $msg . "<br />\n";
}