signature=c46eb6506a9975740265181e69a4a8be,javascript - Jsrsasign. How to verify the signature on th...-CSDN博客

本文档描述了在移动设备上生成证书并进行签名的过程，然后将其发送到服务器进行验证。代码示例中展示了如何使用RSA密钥对进行证书创建、签名和验证。然而，遇到的问题是在服务器端使用OpenSSL进行签名验证失败。寻求帮助解决在OpenSSL中进行相同签名验证的方法。

摘要由CSDN通过智能技术生成

Good morning.

I need to generate a certificate on a mobile device for later send to the server.

The intention is to sign some unique feature of the device and check it on the server.

I use the following method

// Create cert

var publickey="";

publickey=publickey+"-----BEGIN PUBLIC KEY-----\n";

publickey=publickey+"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD2Alder/8ByIu+565IRZS+xB6t";

publickey=publickey+"hJkmlwNy7wMRTX7YysHC9S75wR/FLWFdsjMP+3TElvxsck+A3emsd2TYcJr0s4p7";

publickey=publickey+"5vP8k3Cap39mTXVNLRyaiFZt4ViJTYhsNWtAfS8t8T56FWPxy1prilR0AQHp+Qj5";

publickey=publickey+"VKdp8Rwfik4GrHOGWQIDAQAB\n";

publickey=publickey+"-----END PUBLIC KEY-----";

var privatekey="";

privatekey=privatekey+"-----BEGIN RSA PRIVATE KEY-----\n";

privatekey=privatekey+"MIICXAIBAAKBgQD2Alder/8ByIu+565IRZS+xB6thJkmlwNy7wMRTX7YysHC9S75";

privatekey=privatekey+"wR/FLWFdsjMP+3TElvxsck+A3emsd2TYcJr0s4p75vP8k3Cap39mTXVNLRyaiFZt";

privatekey=privatekey+"4ViJTYhsNWtAfS8t8T56FWPxy1prilR0AQHp+Qj5VKdp8Rwfik4GrHOGWQIDAQAB";

privatekey=privatekey+"AoGAbhYIIPAi7hpfJrOoUuEIOgGrNLzEh/dF7NW2CrUiEUNSR7rOJaddXy/6hSIs";

privatekey=privatekey+"JXfB/gMOvDy/BQzI94uKDiz9uahMcuADhpUJBpDQMP5B1xMwVAxm8MLHEi86Bn3T";

privatekey=privatekey+"W/yaTsa7SYlnMu0TJl1xQFeB9cQS4qZIUgGR44774yIM/V0CQQD92Xz9ojSgcT4m";

privatekey=privatekey+"Hz1ua4jNTBtUPT+Buxr3IZraaXVYKIUiW1dFXiD6BZ0PVFdA8yBTvltoidjv/5zv";

privatekey=privatekey+"7Pm6alHDAkEA+BfZkqBvLXFQtHgxVaj+JMIXei9TWkhtQt9no1IWAZd/vvBDJelE";

privatekey=privatekey+"utOsG824g/I2+mLnYHDFLfH7CBeMz4mJswJAXbRq7zVxN8iVqHzfsGMBnMb7T51M";

privatekey=privatekey+"VBc9XPyKrRVAu8o5WvVcwb59bc2krIP1sYQN6tvZ4j0AV5eD1w0jIi0dAQJBAKQ7";

privatekey=privatekey+"ZZRjEDYM5VgSmNYT4OmEcvY3jf4eI/Y43eqH1HmJSM+lTU4zdYQXy788GAGAvlRS";

privatekey=privatekey+"VMjK3jzkC0H4FQbuDXECQDaFTYpdYkUDeGPX4YTEPBbwMyJygjRDD3X067bgAJ/+";

privatekey=privatekey+"z9pgsAsHhle6aQv09c0t2j+6LPVeFpSvd2u8g9+9U0o=\n";

privatekey=privatekey+"-----END RSA PRIVATE KEY-----";

var rsa = new RSAKey();

rsa.readPrivateKeyFromPEMString(privatekey);

var tbsc = new KJUR.asn1.x509.TBSCertificate();

tbsc.setSerialNumberByParam({'int': 9999});

tbsc.setSignatureAlgByParam({'name': 'SHA256withRSA'});

tbsc.setIssuerByParam({'str': '/C=ES/O=MOBILE-CA'});

tbsc.setNotBeforeByParam({'str': '130501235959Z'});

tbsc.setNotAfterByParam({'str': '230501235959Z'});

tbsc.setSubjectByParam({'str': '/C=ES/CN=SOME'});

tbsc.setSubjectPublicKeyByParam({'rsapem': publickey});

var cert = new KJUR.asn1.x509.Certificate({'tbscertobj': tbsc,

'prvkeyobj': rsa

});

cert.sign();

var x509toServer=cert.getPEMString(); // Send to server

// Generate sign

var xig = new KJUR.crypto.Signature({"alg": "SHA256withRSA"});

xig.init(rsa);

xig.updateString("zzzzttttzzzz");

var xSigVal = xig.sign();

console.log('Sign: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++');

console.log(xSigVal);

console.log('++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++');

// Verify sign

var sig = new KJUR.crypto.Signature({"alg": "SHA256withRSA"});

sig.initVerifyByCertificatePEM(cert.getPEMString()); // signer's certificate

sig.updateString(me.getApplication().device_uid);

var isValid = sig.verify(xSigVal)

if (isValid) {

console.log("valid");

} else {

console.log("invalid");

}

The above code works perfectly, and shows me that the signature is valid.

The certificate server receives the message (zzzzttttzzzz) and signed (variable xSigVal).

and the next files are generated

device.cer with

-----BEGIN CERTIFICATE-----

MIIBwjCCASugAwIBAgICJw8wDQYJKoZIhvcNAQELBQAwITELMAkGA1UEBhMCRVMx

EjAQBgNVBAoMCU1PQklMRS1DQTAeFw0xMzA1MDEyMzU5NTlaFw0yMzA1MDEyMzU5

NTlaMCwxCzAJBgNVBAYTAkVTMR0wGwYDVQQDDBR1MDIwODg1LXp6enp0dHR0enp6

ejCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA9gJXXq//AciLvueuSEWUvsQe

rYSZJpcDcu8DEU1+2MrBwvUu+cEfxS1hXbIzD/t0xJb8bHJPgN3prHdk2HCa9LOK

e+bz/JNwmqd/Zk11TS0cmohWbeFYiU2IbDVrQH0vLfE+ehVj8ctaa4pUdAEB6fkI

+VSnafEcH4pOBqxzhlkCAwEAATANBgkqhkiG9w0BAQsFAAOBgQCj7lCmpZt4Icej

KyH1fLseEAHACoR/FB8vknaLL3Bk8X4ADOEWGQD3ZL5TdQYRKxpqYz49j2Iu90qc

YfBeLD/WJ8bwBwnWal1n02pFZJWKldlYjhcQ7Z910AsP2oG3A4tsOUMaUSs+Al2+

U+YKn08m09RRubGVDuxboVtdBicK/A==

-----END CERTIFICATE-----

message.txt with

zzzzttttzzzz

firma.sign with

cbfbaa6f099fafdb9d892a9d2ea7378a66685e429f77e24241e2e5531db9c020829de125467a891504aaa42b174b0d47d6c83e8234fe32918900ba219cd75b024fa21c241a8c8463ffe629a8e3cf094014cb19a70734db8a0f7b856fb60f4cf9425af8982a9404bfaa8a9e09d742160bca588c4464c17467ef2de69d1b0c46d0

The information returned by the certificate on server is

openssl x509 -in c/device.cer -noout -text

Certificate:

Data:

Version: 3 (0x2)

Serial Number: 9999 (0x270f)

Signature Algorithm: sha256WithRSAEncryption

Issuer: C=ES, O=MOBILE-CA

Validity

Not Before: May 1 23:59:59 2013 GMT

Not After : May 1 23:59:59 2023 GMT

Subject: C=ES, CN=u020885-zzzzttttzzzz