php 数字签名 证书,在PHP中验证SAML响应中的证书的数字签名

使用

xmldsig语法签名的XML有三个重要部分：

>签名 – > KeyInfo包含有关从用于签署数据的私钥派生的公钥的信息

>签名 – > SignedInfo包含将使用上述私钥签名的数据;数据包含有关如何计算验证的信息，例如：CanonicalizationMethod，SignatureMethod，Reference

签名 – > SignatureValue包含通过签名签名生成的签名的值 – > SignedInfo与私钥

理论上，这是代码应该如何查找rsa-sha1算法(由Signature – > SignedInfo – > SignatureMethod指定)，具有以下规范化方法：独占XML规范化1.0(省略注释)和提供的x509证书：

$xmlDoc = new DOMDocument();

$xmlDoc->loadXML($xmlString);

$xpath = new DOMXPath($xmlDoc);

$xpath->registerNamespace('secdsig', 'http://www.w3.org/2000/09/xmldsig#');

// fetch Signature node from XML

$query = ".//secdsig:Signature";

$nodeset = $xpath->query($query, $xmlDoc);

$signatureNode = $nodeset->item(0);

// fetch SignedInfo node from XML

$query = "./secdsig:SignedInfo";

$nodeset = $xpath->query($query, $signatureNode);

$signedInfoNode = $nodeset->item(0);

// canonicalize SignedInfo using the method descried in

// ./secdsig:SignedInfo/secdsig:CanonicalizationMethod/@Algorithm

$signedInfoNodeCanonicalized = $signedInfoNode->C14N(true, false);

// fetch the x509 certificate from XML

$query = 'string(./secdsig:KeyInfo/secdsig:X509Data/secdsig:X509Certificate)';

$x509cert = $xpath->evaluate($query, $signatureNode);

// we have to re-wrap the certificate from XML to respect the PEM standard

$x509cert = "-----BEGIN CERTIFICATE-----\n"

. $x509cert . "\n"

. "-----END CERTIFICATE-----";

// fetch public key from x509 certificate

$publicKey = openssl_get_publickey($x509cert);

// fetch the signature from XML

$query = 'string(./secdsig:SignatureValue)';

$signature = base64_decode($xpath->evaluate($query, $signatureNode));

// verify the signature

$ok = openssl_verify($signedInfoNodeCanonicalized, $signature, $publicKey);