PHP Requires Chilkat v11.0.0+

RSASSA-PSS Sign String to Create Base64 PCKS7 Signature

See more Digital Signatures Examples

Signs a string to create a PKCS7 signature in the base64 encoding. The signature algorithm is RSASSA-PSS with SHA256. Chilkat2 PHP

<?php

use Chilkat2\Cert;
use Chilkat2\Crypt2;
use Chilkat2\Pfx;

$success = false;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

$crypt = new Crypt2();

// Get a digital certificate with private key from a .pfx
// (Chilkat has many different ways to provide a cert + private key for siging.
// Using a PFX is just one possible option.)
$pfx = new Pfx();
try {
    $pfx->LoadPfxFile('qa_data/rsassa-pss/privatekey.pfx', 'PFX_PASSWORD');

    // Get the certificate to be used for signing.
    // (The typical case for a PFX is that it contains a cert with an associated private key,
    // as well as other certificates in the chain of authentication.  The cert with the private
    // key should be in the first position at index 0.)

    $cert = new Cert();
    $pfx->CertAt(0, $cert);
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

$crypt->SetSigningCert($cert);

// Indicate that RSASSA-PSS with SHA256 should be used.
$crypt->SigningAlg = 'pss';
$crypt->HashAlgorithm = 'sha256';

$crypt->EncodingMode = 'base64';

// Sign a string and return the base64 PKCS7 detached signature
$originalText = 'This is a test';
$pkcs7sig = $crypt->SignStringENC($originalText);
echo "Detached Signature:\n";
echo $pkcs7sig, "\n";

// This signature looks like this:
// MIIG5wYJKoZIhvcNAQcCoIIG2DCCBtQCAQExDzANBgl .. YToLqEwTdU87ox5g7rvw==

// The ASN.1 of the signature can be examined by browsing to https://lapo.it/asn1js/ ,
// then copy-and-paste the Base64 signature into the form and decode..

// The signature can be verified against the original data like this:
try {
    $crypt->VerifyStringENC($originalText, $pkcs7sig);
    $success = true;
} catch (\Chilkat2\Exception $e) {
    $success = false;
}
echo 'Signature verified: ', ($success ? 'true' : 'false'), "\n";
try {
    $crypt->VerifyStringENC('Not the original text', $pkcs7sig);
    $success = true;
} catch (\Chilkat2\Exception $e) {
    $success = false;
}
echo 'Signature verified: ', ($success ? 'true' : 'false'), "\n";

// Now we'll create an opaque signature (the opposite of a detached signature).
// An opaque signature is a PKCS7 message that contains both the original data and
// the signature.  The verification process extracts the original data.
$opaqueSig = $crypt->OpaqueSignStringENC($originalText);
echo "Opaque Signature:\n";
echo $opaqueSig, "\n";

// The ASN.1 of the signature can be examined by browsing to https://lapo.it/asn1js/ ,
// then copy-and-paste the Base64 signature into the form and decode..

// We can verify and extract the original data:
try {
    $origTxt = $crypt->OpaqueVerifyStringENC($opaqueSig);
} catch (\Chilkat2\Exception $e) {
    echo "Signature verification failed.\n";
    echo $e->getMessage(), "\n";
    exit;
}

echo "Signature verified.\n";
echo 'Extracted text:', $origTxt, "\n";