0

I'm trying to implement a payment using a Volume webhooks. I'm getting some errors on prodution machine:
error:0480006C:PEM routines::no start line
error:02000068:rsa routines::bad signature
error:1C880004:Provider routines::RSA lib

I'm getting some errors on my localhost machine:
error:0909006C:PEM routines:get_name:no start line
error:02000068:rsa routines::bad signature

the test souce of my application:

<?php
    // Load the public key 
    // get info: https://api.sandbox.volumepay.io/.well-known/signature/pem
    $pemContent = file_get_contents("https://api.sandbox.volumepay.io/.well-known/signature/pem");
    if ($pemContent === false) {
        die("Error reading the public key.\n");
    }

    $publicKey = "-----BEGIN PUBLIC KEY-----\n" . trim($pemContent) . "\n-----END PUBLIC KEY-----";

    // Load the payload
    $payload = '{"paymentId":"a08ff808-53bf-4716-8e0d-c1185c8b0b6b","merchantPaymentId":"payment_6705370a441ed9.34887321","paymentStatus":"FAILED","errorDescription":"Failed to create payment authorization - payment provider returned an error","paymentRequest":{"amount":9.99,"currency":"GBP","reference":"Payment Reference"},"paymentRefundData":null,"paymentMetadata":null,"applicationId":"96c1e0da-93ae-407e-aae5-aa02fa314ff9"}';
    if ($payload === false) {
        die("Error reading the payload.\n");
    }

    // Load and decode the signature from Base64
    $signatureBase64 = "dllgtxuoO3SKehfxs02i9PF9i32m//xeEUp2CLFWs9RCjbKSTFCbIdFwjlQKDGUrQcZQVfFQ4XFb6/COMB9pUjWcXX874uWJVZvkzzGDaaqwxb9obkte49o73NlfCrfpk/kKE1MJ3rXxeHJTkh2A2AcE4tDBP8V9M+gWmytLbtpLG6MAF/lvze0wqgy8Kg5eQ3nwcAqqMiz1ruK6XFnzMzURHNPo6kyqaSH/3/dL+j89WiISPOYZ9uUuJmmQGHRbFW6Jor2BjDAav9I6fCIcOgsgwQkXYs+hA42JZUV5adrau4gtHEvxfmt8xualaB15+OenKcM+3CgXRkPSTKNmYQ==";
    $signatureBase64 = str_replace('\/', '/', $signatureBase64);
    //$signatureBase64 = str_replace('//', '/', $signatureBase64);
    if ($signatureBase64 === false) {
        die("Error reading the signature.\n");
    } else {
        echo "Private key: " . $signatureBase64;
    }

    $signature = base64_decode($signatureBase64);

    // Check if the signature was decoded correctly
    if ($signature === false) {
        die("Error decoding the signature.\n");
    }else{
         echo "signature decode: " . $signatureBase64;
    }

    // Compute the SHA-256 hash of the payload
    $hashedPayload = hash('sha256', $payload, true);

    // Set up the public key for verification
    $publicKeyResource = openssl_pkey_get_public($publicKey);
    if ($publicKeyResource === false) {
        die("Error loading the public key resource.\n");
    }

    // Perform the signature verification
    $result = openssl_verify($hashedPayload, $signature, $publicKeyResource, OPENSSL_ALGO_SHA256);
    echo "\n Result: " . $result . "\n";

    // Free the public key resource
    openssl_free_key($publicKeyResource);

    echo "Payload:\n{$payload}\n\n";
    echo "Hashed Payload (SHA-256): " . bin2hex($hashedPayload) . "\n\n";
    echo "Decoded Signature (Hex): " . bin2hex($signature) . "\n\n";

    if ($result === 1) {
        echo "Signature successfully verified.\n"; 
    } elseif ($result === 0) {
        echo "Signature verification failed: Signature does not match.\n";
        while ($error = openssl_error_string()) {
            echo("ERROR OpenSSL verification error: {$error} \n");
        }
        return false;
    } else {
        while ($error = openssl_error_string()) {
            echo("ERROR OpenSSL error during verification: {$error} \n");
        }
        return false;
    }
?>

My output was:

$ php index.php 
Private key: dllgtxuoO3SKehfxs02i9PF9i32m//xeEUp2CLFWs9RCjbKSTFCbIdFwjlQKDGUrQcZQVfFQ4XFb6/COMB9pUjWcXX874uWJVZvkzzGDaaqwxb9obkte49o73NlfCrfpk/kKE1MJ3rXxeHJTkh2A2AcE4tDBP8V9M+gWmytLbtpLG6MAF/lvze0wqgy8Kg5eQ3nwcAqqMiz1ruK6XFnzMzURHNPo6kyqaSH/3/dL+j89WiISPOYZ9uUuJmmQGHRbFW6Jor2BjDAav9I6fCIcOgsgwQkXYs+hA42JZUV5adrau4gtHEvxfmt8xualaB15+OenKcM+3CgXRkPSTKNmYQ==
signature decode: dllgtxuoO3SKehfxs02i9PF9i32m//xeEUp2CLFWs9RCjbKSTFCbIdFwjlQKDGUrQcZQVfFQ4XFb6/COMB9pUjWcXX874uWJVZvkzzGDaaqwxb9obkte49o73NlfCrfpk/kKE1MJ3rXxeHJTkh2A2AcE4tDBP8V9M+gWmytLbtpLG6MAF/lvze0wqgy8Kg5eQ3nwcAqqMiz1ruK6XFnzMzURHNPo6kyqaSH/3/dL+j89WiISPOYZ9uUuJmmQGHRbFW6Jor2BjDAav9I6fCIcOgsgwQkXYs+hA42JZUV5adrau4gtHEvxfmt8xualaB15+OenKcM+3CgXRkPSTKNmYQ==
 Result: 0
Payload:
{"paymentId":"a08ff808-53bf-4716-8e0d-c1185c8b0b6b","merchantPaymentId":"payment_6705370a441ed9.34887321","paymentStatus":"FAILED","errorDescription":"Failed to create payment authorization - payment provider returned an error","paymentRequest":{"amount":9.99,"currency":"GBP","reference":"Payment Reference"},"paymentRefundData":null,"paymentMetadata":null,"applicationId":"96c1e0da-93ae-407e-aae5-aa02fa314ff9"}

Hashed Payload (SHA-256): 4e41719f186a3d94cc54a5e569107ea5901a516980527904affba2b34e1c69c8

Decoded Signature (Hex): 765960b71ba83b748a7a17f1b34da2f4f17d8b7da6fffc5e114a7608b156b3d4428db2924c509b21d1708e540a0c652b41c65055f150e1715bebf08e301f6952359c5d7f3be2e589559be4cf318369aab0c5bf686e4b5ee3da3bdcd95f0ab7e993f90a135309deb5f1787253921d80d80704e2d0c13fc57d33e8169b2b4b6eda4b1ba30017f96fcded30aa0cbc2a0e5e4379f0700aaa322cf5aee2ba5c59f33335111cd3e8ea4caa6921ffdff74bfa3f3d5a22123ce619f6e52e26699018745b156e89a2bd818c301abfd23a7c221c3a0b20c1091762cfa1038d8965457969dadabb882d1c4bf17e6b7cc6e6a5681d79f8e7a729c33edc28174643d24ca36661

Signature verification failed: Signature does not match.
ERROR OpenSSL verification error: error:0480006C:PEM routines::no start line 
ERROR OpenSSL verification error: error:02000068:rsa routines::bad signature 
ERROR OpenSSL verification error: error:1C880004:Provider routines::RSA lib 
5
  • Why doesn't the output include either Signature successfully verified. or Signature verification failed: Signature does not match.? Commented Oct 8, 2024 at 21:24
  • olá @Barmar, thanks for the answer, the out put happens to me, but the stack overflow erased when I post, see: Signature verification failed: Signature does not match. Commented Oct 8, 2024 at 21:35
  • Paste the output inside triple backtick code fences to preserve the formatting. See how I edited the question. Commented Oct 8, 2024 at 21:37
  • done! please help me, I have this demand to deliver :( Commented Oct 8, 2024 at 23:37
  • Sorry, I don't know anything about verifying signatures, I can't help you with that part. All I can do is help you write the question more clearly. Commented Oct 9, 2024 at 15:05

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.