I'm trying to implement a payment using a Volume webhooks.
I'm getting some errors on prodution machine:
error:0480006C:PEM routines::no start line
error:02000068:rsa routines::bad signature
error:1C880004:Provider routines::RSA lib
I'm getting some errors on my localhost machine:
error:0909006C:PEM routines:get_name:no start line
error:02000068:rsa routines::bad signature
the test souce of my application:
<?php
// Load the public key
// get info: https://api.sandbox.volumepay.io/.well-known/signature/pem
$pemContent = file_get_contents("https://api.sandbox.volumepay.io/.well-known/signature/pem");
if ($pemContent === false) {
die("Error reading the public key.\n");
}
$publicKey = "-----BEGIN PUBLIC KEY-----\n" . trim($pemContent) . "\n-----END PUBLIC KEY-----";
// Load the payload
$payload = '{"paymentId":"a08ff808-53bf-4716-8e0d-c1185c8b0b6b","merchantPaymentId":"payment_6705370a441ed9.34887321","paymentStatus":"FAILED","errorDescription":"Failed to create payment authorization - payment provider returned an error","paymentRequest":{"amount":9.99,"currency":"GBP","reference":"Payment Reference"},"paymentRefundData":null,"paymentMetadata":null,"applicationId":"96c1e0da-93ae-407e-aae5-aa02fa314ff9"}';
if ($payload === false) {
die("Error reading the payload.\n");
}
// Load and decode the signature from Base64
$signatureBase64 = "dllgtxuoO3SKehfxs02i9PF9i32m//xeEUp2CLFWs9RCjbKSTFCbIdFwjlQKDGUrQcZQVfFQ4XFb6/COMB9pUjWcXX874uWJVZvkzzGDaaqwxb9obkte49o73NlfCrfpk/kKE1MJ3rXxeHJTkh2A2AcE4tDBP8V9M+gWmytLbtpLG6MAF/lvze0wqgy8Kg5eQ3nwcAqqMiz1ruK6XFnzMzURHNPo6kyqaSH/3/dL+j89WiISPOYZ9uUuJmmQGHRbFW6Jor2BjDAav9I6fCIcOgsgwQkXYs+hA42JZUV5adrau4gtHEvxfmt8xualaB15+OenKcM+3CgXRkPSTKNmYQ==";
$signatureBase64 = str_replace('\/', '/', $signatureBase64);
//$signatureBase64 = str_replace('//', '/', $signatureBase64);
if ($signatureBase64 === false) {
die("Error reading the signature.\n");
} else {
echo "Private key: " . $signatureBase64;
}
$signature = base64_decode($signatureBase64);
// Check if the signature was decoded correctly
if ($signature === false) {
die("Error decoding the signature.\n");
}else{
echo "signature decode: " . $signatureBase64;
}
// Compute the SHA-256 hash of the payload
$hashedPayload = hash('sha256', $payload, true);
// Set up the public key for verification
$publicKeyResource = openssl_pkey_get_public($publicKey);
if ($publicKeyResource === false) {
die("Error loading the public key resource.\n");
}
// Perform the signature verification
$result = openssl_verify($hashedPayload, $signature, $publicKeyResource, OPENSSL_ALGO_SHA256);
echo "\n Result: " . $result . "\n";
// Free the public key resource
openssl_free_key($publicKeyResource);
echo "Payload:\n{$payload}\n\n";
echo "Hashed Payload (SHA-256): " . bin2hex($hashedPayload) . "\n\n";
echo "Decoded Signature (Hex): " . bin2hex($signature) . "\n\n";
if ($result === 1) {
echo "Signature successfully verified.\n";
} elseif ($result === 0) {
echo "Signature verification failed: Signature does not match.\n";
while ($error = openssl_error_string()) {
echo("ERROR OpenSSL verification error: {$error} \n");
}
return false;
} else {
while ($error = openssl_error_string()) {
echo("ERROR OpenSSL error during verification: {$error} \n");
}
return false;
}
?>
My output was:
$ php index.php
Private key: dllgtxuoO3SKehfxs02i9PF9i32m//xeEUp2CLFWs9RCjbKSTFCbIdFwjlQKDGUrQcZQVfFQ4XFb6/COMB9pUjWcXX874uWJVZvkzzGDaaqwxb9obkte49o73NlfCrfpk/kKE1MJ3rXxeHJTkh2A2AcE4tDBP8V9M+gWmytLbtpLG6MAF/lvze0wqgy8Kg5eQ3nwcAqqMiz1ruK6XFnzMzURHNPo6kyqaSH/3/dL+j89WiISPOYZ9uUuJmmQGHRbFW6Jor2BjDAav9I6fCIcOgsgwQkXYs+hA42JZUV5adrau4gtHEvxfmt8xualaB15+OenKcM+3CgXRkPSTKNmYQ==
signature decode: dllgtxuoO3SKehfxs02i9PF9i32m//xeEUp2CLFWs9RCjbKSTFCbIdFwjlQKDGUrQcZQVfFQ4XFb6/COMB9pUjWcXX874uWJVZvkzzGDaaqwxb9obkte49o73NlfCrfpk/kKE1MJ3rXxeHJTkh2A2AcE4tDBP8V9M+gWmytLbtpLG6MAF/lvze0wqgy8Kg5eQ3nwcAqqMiz1ruK6XFnzMzURHNPo6kyqaSH/3/dL+j89WiISPOYZ9uUuJmmQGHRbFW6Jor2BjDAav9I6fCIcOgsgwQkXYs+hA42JZUV5adrau4gtHEvxfmt8xualaB15+OenKcM+3CgXRkPSTKNmYQ==
Result: 0
Payload:
{"paymentId":"a08ff808-53bf-4716-8e0d-c1185c8b0b6b","merchantPaymentId":"payment_6705370a441ed9.34887321","paymentStatus":"FAILED","errorDescription":"Failed to create payment authorization - payment provider returned an error","paymentRequest":{"amount":9.99,"currency":"GBP","reference":"Payment Reference"},"paymentRefundData":null,"paymentMetadata":null,"applicationId":"96c1e0da-93ae-407e-aae5-aa02fa314ff9"}
Hashed Payload (SHA-256): 4e41719f186a3d94cc54a5e569107ea5901a516980527904affba2b34e1c69c8
Decoded Signature (Hex): 765960b71ba83b748a7a17f1b34da2f4f17d8b7da6fffc5e114a7608b156b3d4428db2924c509b21d1708e540a0c652b41c65055f150e1715bebf08e301f6952359c5d7f3be2e589559be4cf318369aab0c5bf686e4b5ee3da3bdcd95f0ab7e993f90a135309deb5f1787253921d80d80704e2d0c13fc57d33e8169b2b4b6eda4b1ba30017f96fcded30aa0cbc2a0e5e4379f0700aaa322cf5aee2ba5c59f33335111cd3e8ea4caa6921ffdff74bfa3f3d5a22123ce619f6e52e26699018745b156e89a2bd818c301abfd23a7c221c3a0b20c1091762cfa1038d8965457969dadabb882d1c4bf17e6b7cc6e6a5681d79f8e7a729c33edc28174643d24ca36661
Signature verification failed: Signature does not match.
ERROR OpenSSL verification error: error:0480006C:PEM routines::no start line
ERROR OpenSSL verification error: error:02000068:rsa routines::bad signature
ERROR OpenSSL verification error: error:1C880004:Provider routines::RSA lib
Signature successfully verified.orSignature verification failed: Signature does not match.?