为什么OpenSSL_X509_FINGERPRINT给出与原件不同的值？

发布于 2025-02-02 11:17:31 字数 1431 浏览 2 评论 0原文

我正在制定一个PHP程序，该程序将验证数字签名。解密了数字签名，这给了我我试图匹配的SHA256 Imp

$Cert1 = file_get_contents('CERT1/cert_array.json'); // TEST CERT DATA
$Cert1 = json_decode($Cert1, true);
$PublicKey = file_get_contents('CERT2/public_key_rsa.pem'); // CA CERT PUBLIC KEY
openssl_public_decrypt(hex2bin($Cert1['DigitalSignature']), $DecryptedDigitalSignature, $PublicKey, OPENSSL_PKCS1_PADDING); // DECRYPT SIGNATURE USING CA PUBLIC KEY
print('decrypted digital signature:' . bin2hex($DecryptedDigitalSignature) . "\n\n"); // PRINT RESULTS

decrypted digital signature:
3031300d0609608648016503040201050004200bf3dcf2340b972e97fe3c8493e11eeee01f298939734690d0b4e79e1f5701b4

我正在使用一个示例（有效）证书进行测试，并获取SHA256摘要：

3031300d060960864801650304020105000420 // PADDING
0bf3dcf2340b972e97fe3c8493e11eeee01f298939734690d0b4e79e1f5701b4  // SHA256 DIGEST

好的，所以现在我有了SHA 256 Digest，因此我现在希望在同一证书（CERT1）上使用OpenSSL_X509_FINGERPRINT功能来创建我自己的SHA256 Digest。这应该与我已经从上面的证书中提取的摘要相匹配。我使用此代码：

$Cert1 = file_get_contents('CERT1/cert.crt'); // THE CERT IN VALID x509 FORMAT
print(openssl_x509_fingerprint($Cert1, 'sha256'));

我得到以下结果：

d74157547fb287694b95b2533588c71f8706b0960e023fc4317f4f9a49ad2721

因此，我的问题是，为什么要获得“ D74157547FB287694B95B25333588C71F8706B0960E023FC43FC4317FC4317F9A49A49AD2721” 939734690D0B4E79E1F5701B4“？

原文

I'm working on a php program that will verify a digital signature. I'm testing with an example (valid) certificate, and decrypting the digital signature, this gives me the sha256 digest which I am trying to match:

$Cert1 = file_get_contents('CERT1/cert_array.json'); // TEST CERT DATA
$Cert1 = json_decode($Cert1, true);
$PublicKey = file_get_contents('CERT2/public_key_rsa.pem'); // CA CERT PUBLIC KEY
openssl_public_decrypt(hex2bin($Cert1['DigitalSignature']), $DecryptedDigitalSignature, $PublicKey, OPENSSL_PKCS1_PADDING); // DECRYPT SIGNATURE USING CA PUBLIC KEY
print('decrypted digital signature:' . bin2hex($DecryptedDigitalSignature) . "\n\n"); // PRINT RESULTS

This outputs the following:

decrypted digital signature:
3031300d0609608648016503040201050004200bf3dcf2340b972e97fe3c8493e11eeee01f298939734690d0b4e79e1f5701b4

There is some padding on the left, I now split this up to get the sha256 digest:

3031300d060960864801650304020105000420 // PADDING
0bf3dcf2340b972e97fe3c8493e11eeee01f298939734690d0b4e79e1f5701b4  // SHA256 DIGEST

Ok, so now I have my sha 256 digest, so I now wish to use the openssl_x509_fingerprint function on the same cert (CERT1) to create my own sha256 digest. This should match the digest that I already extracted from the cert from above. I use this code:

$Cert1 = file_get_contents('CERT1/cert.crt'); // THE CERT IN VALID x509 FORMAT
print(openssl_x509_fingerprint($Cert1, 'sha256'));

I get the following result:

d74157547fb287694b95b2533588c71f8706b0960e023fc4317f4f9a49ad2721

So, my question is, why am I getting "d74157547fb287694b95b2533588c71f8706b0960e023fc4317f4f9a49ad2721" and not "0bf3dcf2340b972e97fe3c8493e11eeee01f298939734690d0b4e79e1f5701b4"?

分享到QQ

分享到微博