-----Original Message----- From: WCR [mailto:[EMAIL PROTECTED] Sent: 31 January 2007 14:37 To: openssl-users@openssl.org Subject: Digital Signatures rsa-sha1
I am sending a message to a web service and I need to apply a digital signature. I have been issued with a .P12 certificate and my public key. I need to insert various bits into the xml message. I have converted the P12 to PEM doing this: openssl pkcs12 -in mycert.p12 -out mycert.pem -passin file:mypassword -nodes I then extract the token between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- from mycert.pem and create a Base64 encoded BinarySecurityToken element. So far so good. The specification states: //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// /////////////////////////////// Canonicalization: The Canonicalization Algorithm should be XML-EXC-C14N (Exclusive Canonicalization) -http://www.w3.org/2001/10/xml-exc-c14n# Signature Algorithm: The Signature Algorithm should be SHA1withRSA - http://www.w3.org/2000/09/xmldsig#rsa-sha1 References: There must be a Reference element (Envelope/Header/Security/Signature/SignedInfo/Reference) corresponding to the signed Body element within the message. This should have an Id attribute with a value of MsgBody. The Reference should have a single transform - Exclusive Canonicalization (see the URI above). The Digest Algorithm should be SHA1 - http://www.w3.org/2000/09/xmldsig#sha1 //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// /////////////////////////////// I can create the digest of the message doing: openssl dgst -sha1 mymessage > mymessage.sha But I now need to sign it. I have tried: openssl dgst -sha1 -sign mycert.pem -out mysign.sig mymessage.sha But I don't think this correct as it is not RSA-SHA1. If I insert the signature into the xml message it causes an xml fault. Is something like " openssl dgst -rsasha1 " provided at the command level of openssl? Any assistance would be appreciated. Regards David