I am trying to use a timestamp service in both php and windows. My problem is that, what openssl outputs is not seem to be compatible with CryptVerifyTimeStampSignature().
To generate and upload the request in Windows, I use the CryptRetrieveTimeStamp():
CRYPT_TIMESTAMP_CONTEXT*re;
CRYPT_TIMESTAMP_PARA r = { 0 };
r.fRequestCerts = true;
auto C = ... // my data
auto flg = TIMESTAMP_VERIFY_CONTEXT_SIGNATURE;
CryptRetrieveTimeStamp(url, flg, 0,
szOID_NIST_sha256, &r, (BYTE*)C.data(), C.size(), &re, 0, 0);
In order to do that in php, I use openssl and curl
openssl ts -query -data inputfile -sha256 -cert -out file.tsq
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $tsa_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_BINARYTRANSFER, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, file_get_contents($requestfile_path));
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/timestamp-query'));
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
$binary_response_string = curl_exec($ch);
So far, good. I get a valid tsa response. The problem is now that, while openssl can verify both responses (from Windows API and from php):
openssl ts -verify -sha256 -digest "..." -in r:\1.dat -CAfile file.pem
Windows API call fails when the response is the openssl's:
PCRYPT_TIMESTAMP_CONTEXT re = 0;
BYTE* b = (BYTE*)...
auto sz = ...
auto Sig = ...
auto res = CryptVerifyTimeStampSignature(b,sz, (BYTE*)Sig.data(), Sig.size(), 0, &re, p, 0);
Result: @ERR,hr 0x8009310b : ASN1 bad tag value met. unsigned int
What could be wrong?
Thanks a lot.
User contributions licensed under CC BY-SA 3.0