0

I try to create a client assertion as described here.

In the third part of this doc (Signature), I don't know how to get my certificate signature as requested in the document. My certificate is a .cer file on my computer that I created like that :

$cert = New-SelfSignedCertificate -Subject "CN=Certiftest" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256
Export-Certificate -cert $cert -FilePath "path\Certiftest.cer"

In order to get the signature, I tried :

openssl x509 -inform der -in "path\Certiftest.cer" -text -noout -certopt ca_default -certopt no_validity -certopt no_serial -certopt no_subject -certopt no_extensions -certopt no_signame

But the signature does not have the same format as in the doc.

What I got :

Signature Algorithm: sha256WithRSAEncryption
         58:4c:52:d1:43:d4:5s:c1:56:bf:be:08:1b:29:ab:68:19:43:
         41:b6:91:0e:fe:46:39:35:46:e6:3b:6a:e7:80:7f:6a:7d:b5:
         9f:ce:0d:ff:17:26:e9:9f:a3:48:91:15:19:96:eb:c2:e3:36:
         64:3f:19:7c:cd:c4:e9:9f:a3:48:91:15:19:96:eb:c2:e3:36:
         cb:ce:f3:8f:fa:75:f5:d8:33:1f:e5:a6:e0:ff:22:b8:da:e0:
         *****************************************************
         53:85:74:35:e1:e6:bf:3e:e4:58:44:29:05:86:3b:6b:58:b9:
         1e:1f:0e:bc:35:4b:7d:ee:1f:ff:34:bc:5e:e5:3b:6b:58:b9:
         d2:b5:d4:a3

What they got in the document :

"Gh95kHCOEGq5E_ArMBbDXhwKR577scxYaoJ1P{a lot of characters here}KKJDEg"

Thanks,

Alex
  • 217
  • 1
  • 17

1 Answers1

0

Your "signature" is encoded in Hexadecimal, whereas the example you mention relies on base64 encoding (as is required by RFC7515).

Quoting the RFC: "The JWS Signing Input is always the concatenation of the Encoded JWS Header, a period ('.') character, and the Encoded JWS Payload." In your case, it looks like there is a misunderstanding on how to use openssl: the ** x509** is used for certificate manipulations (e.g. certificate conversion from one form to another, signing CSRs etc.). For signing, have a look at the dgst command instead.

The following question may also help you in the generation of the signature using openssl: How to create a Json Web Token (JWT) using OpenSSL shell commands?

veebee
  • 391
  • 2
  • 12