php - 使用 PHP 为 Apple Wallet 通行证创建 PKCS #7 分离签名
<p><p>这对我来说是一个全新的概念，所以我在黑暗中拍摄。</p>
<blockquote>
<p>To create the signature file, make a PKCS #7 detached signature of the
manifest file, using the private key associated with your signing
certificate. Include the WWDR intermediate certificate as part of the
signature. You can download this certificate from Apple’s website.
Write the signature to the file signature at the top level of the pass
package. Include the date and time that the pass was signed using the
S/MIME signing-time attribute.</p>
</blockquote>
<h2>我的理解:</h2>
<blockquote>
<p>To create the signature file, make a PKCS #7 detached signature of the manifest file</p>
</blockquote>
<p>我将使用 <a href="http://php.net/manual/en/function.openssl-pkcs7-sign.php" rel="noreferrer noopener nofollow"><code>openssl_pkcs7_sign</code></a>使用标志 <code>PKCS7_DETACHED</code> 的函数。</p>
<blockquote>
<p>using the private key associated with your signing certificate.</p>
</blockquote>
<p>我将使用我的 ssl <code>cert.pem</code> 文件的位置作为 <code>signcert</code> 参数和 <code>cert.key</code> 的位置文件作为 <code>privkey</code> 参数。</p>
<blockquote>
<p>Include the WWDR intermediate certificate as part of the signature.</p>
</blockquote>
<p>我将在 <code>extracerts</code> 参数中包含 WWDR 证书的路径</p>
<blockquote>
<p>Include the date and time that the pass was signed using the S/MIME signing-time attribute.</p>
</blockquote>
<p>我将包含一个数组，其中包含一个键 <code>signing-time</code> 和 <code>headers 的值类似于 <code>2015-05-03 10:40:00</code> </code> 参数。</p>
<h2>我的代码:</h2>
<pre><code>private function createSignature($dir)
{
$cert = '/etc/ssl/cert.pem';
$key = '/etc/ssl/private/cert.key';
$wwdr = '/location/of/apple/wwdr/cert.cer';
$headers = [
'signing-time' => (new DateTime())->format('o-m-d H:i:s'),
];
return openssl_pkcs7_sign("$dir/manifest.json", "$dir/signature", $cert, $key, $headers, PKCS7_DETACHED, $wwdr);
}
</code></pre>
<h2>其他问题:</h2>
<p>我在 <code>openssl_pkcs7_sign</code> 函数的文档示例中注意到文件的 <em>一些</em> 位置以 <code>file://</code> 为前缀>。这是为什么呢？</p></p>
<br><hr><h1><strong>Best Answer-推荐答案</ strong></h1><br>
<p><ol>
<li>在 <a href="https://developer.apple.com/account/ios/identifier/passTypeId" rel="noreferrer noopener nofollow">https://developer.apple.com/account/ios/identifier/passTypeId</a> 生成通行证类型 ID </li>
<li>在 <a href="https://developer.apple.com/account/ios/certificate/create/" rel="noreferrer noopener nofollow">https://developer.apple.com/account/ios/certificate/create/</a> 为该通行证类型 ID 创建证书</li>
<li>下载证书并将其放入您的钥匙串(keychain)中</li>
<li>在您的钥匙串(keychain)中找到证书并将其导出为 <code>Certificates.p12</code>，无需密码</li>
<li>打开终端，运行<code>openssl pkcs12 -in Certificates.p12 -clcerts -nokeys -out pass_cert.pem -passin pass:</code>生成证书</li>
<li>在终端中，运行 <code>openssl pkcs12 -in Certificates.p12 -nocerts -out pass_key.pem -passin pass: -passout pass:YourPassword</code> 生成 key </li>
<li>从 <a href="https://www.apple.com/certificateauthority/" rel="noreferrer noopener nofollow">https://www.apple.com/certificateauthority/</a> 下载 WWDR 证书并将其放入您的钥匙串(keychain)中</li>
<li>将 WWDR 证书从您的钥匙串(keychain)导出为 <code>wwdr.pem</code></li>
</ol>
<p>创建分离签名的函数:</p>
<pre><code>public function createSignature()
{
$cert = "file://location/of/pass_cert.pem";
$key = "file://location/of/pass_key.pem";
$wwdr = "/location/of/wwdr.pem";
openssl_pkcs7_sign("/location/of/manifest.json", "/location/of/signature",
$cert, [$key, 'YourPassword'], [], PKCS7_BINARY | PKCS7_DETACHED, $wwdr);
// convert pem to der
$signature = file_get_contents("/location/of/signature");
$begin = 'filename="smime.p7s"';
$end = '------';
$signature = substr($signature, strpos($signature, $begin) + strlen($begin));
$signature = substr($signature, 0, strpos($signature, $end));
$signature = trim($signature);
$signature = base64_decode($signature);
file_put_contents("/location/of/signature", $signature);
}
</code></pre>
<p>引用资料:</p>
<ul>
<li> <a href="https://www.raywenderlich.com/20734/beginning-passbook-part-1" rel="noreferrer noopener nofollow">https://www.raywenderlich.com/20734/beginning-passbook-part-1</a> </li>
<li> <a href="https://github.com/tschoffelen/PHP-PKPass/blob/master/PKPass.php" rel="noreferrer noopener nofollow">https://github.com/tschoffelen/PHP-PKPass/blob/master/PKPass.php</a> </li>
</ul></p>
<p style="font-size: 20px;">关于php - 使用 PHP 为 Apple Wallet 通行证创建 PKCS #7 分离签名，我们在Stack Overflow上找到一个类似的问题：
<a href="https://stackoverflow.com/questions/37010864/" rel="noreferrer noopener nofollow" style="color: red;">
https://stackoverflow.com/questions/37010864/
</a>
</p>
页:
[1]