Question

是否可以在openssl中使用命令行为给定的xml文档创建数字签名？

期望

我有兴趣从命令行获取一个值，如下所示，该值是从ds:SignatureValue提取的

签名方法：SHA1进行了两次转换

ULNmpuKwXwHwqUMybbwnupC/y9WZo8hi0qy9S2GuWxSB8WVEyA7RB6Qy.........hSq5BVw==

数字签名仅供参考。


<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
    <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
    <ds:Reference URI="#pfx238f2615-2267-6ee6-efa9-24dd82d85764">
        <ds:Transforms>
            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
        <ds:DigestValue>6okYcbSa3y18LSbOBJTMMWN7/Rs=</ds:DigestValue>
    </ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue> <!-- how to compute this value -->
    ULNmpuKwXwHwqUMybbwnupC/y9WZo8hi0qy9S2GuWxSB8WVEyA7RB6Qy.........hSq5BVw==
</ds:SignatureValue>
<ds:KeyInfo>
    <ds:X509Data>
        <ds:X509Certificate>
            MIIDuDCCAqACCQDpZiKUmwKtZTANBgkqhkiG9w0BAQsFADCBnTEL.......cBnjt9gNFVPaL7+/P+enkq9Vx0thQHUaI+ndr1gpZE=
        </ds:X509Certificate>
    </ds:X509Data>
</ds:KeyInfo>
</ds:Signature>

我已经生成了密钥（公共/私有）。

我的尝试

openssl dgst -sha1 -sign ../keys/client.pem -out sign.sha1 response.xml

# readable base64

openssl enc -base64 -in sign.sha1 -out sign.sha1.base64

我正在参考本教程https://opensource.com/article/19/6/cryptography-basics-openssl-part-2

是否可以用openssl签名xml文档

0 个答案: