0

I am creating an API endpoint that receives payload from a third party. The third party is signing the request with there X509 Certificate(Private Key). I have been provided with their Public Certificate. How do I verify that the incoming request has a valid Signature using the Public Certificate that I have via Apache?

I have tried a few of the things, which is not working:

  • I kept SSLVerifyClient require along with SSLVerifyDepth 10 in the Apache httpd config, and then kept their client certificate in the trusted Store.
  • I kept SSLOptions +ExportCertData and verified SSL_CLIENT_CERT Environment Variable at the application end whether I am getting there Client Certificate in the Request that I am receiving. Although the Environment variable does not have any Cerificate in it.

How can I verify the Signed Request? Please guide me if I am looking into a wrong direction in order to verify the Request.

|improve this question
  • SSLVerifyClient is for verification of client certificates which is not a "Signed Request" but only used for authentication. There is no such thing in HTTP/HTTPS so you probably refer to some application specific thing which need to be verified in your application, i.e. not in Apache. Maybe one can help further if you provide more information what exactly this "Signed Request" is, i.e. link to some documentation or standards which describe the behavior of your client. – Steffen Ullrich Oct 9 '16 at 6:22
  • The Third Party is Docusign. My Application endpoint is receiving this Request and consuming the documents via there Connect API. And they have an option for "Sign with X509 Certificate" in there Connect API. I want to verify this signature in my application. – Richa Sinha Oct 9 '16 at 15:02
1

The digital signature of the payload is from Docusign as you've stated in a comment. This payload signature is unrelated to HTTPS and thus can not be verified at the HTTP level in Apache. This means any attempts to use SSLVerifyClient or similar will not work.

From a short look at their documentation it does not look like that DocuSign employs some standardized signature format everybody could verify. Also their API and SDK seem to offer signing only but not signature verification. It might be part of their business model to control this part. But for more details look at their API documentation yourself (maybe I've missed something) or contact Docusign.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.