I am creating an API endpoint that receives payload from a third party. The third party is signing the request with there X509 Certificate(Private Key). I have been provided with their Public Certificate. How do I verify that the incoming request has a valid Signature using the Public Certificate that I have via Apache?
I have tried a few of the things, which is not working:
- I kept SSLVerifyClient require along with SSLVerifyDepth 10 in the Apache httpd config, and then kept their client certificate in the trusted Store.
- I kept SSLOptions +ExportCertData and verified SSL_CLIENT_CERT Environment Variable at the application end whether I am getting there Client Certificate in the Request that I am receiving. Although the Environment variable does not have any Cerificate in it.
How can I verify the Signed Request? Please guide me if I am looking into a wrong direction in order to verify the Request.