We're using OpenSSL to parse and verify the certificate and signature that Amazon's Alexa sends to external web services, following their list of requirements in the instructions here.

We're successfully extracting the public key, checking the start/end dates of the certificate, verifying that echo-api.amazon.com is the subject of the certificate, and verifying the chain of trust (by using OpenSSL command line functions).

But we're stuck at the point where the Amazon documentation says to "Use the public key extracted from the signing certificate to decrypt the encrypted signature to produce the asserted hash value."

Is this possible with OpenSSL? The openssl "rsautl -decrypt" command is only for private keys (both the documentation and our tests confirm this, and public keys are rejected, even with the -pubin option).

Alternately, is there a way to get the openssl dgst -verify to work for the Alexa signature verification?

We're testing these commands:

openssl base64 -d -in (signature_file) -out /tmp/sign.sha256 
openssl dgst -sha256 -verify (pub-key_file) -signature /tmp/sign.sha256 (file)

We've used ColdFusion's getHttpRequestData().headers["Signature"] function to get the signature:


And the Coldfusion GetHttpRequestData().content function returns the JSON structure sent to the web service:


               "value":"top news"

Here's the public key:

-----END PUBLIC KEY-----

But the openssl dgst always returns a message of "Verification Failed" when we use the openssl dgst -verify with files containing the signature (trying raw and Base64-decoded) and http request body (listed above).

1 Answer 1


First, Amazon and you are repeating a common but wrong trope; signature is not encryption with the private key -- not even for RSA, where there is enough similarity in the mathematical underpinning that it is dangerously appealing to think this even though there are vital differences in the actual schemes and trying to interchange them leads to very bad results, and totally completely not at all for other algorithms like DSA and ECDSA. See:
Trying to understand RSA and it's terminology?
Is encrypting data with a private key dangerous?
If the public key can't be used for decrypting something encrypted by the private key, then how do digital signatures work?
Understanding digitial certifications
Digital Signature and Verification?
With GPG, can you "decrypt" a file that hasn’t been encrypted?
Why should I sign data that's already encrypted?
Is encrypting data with a private key dangerous?
Does RSA encryption always pad small amounts of data to some larger size?
Encrypt with private and decrypt with public
(some of which I admit are hard to find unless you know what you are looking for).

That said, openssl rsautl can recover the signed (and padded) encoded hash from a signature using the -verify option, and the newer pkeyutl with (clearer) -verifyrecover; given your de-base64-ed signature in temp.sig and your publickey in temp.key:

$ openssl rsautl -verify -pubin -inkey temp.key <temp.sig |openssl asn1parse -inform der
    0:d=0  hl=2 l=  33 cons: SEQUENCE
    2:d=1  hl=2 l=   9 cons: SEQUENCE
    4:d=2  hl=2 l=   5 prim: OBJECT            :sha1
   11:d=2  hl=2 l=   0 prim: NULL
   13:d=1  hl=2 l=  20 prim: OCTET STRING      [HEX DUMP]:AE2F2DD493F3E58F62E9F20678D9A05B86E06F8A

Observe this is a SHA-1 hash, as stated on the Amazon page you link, not SHA-256, and does match the SHA-1 hash of your data -- from edit 3 or earlier, before Anders added spaces and newlines which makes the signature fail because the entire point of digital signature is to detect and reject any change to the signed data:

 $ openssl sha1 <temp.dat
 (stdin)= ae2f2dd493f3e58f62e9f20678d9a05b86e06f8a

and thus can be verified with dgst -verify

 $ openssl sha1 <temp.dat -verify temp.key -signature temp.sig
 Verified OK
  • Is the Wikipedia article at en.wikipedia.org/wiki/RSA_(cryptosystem)#Signing_messages also repeating the same wrong trope, where it states, a private key of a key pair may be used to...Encrypt a message which may be decrypted by anyone, but which can only be encrypted by one person; this provides a digital signature.
    – mti2935
    Commented Oct 7, 2020 at 17:07
  • mti: yes -- but the immediately preceding para got it right by saying sign/verify use modexp "as ... when decrypting/encrypting ..." (emphasis added). Unfortunately wikipedia accepts some of its content from humans; you may want to complain to them. Commented Oct 9, 2020 at 2:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .