IOS 应用内购买收据 AppleInc 根 CA 验证

Question

我目前正在尝试实现一种本地收据验证形式，详见 apple's developer portal :

但是我遇到了障碍。我相信收据中的证书没有正确验证苹果根 CA。

87937:error:04077068:rsa routines:RSA_verify:bad signature:rsa_sign.c:263:87937:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:a_verify.c:179:87937:error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error:pk7_smime.c:244:Verify error:certificate signature failure

运行 gdb 显示失败发生在这里:

(gdb) bt

#0 RSA_verify (dtype=64, m=0xbfffe1b4 "", m_len=20, sigbuf=0x37af90 "", siglen=256, rsa=0x37ca80) at rsa_sign.c:263

#1 0x0013e6fa in EVP_VerifyFinal (ctx=0xbfffe2b0, sigbuf=0x37af90 "", siglen=256, pkey=0x37ca60) at p_verify.c:107

#2 0x00152b38 in ASN1_item_verify (it=0x20b118, a=0x37a5b0, signature=0x37a5c0, asn=0x37a460, pkey=0x37ca60) at a_verify.c:176

#3 0x0018e73c in X509_verify (a=0x37a400, r=0x37ca60) at x_all.c:76

#4 0x001866ef in internal_verify (ctx=0xbffff5a8) at x509_vfy.c:998

#5 0x00185ad9 in X509_verify_cert (ctx=0xbffff5a8) at x509_vfy.c:305

#6 0x001b4f1d in PKCS7_verify (p7=0x3792c0, certs=0x0, store=0x379160, indata=0x0, out=0x379260, flags=0) at pk7_smime.c:240

#7 0x00001dd6 in main () at pkcs7_decrypt.c:42Current language: auto; currently minimal(gdb)

无法根据中间证书“/C=US/O=Apple Inc./OU=Apple Worldwide Developer Relations/CN=Apple Worldwide Developer Relations Certification Authority”验证根 CA 的公钥。

直接针对中间证书运行 openssl verify 会产生类似的结果，尽管我可能没有正确执行此操作:

bbooth@Bills-MacBook-Air:forge$ openssl verify -verbose -CAfile apple.pem devrel.pem

devrel.pem: /C=US/O=Apple Inc./OU=Apple Worldwide Developer Relations/CN=Apple Worldwide Developer Relations Certification Authority

error 7 at 0 depth lookup:certificate signature failure

88161:error:04077068:rsa routines:RSA_verify:bad signature:/SourceCache/OpenSSL098/OpenSSL098-47.2/src/crypto/rsa/rsa_sign.c:263:

88161:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:/SourceCache/OpenSSL098/OpenSSL098-47.2/src/crypto/asn1/a_verify.c:179:

bbooth@Bills-MacBook-Air:forge$

这是我在 OSX 中运行的代码:

fp = fopen("AppleIncRootCertificate.cer", "rb");
fread(buf, sizeof(buf), 1, fp);
b_x509 = BIO_new_mem_buf(buf, 1215);

Apple = d2i_X509_bio(b_x509, NULL);
fclose(fp);

X509_STORE *store = X509_STORE_new();
X509_STORE_add_cert(store, Apple);

bio = BIO_new_file("receipt.cer", "r");
p7 = d2i_PKCS7_bio(bio, NULL);
BIO_free(bio);

ERR_print_errors_fp(stdout);
bio = BIO_new_file("receipt.dec", "w");
PKCS7_verify(p7, NULL, store, NULL, bio, 0);

随意看the receipt .我必须承认，我是这个问题涉及的几乎所有系统的新手，我们将不胜感激任何和所有建议!

Answer 1

所以解决方案很简单，收据以某种方式损坏(尽管能够解析它)。将此收据发送到应用商店收据验证程序会产生收据数据格式错误。

我重试了收据上的代码，在苹果服务器上验证没有错误，它工作正常。