我需要你的支持。我想使用我的憑證和第三方憑證進行 pkcs 加密。
我有以下元件並想要 pkcs7 加密的輸出檔。
原始檔：PayFile_143_2300000004_20170508_161457.txt 我的登入憑證：
mycertificate.cer 及其私鑰是 keyfile.key 第三方銀行憑證(public) : public_2017-2018_base64enc.cer
所以，如果我使用下面的命令
openssl smime -sign -signer mycertificate.cer -inkey keyfile.key -in PayFile_143_2300000004_20170508_161457.txt | openssl smime -encrypt -out PayFile_143_2300000004_20170508_161457.txt.smime public_2017-2018_base64enc.cer mycertificate.cer
我會得到正確的輸出PKCS7加密的輸出檔嗎？請告訴我。
但是當銀行在終端解密時，他們面臨標頭問題
以下是銀行提供的解密日誌
starting ReceiveMsg...
logging in...
login successful
getting decryption key and verification certificate...
decryption key and verification certificate extracted
creating mime session
session created
opening mime envelope
message Content-Type [application/x-pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"]
message Content-Description [null]
message Content-Disposition [attachment]
message Content-Transfer-Encoding [base64]
getting mime message content
content handler [oracle.security.crypto.smime.SmimeEnveloped]
---------------------------------------
processing encrypted content
content decrypted
decrypted Content-Type [multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boundary="----DA713A069014AEA715F4E38046E2CA0F"]
content handler [oracle.security.crypto.smime.SmimeMultipartSigned]
-Multipart 1-
Multipart Content-Type [multipart/signed; protocol="application/pkcs7-signature";
boundary="SMS:gW4H/s2Z6GzgMG1DTTNnUi3TmH8="]
Multipart contains [2] body parts
Part 0 Content-Type [text/plain]
Part 0 Content-Description [null]
Part 0 Content-Disposition [null]
Part 0 Content-Transfer-Encoding [null]
Part 0 Content-ID [null]
Part 0 Content-Language [null]
Part 0 Content-MD5 [null]
Part 0 File-Name [null]
Part 0 Header name [], value [20:61]
Part 0 Header name [], value [23B:CRED]
Part 0 Header name [], value [32A:170508RUB100,00]
Part 0 Header name [], value [50K:/40702810200101102376]
Part 0 Header name [???7743170710.???774301001], value [???7743170710.???774301001]
Part 0 Header name [], value [57D://RU044525460.40702840401735933455]
Part 0 Header name [??? ?????????], value [??? ?????????]
Part 0 Header name [115054, ?????????? ???????, ??? 2, ?????], value [115054, ?????????? ???????, ??? 2, ?????]
Part 0 Header name [??????,,RU,], value [??????,,RU,]
Part 0 Header name [], value [59:/40702840401735933455]
Part 0 Header name [???7704662571.???770901001], value [???7704662571.???770901001]
Part 0 Header name [??? "????? ?????? ????? ???????"], value [??? "????? ?????? ????? ???????"]
Part 0 Header name [,??.???????? ???,9], value [,??.???????? ???,9]
Part 0 Header name [??????,,RU,105064], value [??????,,RU,105064]
Part 0 Header name [], value [70:??????????, ???????? ???? ????????? ? ????????????]
Part 0 Header name [], value [71A:SHA]
Part 0 Header name [], value [72:/RPP/61.170508.3.ELEK.170508]
content handler [java.lang.String]
-Multipart 1-
Content-Type=Cp1251
charset=null
writing text mime data to file
data length=0
data =
done...
您能檢查一下並讓我知道問題出在哪裡嗎
感謝你的幫助 ！謝謝尼基爾
答案1
看起來銀行正在解密，但無法解析代表簽署文件的 SMIME。這是透過電子郵件發送的嗎？您是否嘗試過使用“-outform PEM”更改簽名文件的格式？
openssl smime -sign -signer mycertificate.cer -inkey keyfile.key -in PayFile_143_2300000004_20170508_161457.txt -outform PEM | openssl smime -encrypt -out PayFile_143_2300000004_20170508_161457.txt.smime public_2017-2018_base64enc.cer mycertificate.cer
這是一個發送簽名和加密訊息的簡短腳本。將環境變數替換為您和您的銀行的值。另請注意，我使用 cert.pem 和 key.pem。這只是我的偏好，以便我可以輕鬆識別憑證和金鑰檔案是 PEM 還是 DER 格式。這是在 CentOS 7 上編寫並測試的，使用 OpenSSL 1.0.1e-fips 2013 年 2 月 11 日。
#!/bin/bash
FROM="Your Name <[email protected]>"
FROMCERT=cert.pem
FROMKEY=key.pem
[email protected]
TOCERTS="bankcert.pem cert.pem"
SUBJECT="Signed and Encrypted Email Test - $(date)"
(echo -e "Content-Type: text/plain; charset=windows-1251\n"; cat file.txt) \
| openssl smime -sign \
-signer ${FROMCERT} \
-inkey ${FROMKEY} \
| openssl smime -encrypt \
-from "${FROM}" \
-to "${TO}" \
-subject "${SUBJECT}" \
-des3 \
${TOCERTS} \
| sendmail -t -f "${FROM}" -F "${FROM}"