verifying a file signature with openssl dgst

Question

I am signing packets in some Java code and I want to verify the signatures on a C server. I want to fork openssl for this purpose (can always use library functions later... when I know openssl can verify the signatures); however, it's failing to do so: ``` openssl dgst -verify cert.pem -signature file.sha1 file.data ``` - all it says is "unable to load key file" The certificate says: ``` openssl verify cert.pem cert.pem: /C=.... error 20 at 0 depth lookup:unable to get local issuer certificate ``` However, I specifically don't care about verifying the certificate, I want only to verify the signature for a given file! The output of `openssl x509 -in cert.pem -noout -text` is: ``` Certificate: Data: Version: 1 (0x0) Serial Number: ... Signature Algorithm: sha1WithRSAEncryption Issuer: C=... Validity Not Before: Feb 1 15:22:44 2010 GMT Not After : Jun 19 15:22:44 2037 GMT Subject: C=... Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048…

Accepted Answer

`openssl dgst -verify foo.pem` expects that `foo.pem` contains the "raw" public key in PEM format. The raw format is an encoding of a `SubjectPublicKeyInfo` structure, which can be found within a certificate; but `openssl dgst` cannot process a complete certificate in one go.

You must first extract the public key from the certificate:

```
openssl x509 -pubkey -noout -in cert.pem > pubkey.pem
```

then use the key to verify the signature:

```
openssl dgst -verify pubkey.pem -signature sigfile datafile
```

verifying a file signature with openssl dgst

Solution

Problem