Safari推送通知证书问题

Question

I have a website which uses push notifications for safari browser. It worked fine until recently when I started to receive a message saying

Signature verification of push package failed

I believe that it is connected with the recent Apple WWDRCA certificate expiration and now trying to install their new certificate into the system. Their docs say that

If you were using the openssl_pkcs7_sign function to sign your push package with only your web push certificate, you should pass the path to the renewed intermediate for the extra certificates parameter.

So my question is how to tell this function to use this new certificate, and another one, should I install their certificate into my linux system which is running Apache. I am not sure if I had a previous certificate installed in it. Thank You

Answer 1

Thanks everyone,

managed to solve the issue by adding Apple WWDRCA new certificate as a last parameter to openssl_pkcs7_sign

openssl_pkcs7_sign("$package_dir/manifest.json", $signature_path, $cert_data, $private_key, array(), PKCS7_BINARY | PKCS7_DETACHED,"/path/to/certificate/AppleWWDRCA.pem");

No additional work required. Note that the file must be converted from .cer to .pem manually.

I think this should be pointed out somewhere in docs more clearly.