ream88
Hello Elixir community,
I’m currently working on an app that delivers Apple Wallet passes to its users. Basically I followed the official guidelines, and implemented most of the stuff directly in Elixir. However to correctly sign the passes, Apple states the following:
To create the signature file, make a PKCS #7 detached signature of the manifest file, using the private key associated with your signing certificate. Include the WWDR intermediate certificate as part of the signature. You can download this certificate from Apple’s website. Write the signature to the file
signatureat the top level of the pass package. Include the date and time that the pass was signed using the S/MIMEsigning-timeattribute.
This sounds like alien language to me 
. Thankfully I also found the these guidelines which states the following command to properly sign the pass:
openssl smime -binary -sign -certfile WWDR.pem -signer passcertificate.pem -inkey passkey.pem -in manifest.json -out signature -outform DER -passin pass:12345
Everything works quite well, however is there a way to do the same without the openssl dependency? I found the :public_key application which is shipped with OTP, but as already mentioned, all the public key/certs stuff is very alien to me. Any ideas?
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Error tracking, logs, APM, uptime and cron monitoring in one dev-friendly platform. Find and fix problems before your users notice.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #ai
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #blog-post
- #ecto-query
- #elixirconf-us
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Bringing learning, work and compliance together since 1987.
**Building the future of software with AI, trust, and human connection.**
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 2- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
D4no0
OpenSSL is used when compiling OTP, because it uses the functionality for a lot of it’s basic libraries (crypto, public_key, ssl). The only thing you need to take in consideration is the version of OTP, older versions might have less functionality, you can read more about it here.
From what I see here it is nothing out of the ordinary, you should be able to do this even with older versions of OTP. The only problem I see is the S/MIME encoder, elixir/erlang doesn’t have a general library for dealing with MIME types, usually the libraries use their custom implementations.
If you need to get this working fast, I would just interface with the openssl directly and use the command you provided, there are no downsides as long as don’t leak processes.
voltone
Here’s something I wrote once upon a time when someone was asking about producing a PKCS#7 signature: How can I generate PKCS7 file? - #2 by voltone
Your requirement may be slightly different. The best place to start would be decoding a signature produced by OpenSSL to Erlang records using
:public_key, e.g.:public_key.der_decode(:ContentInfo, File.read!("signature"))…