<turbo-stream action="append" target="posts_list"><template>    <div class="postbit" id="29002" data-post-id="29002">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="voltone" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/voltone/120/24672_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  voltone
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Erlang and Elixir do not include a trust store. The <a href="https://github.com/hexpm/hex" rel="noopener nofollow ugc">Hex client</a> does, as explained in the README file, and there is a package on Hex called <a href="https://hex.pm/packages/certifi" rel="nofollow">certifi</a> that is used by the Hackney and HTTPoison HTTP clients.</p>
<p>BTW, I haven’t looked closely at the Java code, but I believe it does more than just verify the certificate chain: it also checks for a certain hostname in the peer certificate SAN extension (in Erlang 19.3 you can use <code>:public_key.pkix_verify_hostname(cert, dns_id: 'example.net')</code> for that), and uses the certificate’s public key to verify the request signature (use <code>:public_key.verify/4</code>, avoid using <code>:crypto</code> directly)</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="29002" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/x-509-request-cert-chain-validation-plug-for-alexa-skills/4463/12">Post #11</a>
	                </div>
	            </div>
              <div id="likers-container-29002" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="29002"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #11"></div>
  </section>
</div>
    <div class="postbit" id="29010" data-post-id="29010">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="cgraham" src="/assets/icons/user-9f439610.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  cgraham
                    <span class="op-star" title="Thread Starter">
                      <img alt="OP" class="op-star-icon" src="/assets/thread-icons/thread-icon-thread-starter-df91e872.png" />
                    </span>
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Thanks Voltone.  I’ll look into those libraries.</p>
<p>And I got verify_hostname working separately (it required an update to erlang 19.3 which I did not figure out for a bit).  As for the signature verification, I am now in the midst of the fun of redoing the endpoint parsers to get the raw body so that I can verify the signature.  (That’s the only way I have discovered to get the raw body as it is removed by the json parser otherwise).</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="29010" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/x-509-request-cert-chain-validation-plug-for-alexa-skills/4463/13">Post #12</a>
	                </div>
	            </div>
              <div id="likers-container-29010" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="29010"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #12"></div>
  </section>
</div>
    <div class="postbit" id="29031" data-post-id="29031">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="cgraham" src="/assets/icons/user-9f439610.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  cgraham
                    <span class="op-star" title="Thread Starter">
                      <img alt="OP" class="op-star-icon" src="/assets/thread-icons/thread-icon-thread-starter-df91e872.png" />
                    </span>
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>So I got the verification of the signature working great - thanks to your all help!  Path verification works, domain verification works, and I even got caching of the cert working with ConCache so that it won’t keep fetching and validating the cert chain for every request.</p>
<p>I am unfortunately now having problems with message / signature verification.</p>
<p>The :public_key.verify function has Msg, digest, signature, and Key parameters.</p>
<p>I am confused as to what exactly I should be putting into the digest and key parameters.</p>
<p>Specifically, for the digest parameter, do I put in an :rsa atom?  or something else?<br>
And for the key parameter, do I put in the top cert from the chain or do I need to further convert it. It says it requires an rsa_public_key but we only have Certificates.</p>
<p>I have tried looking at the erlang example docs but to no avail.</p>
<p>Here are quick links to the docs in case they help.</p><aside class="onebox allowlistedgeneric" data-onebox-src="https://www.erlang.org/doc/apps/public_key/public_key.html">
  <header class="source">

      <a href="https://www.erlang.org/doc/apps/public_key/public_key.html" target="_blank" rel="noopener nofollow">erlang.org</a>
  </header>

  <article class="onebox-body">
    

<h3><a href="https://www.erlang.org/doc/apps/public_key/public_key.html" target="_blank" rel="noopener nofollow">public_key — OTP 29.0.2 (public_key 1.21.2)</a></h3>



  </article>

  <div class="onebox-metadata">
    
    
  </div>

  <div style="clear: both"></div>
</aside>
<aside class="onebox allowlistedgeneric" data-onebox-src="https://www.erlang.org/doc/apps/public_key/using_public_key.html">
  <header class="source">

      <a href="https://www.erlang.org/doc/apps/public_key/using_public_key.html" target="_blank" rel="noopener nofollow">erlang.org</a>
  </header>

  <article class="onebox-body">
    

<h3><a href="https://www.erlang.org/doc/apps/public_key/using_public_key.html" target="_blank" rel="noopener nofollow">Examples — OTP 29.0.2 (public_key 1.21.2)</a></h3>



  </article>

  <div class="onebox-metadata">
    
    
  </div>

  <div style="clear: both"></div>
</aside>

<p>This is I believe the last step so any help would be appreciated!</p>
<p>Thank you guys so much once again!</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="29031" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/x-509-request-cert-chain-validation-plug-for-alexa-skills/4463/14">Post #13</a>
	                </div>
	            </div>
              <div id="likers-container-29031" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="29031"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #13"></div>
  </section>
</div>
    <div class="postbit" id="29033" data-post-id="29033">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="xlphs" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/xlphs/120/12168_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  xlphs
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>I think you might be confused with how verification works. The message cannot be encrypted directly using private key, you need to use a hash function like sha1 to hash it into a fixed number of bytes, then encrypt that with private key, the result is a signed digest. On the other hand, when you have the message and signed digest and public key, you hash the message using the same hash function, then verify the signed digest using public key.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="29033" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/x-509-request-cert-chain-validation-plug-for-alexa-skills/4463/15">Post #14</a>
	                </div>
	            </div>
              <div id="likers-container-29033" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="29033"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #14"></div>
  </section>
</div>
    <div class="postbit" id="29036" data-post-id="29036">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="cgraham" src="/assets/icons/user-9f439610.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  cgraham
                    <span class="op-star" title="Thread Starter">
                      <img alt="OP" class="op-star-icon" src="/assets/thread-icons/thread-icon-thread-starter-df91e872.png" />
                    </span>
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Sorry xlphs, I might not have been clear.  I have the signed digest (I called that a “signature”), I have the raw message, and I have the X509 public certificate chain (which i presume has the key). I am trying to use :public_key.verify with those but haven’t figured out how to get it to work.  In particular, I haven’t figured out what to put for the sha and key parameters.  Do I use the  first certificate from the chain as the key?</p>
<p>And what do I use as the second parameter - do I use the atom :sha?</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="29036" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/x-509-request-cert-chain-validation-plug-for-alexa-skills/4463/16">Post #15</a>
	                </div>
	            </div>
              <div id="likers-container-29036" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="29036"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #15"></div>
  </section>
</div>
    <div class="postbit" id="29037" data-post-id="29037">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="xlphs" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/xlphs/120/12168_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  xlphs
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>The public key should be the peer certificate I think, so yes the first cert from the chain. Second parameter is the hash function used to hash message into a fixed length digest, if you are supposed to use SHA1 hash then yes put <code>:sha</code>.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="29037" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/x-509-request-cert-chain-validation-plug-for-alexa-skills/4463/17">Post #16</a>
	                </div>
	            </div>
              <div id="likers-container-29037" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="29037"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #16"></div>
  </section>
</div>
    <div class="postbit" id="29041" data-post-id="29041">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="cgraham" src="/assets/icons/user-9f439610.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  cgraham
                    <span class="op-star" title="Thread Starter">
                      <img alt="OP" class="op-star-icon" src="/assets/thread-icons/thread-icon-thread-starter-df91e872.png" />
                    </span>
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Thanks for validating, xlphs.  I am realizing the public key is inside of the certificate and not the certificate itself.  It seems like it is a proplist/record in erlang and people are accessing it as follows:</p>
<pre><code>Decoded = decoded_cert

   PublicKey = Decoded#'OTPCertificate'.tbsCertificate#'OTPTBSCertificate'.subjectPublicKeyInfo#'OTPSubjectPublicKeyInfo'.subjectPublicKey,
</code></pre>
<p>In Elixir this is coming across as multiple tuples with atoms as the first value.   Is there a easy way to traverse the tuple in Elixir? I am afraid to use pattern matching for the tuples as I am not sure if there is variability among the number of entries in each tuple (i.e OTPCertificate tuple may be 2 or 3 values, etc…) and I am not sure if the placement in the tuple is variable as well (i.e. OTPSubjectPublicKeyInfo might be the 2nd or 5th entry in the subjectPublicKeyInfo tuple).  Do I have to use Record in Elixir and re-define a series of Records for each of these?</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="29041" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/x-509-request-cert-chain-validation-plug-for-alexa-skills/4463/18">Post #17</a>
	                </div>
	            </div>
              <div id="likers-container-29041" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="29041"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #17"></div>
  </section>
</div>
    <div class="postbit" id="29046" data-post-id="29046">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="outlog" src="/assets/icons/user-9f439610.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  outlog
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>not saying the code is pretty but hope it helps..</p>
<pre><code>def verify do
  Application.ensure_all_started :inets
  Application.ensure_all_started :ssl
  Application.ensure_all_started :public_key

  {:ok, resp} = :httpc.request(:get, {'https://s3.amazonaws.com/echo.api/echo-api-cert.pem', []}, [], [body_format: :binary])
  {_, _headers, body} = resp

  certs = :public_key.pem_decode(body)
  for {_,raw_cert,_} &lt;- certs do
    decoded = :public_key.pkix_decode_cert(raw_cert, :otp)
    case decoded do
      {:OTPCertificate,
       {:OTPTBSCertificate, _, _, _, _, validity, _,
        {:OTPSubjectPublicKeyInfo, _, key}, _, _, extensions}, _, _} -&gt;
        for {:Extension, _, _, val} &lt;- extensions do
          case val do
          	[dNSName: uri] -&gt;
                    #do more validation
          		if uri == 'echo-api.amazon.com' do
          		  IO.inspect "WOHOOO"
                   #do some validation here
                   {:Validity, {:utcTime, from}, {:utcTime, to}} = validity
                   IO.inspect from
                   IO.inspect to
                   IO.inspect key
          		end
          	_ -&gt;
          		IO.inspect "NO"
          end
        end
    end
  end
end
</code></pre> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="29046" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/x-509-request-cert-chain-validation-plug-for-alexa-skills/4463/19">Post #18</a>
	                </div>
	            </div>
              <div id="likers-container-29046" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="29046"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #18"></div>
  </section>
</div>
    <div class="postbit" id="29051" data-post-id="29051">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="voltone" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/voltone/120/24672_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  voltone
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Using Record would be the proper way to do it. Something like:</p>
<pre data-code-wrap="elixir"><code class="lang-elixir">require Record

Record.defrecordp :otp_tbs_certificate, :OTPTBSCertificate,
  Record.extract(:OTPTBSCertificate, from_lib: "public_key/include/OTP-PUB-KEY.hrl")
# and so on...
</code></pre>
<p>However, since the structures of these records are unlikely to change, as they are built directly from the X.509 specifications, a shortcut might be acceptable. So you could do this instead:</p>
<p><code>public_key_der = cert |&gt; elem(1) |&gt; elem(7) |&gt; elem(2)</code></p>
<p>You’d have to decode the binary key before you pass it into <code>verify/4</code>:</p>
<p><code>public_key = :public_key.der_decode(:RSAPublicKey, public_key_der)</code></p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="29051" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/x-509-request-cert-chain-validation-plug-for-alexa-skills/4463/20">Post #19</a>
	                </div>
	            </div>
              <div id="likers-container-29051" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="29051"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #19"></div>
  </section>
</div>
    <div class="postbit" id="29097" data-post-id="29097">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="OvermindDL1" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/OvermindDL1/120/2677_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  OvermindDL1
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>This would make an <em>awesome</em> elixir library when you are done.  <em>*hint*hint*</em>  ^.^</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="29097" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/x-509-request-cert-chain-validation-plug-for-alexa-skills/4463/21">Post #20</a>
	                </div>
	            </div>
              <div id="likers-container-29097" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="29097"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #20"></div>
  </section>
</div>
</template></turbo-stream><turbo-stream action="replace" target="load-more-container"><template><div id="load-more-container" class="load-more-container">
    <a class="load-more-button" data-turbo-stream="true" href="/topics/4463/load_more?page=3">Load more posts (4 remaining)</a>
</div></template></turbo-stream>