How to verify sign using X509 Certificates

Questions & Help Questions
1

I have a requirement that using Certificates begins with -----BEGIN CERTIFICATE----- to verify signatures.
It’s unlike public key that can do with:

[entry] = :public_key.pem_decode(public_key_string)
pub_key = :public_key.pem_entry_decode(entry)
:public_key.verify(...)

I have search to where describe the Certificates Examples — OTP 29.0.2 (public_key 1.21.2) . But cannot figure out how to solve it.

2

I would look into the X509 hex package, the git repo has some tests that do a sign/verify see here:
https://github.com/voltone/x509/blob/3129908471ab32b7c7ac3e8080b564fa52fccccd/test/x509/public_key_test.exs

3

You’ll have to extract the public key from the certificate. While it is possible to do that directly using :public_key, with help of some Record imports, you may want to use the x509 package to simplify things:

{:ok, certificate} = X509.Certificate.from_pem(certificate_string)
public_key = X509.Certificate.public_key(certificate)
:public_key.verify(message, :sha256, signature, public_key)

Depending on the signature algorithm (ECDSA, RSASSA-PKCS1_5, RSASSA-PSS, …) it may be necessary to pass in additional options.

4

Thanks! @rjk and @voltone