Our microservice exposes its own API supports two relevant methods:
one which lists all the certificate aliases available (every alias represents one certificate available to be used in the signature)
one which does the signing which takes 3 arguments
Swagger file:
signature-service.json
03 lip 2020, 12:16 PM
Of those three arguments:
alias is the name of the cert to be used - in case the service supports multiple certs, it is mostly used for sandboxes where there are sometimes certs provided by banks to be used on the sandbox, so one certificate per environment is insufficient
hash algorithm to be used - currently, based on what we've encountered connecting to different banking APIs, we support three values here:
rsa-sha256 (representing attributes: padding - Pkcs1, algorithm - SHA256, encoding - base 64 encoded) - used by HTTP message signing,
ps256 (attributes: padding - Pss, algorithm - SHA256, encoding - base 64 URL encoded ) - used by JWS signature
rs256 (attributes: padding - Pkcs1, algorithm - SHA256, encoding - base 64 URL encoded ) - used by JWS signature
The algorithms list is sufficient to support both JWS signature and HTPP Message Signing as described here https://tools.ietf.org/html/draft-cavage-http-signatures-11.