jwt decode Signature verification failed

Receipt verification on my app's server suddenly started giving an error, and all billing-related processes became errors. The error that is occurring is Signature verification failed is.(FireBaseJWT throw Exception)

The code is below, but it was working fine until 3 days ago.

JWT::decode($lastTransaction['signedTransactionInfo'], $appleCertificate, ['ES256']);

The certificate used here was created by the server developer, so I don't know how to create it. Could you please help me which certificate should I use?

I tried using the ApplePKI certificate, but the same error occurred.

私のアプリのサーバでのレシート検証が突然エラーを吐くようになり、課金関連の処理が全てエラーになってしまいました。

発生しているエラーはSignature verification failedです。(FireBaseJWTのException)

コードは以下になっていますが、3日前までは正常に動作していたコードです。

JWT::decode($lastTransaction['signedTransactionInfo'], $appleCertificate, ['ES256']);

ここで利用している証明書はサーバ開発者に作成して貰っていたので作成方法が分かりません。

どの証明書を使えば良いか助けて貰えないでしょうか。

ApplePKIの証明書は粗方試してみましたが同様のエラーになっています。

Accepted Reply

Thank you for answering.

Sorry for the basic question, but is it okay to create a certificate from the information in x5c and use it?

  • Generally you would need to verify the certificate in the x5c is actually from Apple, as described in https://developer.apple.com/wwdc23/10143?time=549. Directly creating a certificate from that info would not prove the data is legitimate, because that certificate is provided with the data, not separately

Add a Comment

Replies

Thank you for reaching out. From where are you fetching the appleCertificate variable, is this hardcoded? The signing certificate rotates occasionally, and should not be hardcoded. For more information about verifying certificates, see https://developer.apple.com/wwdc23/10143?time=549

Thank you for answering.

Sorry for the basic question, but is it okay to create a certificate from the information in x5c and use it?

  • Generally you would need to verify the certificate in the x5c is actually from Apple, as described in https://developer.apple.com/wwdc23/10143?time=549. Directly creating a certificate from that info would not prove the data is legitimate, because that certificate is provided with the data, not separately

Add a Comment