Intermittent false Certificate Password Invalid. for legacy PKCS#12 certificates

[vkywalker]

We are still experiencing an intermittent Certificate Password Invalid issue in v3.0.0. We also observed it in earlier releases.

We suspect an OpenSSL error-queue handling issue.

We are seeing intermittent Certificate Password Invalid exceptions while signing PDFs with valid PKCS#12 certificate passwords.
The same password, left unchanged in the same browser field, could fail several times and then sign successfully.
Failures returned almost immediately, while successful signing took a few seconds.

Our logging showed that failed and successful attempts used identical inputs:

• same certificate byte length
• same certificate SHA-256
• same PDF byte length and SHA-256 for the same document version
• same password length

Workaround applied which works for us:
clear the OpenSSL error queue immediately before calling JSignPDF::sign()

private function clearOpenSslErrors(): array
{
$errors = [];

while (($error = openssl_error_string()) !== false) {
    $errors[] = $error;
}

return $errors;

}

Possible patch the vendor library so pkcs12Read():

1. Drain stale OpenSSL errors before openssl_pkcs12_read(). If it fails, collect all resulting errors.
2. If any collected error contains digital envelope routines::unsupported, use the existing legacy PKCS#12 repack flow.
3. After repacking, verify that openssl_pkcs12_read() succeeds.

[vitormattos]

Thanks for your help reporting this.

I was able to reproduce the issue with a regression test using a legacy PKCS#12 certificate and different pre-existing OpenSSL errors.

The tests failed with the previous implementation with Certificate Password Invalid. and pass with the fix applied.

This was fixed in #67 and released in v3.2.1.

Thanks for identifying the OpenSSL error queue as the likely cause.

Could you test again with the newest release?

[vitormattos]

By the way, if you're also looking at a native PHP signing path without JSignPdf/Java, we're working on SignerPHP. It's already being integrated into LibreSign, but it's a separate project and still evolving.

[vkywalker]

Thanks for looking into this and for the fix!
The workaround is working for us for now, so I’ll test v3.2.1 internally as soon as I get some time and will report back with the results.