| Subject: | documentation fix: certs must be separate for setPublicKey |
I just spent ages trying to find out why my certificate chain wouldn't
be included in the signed message such that mailers can fully verify the
signature. Turns out that, while 'openssl smime -sign -certfile
chain.pem ...' is happy to accept several certificates in the chain.pem
file, smime->setPublicKey($crt) is unable to deal with more than one
certificate contained in the $crt string (only the first certificate in
$crt is used). That is, chain.pem must be split into an array like so:
my @chain;
my $chainfile = do { local(@ARGV, $/) = "chain.pem"; <> };
push @chain, $1 while ($chainfile =~ /(-----BEGIN
CERTIFICATE-----.*?-----END CERTIFICATE-----)/sg);
$smime->setPublicKey(\@chain);
If this cannot be accommodated for in Crypt::SMIME, perhaps a note could
be added to the documentation of setPublicKey that several certificates
have to be added as separate array elements and can neither be added as
one long string (only the first would be used) nor through separate
calls to setPublicKey (new call erases previously installed certificates)?
Thanks,
Florian