digital signature in xml files for E-social

Question

Hello, I need to clear the doubt about the signature in the xml sending to the E-social, see I am basing the article Problem with eSocial digital signature - Invalid signature I have the following doubts:

$objXMLSecurityDSig->add509Cert(file_get_contents('/path_para_chave_PEM_publica'));

This key would be what exactly? It comes from the chain of certificates that the E-social asks to be installed in the machine that will make the access?

The same doubt applies here

$objXMLSecurityKey->loadKey('/path_para_chave_PEM_privada', TRUE);

In another case I have the following:

'local_cert' => '/path_para_chaves_PEM_privada_e_publica_combinadas_em_um_unico_arquivo',

this left me with more questions, has this configured public and private key in a single file?

Use the library PHP library for digital signature of xml files

Answer 1

I don’t know PHP, and had never seen the library Xmlseclibs of Robrichards, but, I’m also developing for eSocial (.NET) and know something of the procedure of how to sign events and how to communicate to the service, so I’ll try to help.

You said you were having doubts in those three passages, regarding the certificate:

$objXMLSecurityDSig->add509Cert(file_get_contents('/path_para_chave_PEM_publica'));

$objXMLSecurityKey->loadKey('/path_para_chave_PEM_privada', TRUE);

'local_cert' => '/path_para_chaves_PEM_privada_e_publica_combinadas_em_um_unico_arquivo',

eSocial requires a digital certificate A1 or A3, both to sign events and to communicate with the service. In Windows, the A1 certificate usually comes in a file .pfx, which contains the public key and the private key, and you can install that file on Windows and use it from the Windows certificate repository, or open the file directly. In my case I’m always getting the certificate installed in the Windows repository.

Like I said, I don’t know the library Xmlseclibs, so I can’t tell if she directly accepts a file .pfx or if it accepts only files .pitch, but, I did a quick search and found that the files .pitch can also store public key and private key such as file .pfx, and, it is possible to convert a file format .pfx for the format .pitch.

Here are some links that explain this better:

Summary of Digital Certificate - Knowledge Base
http://fantastsoft.com.br/basecon/base-conhecimento/resumo-sobre-certificado-digital/

SECURITY, What are the differences between PEM, DER, P7B / PKCS # 7, PFX / PKCS # 12 certificates?
https://discursa.rknet.top/t/seguranca-quais-sao-as-diferencas-entre-os-certificados-pem-der-p7b-pkcs-7-pfx-pkcs-12/258

Conversion of CA certificate (TYPE A1) from PFX to PEM
https://www.rafaeltheodoro.com.br/nfe/conversao-de-certificado-ca-tipo-a1-de-pfx-para-pem/

So I guess you can catch one A1 digital certificate valid in format .pfx and convert it to a file .pitch, as in the link examples (using some application Openssl):

openssl pkcs12 -in certificado.pfx -out certificado.pem –nodes

Done that I imagine you can use that file certified.pem. in all 3 lines you were in doubt because it will contain the public key and the private key of your A1 certificate, and it is your A1 certificate that is required to sign eSocial events and to open communication with the eSocial service (the first two lines of doubt refer to the signature, and the third refers to the transmission).

This certificate used for the signature must have the same root CNPJ of the employer whose events are being signed (or CPF), or it may be another CNPJ/CPF provided that you have done an electronic power of attorney on the site e-CAC of Receita Federal.