Здравствуйте.
Я занялся доработкой ПО в системе SAP в части получения данных с сайта ФСС по электронному больничному листу.
На первом этапе хочу реализовать подписывание XML, отправляемого на тестовый сервис ФСС (https://docs-test.fss.ru/ws-insurer-v11/FileOperationsLnPort/getPrivateLNData) из SAP приложения.
На компьютере установлено ПО:
КриптоПро CSP 4.0.9944
КриптоПро SSF.
Настроен ssfrfc.ini:
[cpsapssf]
SSF_LIBRARY_PATH = C:\Program Files (x86)\Crypto Pro\SSF\cpsapssf.dll
SSF_TRACE_LEVEL = 1
SSF_MD_ALG = GOST3411
SSF_SYMENCR_ALG = GOST28147
ЭЦП установлена на компьютере, подпись действительна.
По спецификации ФСС требуется сформировать XML-запрос определенной структуры,
в теги запроса вложить:
1. BinarySecurityToken - публичный сертификат в формате Base64.
2. DigestValue - хэш сумма (по алгоритму ГОСТ Р 34.11-94 ) вычисленная от подписываемого элемента <body> каноникализированного по C14N (http://www.w3.org/2001/10/xml-exc-c14n#). В формате Base64.
3. SignatureValue - цифровая подпись (алгоритм ГОСТ Р 34.10-2001) вычисленная от каноникализированного по C14N блока SignedInfo. В формате Base64.
Цифровую подпись, хэш формирую в системе SAP функциональными модулями: SSF_SIGN, SSF_DIGEST (они умеют общаться с внешним криптопровайдером КриптоПро CSP 4.0.9944 установленным у меня на ПК).
Публичный сертификат считывается из файла *.cer.
Мой формированный XML-запрос прилагаю.
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" signAlgorithm="http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411">
<S:Header xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
<wsse:Security xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" S:actor="http://eln.fss.ru/actor/insurer/4210000443">
<wsse:BinarySecurityToken wsu:Id="http://eln.fss.ru/actor/insurer/4210000443" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">
MIIKCzCCCbqgAwIBAgIRAPNJ4HrEDMeA6BFWJw3Svk0wCAYGKoUDAgIDMIIBcTEeMBwGCSqGSIb3DQEJARYPY2FAc2tia29udHVyLnJ1MRgwFgYFKoUDZAESDTEwMjY2MDU2MDY2MjAxGjAYBggqhQMDgQMBARIMMDA2NjYzMDAzMTI3MQswCQYDVQQGEwJSVTEzMDEGA1UECAwqNjYg0KHQstC10YDQtNC70L7QstGB0LrQsNGPINC+0LHQu9Cw0YHRgtGMMSEwHwYDVQQHDBjQldC60LDRgtC10YDQuNC90LHRg9GA0LMxLDAqBgNVBAkMI9Cf0YAuINCa0L7RgdC80L7QvdCw0LLRgtC+0LIg0LQuIDU2MTAwLgYDVQQLDCfQo9C00L7RgdGC0L7QstC10YDRj9GO0YnQuNC5INGG0LXQvdGC0YAxKTAnBgNVBAoMINCQ0J4gItCf0KQgItCh0JrQkSDQmtCe0J3QotCj0KAiMSkwJwYDVQQDDCDQkNCeICLQn9CkICLQodCa0JEg0JrQntCd0KLQo9CgIjAeFw0xODAzMTQwNjU4MDFaFw0xOTA2MTQwNjU4MDFaMIICADEZMBcGA1UEAx4QBBAEHgAgACIEGgQfBCIAIjEZMBcGA1UEBB4QBBMEQAQwBDEEPgRABD4EMjEtMCsGA1UEKh4kBBAEOwQ1BDoEQQQ1BDkAIAQQBEAEOgQwBDQETAQ1BDIEOARHMQswCQYDVQQGEwJSVTE1MDMGA1UECB4sADQAMgAgBBoENQQ8BDUEQAQ+BDIEQQQ6BDAETwAgBD4EMQQ7BDAEQQRCBEwxIzAhBgNVBAceGgQzACAEHQQ+BDIEPgQ6BEMENwQ9BDUERgQ6MTcwNQYDVQQJHi4EIwQbACAEHwQgBB4EHAQrBCgEGwQVBB0EHQQQBC8ALAAgBBQEHgQcACAAMQA4MRkwFwYDVQQKHhAEEAQeACAAIgQaBB8EIgAiMRkwFwYDVQQMHhAENAQ4BEAENQQ6BEIEPgRAMRgwFgYFKoUDZAESDTEwMjQyMDE3NTI2MzAxFjAUBgUqhQNkAxILMDQwMTEwMTM3NTkxGjAYBggqhQMDgQMBARIMMDA0MjE2MDAzODY5MScwJQYJKoZIhvcNAQkBFhhSdXNsYW4uWXVzdXBvdkBldnJhei5jb20xMDAuBgkqhkiG9w0BCQITITQyMTYwMDM4NjktNDIyMDAxMDAxLTQyMTUwMTYxODg4MzEYMBYGCCqFAwOBDQEBEgo0MjEwMDAwNDQzMGMwHAYGKoUDAgITMBIGByqFAwICJAAGByqFAwICHgEDQwAEQNfoPE/dTv9MEVkc99r8+mr7wSZwheSYVLcRa2rS8iFkKTKwmaZv/u6ZsrQY1hzOLg9aq74wzq247kjrFRQ76dejggWWMIIFkjAOBgNVHQ8BAf8EBAMCBPAwQQYDVR0RBDowOIEYUnVzbGFuLll1c3Vwb3ZAZXZyYXouY29tpBwwGjEYMBYGCCqFAwOBDQEBEgo0MjEwMDAwNDQzMBMGA1UdIAQMMAowCAYGKoUDZHEBMEsGA1UdJQREMEIGCCsGAQUFBwMCBgcqhQMCAiIGBggrBgEFBQcDBAYHKoUDAwcIAQYIKoUDAwcBAQEGBiqFAwMHAQYIKoUDAwcAAQ8wggGFBgNVHSMEggF8MIIBeIAUoGS9i4NKZUpDs1z9mVxXpvP4e0WhggFSpIIBTjCCAUoxHjAcBgkqhkiG9w0BCQEWD2RpdEBtaW5zdnlhei5ydTELMAkGA1UEBhMCUlUxHDAaBgNVBAgMEzc3INCzLiDQnNC+0YHQutCy0LAxFTATBgNVBAcMDNCc0L7RgdC60LLQsDE/MD0GA1UECQw2MTI1Mzc1INCzLiDQnNC+0YHQutCy0LAsINGD0LsuINCi0LLQtdGA0YHQutCw0Y8sINC0LiA3MSwwKgYDVQQKDCPQnNC40L3QutC+0LzRgdCy0Y/Qt9GMINCg0L7RgdGB0LjQuDEYMBYGBSqFA2QBEg0xMDQ3NzAyMDI2NzAxMRowGAYIKoUDA4EDAQESDDAwNzcxMDQ3NDM3NTFBMD8GA1UEAww40JPQvtC70L7QstC90L7QuSDRg9C00L7RgdGC0L7QstC10YDRj9GO0YnQuNC5INGG0LXQvdGC0YCCCj7FifQAAAAAAXkwHQYDVR0OBBYEFJ4xFnpRe5UbKs2L/WXxE7xBuBubMCsGA1UdEAQkMCKADzIwMTgwMzE0MDY1ODAwWoEPMjAxOTA2MTQwNjU4MDBaMIIBMwYFKoUDZHAEggEoMIIBJAwrItCa0YDQuNC/0YLQvtCf0YDQviBDU1AiICjQstC10YDRgdC40Y8gNC4wKQxTItCj0LTQvtGB0YLQvtCy0LXRgNGP0Y7RidC40Lkg0YbQtdC90YLRgCAi0JrRgNC40L/RgtC+0J/RgNC+INCj0KYiINCy0LXRgNGB0LjQuCAyLjAMT9Ch0LXRgNGC0LjRhNC40LrQsNGCINGB0L7QvtGC0LLQtdGC0YHRgtCy0LjRjyDihJYg0KHQpC8xMjQtMjg2NCDQvtGCIDIwLjAzLjIwMTYMT9Ch0LXRgNGC0LjRhNC40LrQsNGCINGB0L7QvtGC0LLQtdGC0YHRgtCy0LjRjyDihJYg0KHQpC8xMjgtMjk4MyDQvtGCIDE4LjExLjIwMTYwIwYFKoUDZG8EGgwYItCa0YDQuNC/0YLQvtCf0YDQviBDU1AiMHYGA1UdHwRvMG0wNKAyoDCGLmh0dHA6Ly9jZHAuc2tia29udHVyLnJ1L2NkcC9rb250dXItcTEtMjAxNy5jcmwwNaAzoDGGL2h0dHA6Ly9jZHAyLnNrYmtvbnR1ci5ydS9jZHAva29udHVyLXExLTIwMTcuY3JsMIGbBggrBgEFBQcBAQSBjjCBizBDBggrBgEFBQcwAoY3aHR0cDovL2NkcC5za2Jrb250dXIucnUvY2VydGlmaWNhdGVzL2tvbnR1ci1xMS0yMDE3LmNydDBEBggrBgEFBQcwAoY4aHR0cDovL2NkcDIuc2tia29udHVyLnJ1L2NlcnRpZmljYXRlcy9rb250dXItcTEtMjAxNy5jcnQwgZMGByqFAwICMQIEgYcwgYQwdBZCaHR0cDovL2NhLnNrYmtvbnR1ci5ydS9hYm91dC9kb2N1bWVudHMvY3J5cHRvcHJvLWxpY2Vuc2UtcXVhbGlmaWVkDCrQodCa0JEg0JrQvtC90YLRg9GAINC4INCh0LXRgNGC0YPQvC3Qn9GA0L4DAgXgBAxZBIeE187UWKPG+wowCAYGKoUDAgIDA0EAN9jEKScwWkoaIJlz7WHpYpF7b9yv/zbsPXz5q98RtUQI1xw60RlafRRLq3+YAGX0yQGGAjsf6+6TEiCrVfuscA==
</wsse:BinarySecurityToken>
<ds:Signature>
<SignedInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod Algorithm="urn:ietf:params:xml:ns:cpxmlsec:algorithms:gostr34102001-gostr3411"/>
<Reference URI="#REGNO_4210000443">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="urn:ietf:params:xml:ns:cpxmlsec:algorithms:gostr3411"/>
<DigestValue>
ME0GCSqGSIb3DQEHBaBAMD4CAQAwCgYGKoUDAgIJBQAwCwYJKoZIhvcNAQcBBCC48qL9OOBzCWOATpH3pEBVI6MixzBOnzMZnTcGfSwbmg==
</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue xmlns="http://www.w3.org/2000/09/xmldsig#">
MIIEcAYJKoZIhvcNAQcCoIIEYTCCBF0CAQExDDAKBgYqhQMCAgkFADALBgkqhkiG9w0BBwExggQ7MIIENwIBATCCAYgwggFxMR4wHAYJKoZIhvcNAQkBFg9jYUBza2Jrb250dXIucnUxGDAWBgUqhQNkARINMTAyNjYwNTYwNjYyMDEaMBgGCCqFAwOBAwEBEgwwMDY2NjMwMDMxMjcxCzAJBgNVBAYTAlJVMTMwMQYDVQQIDCo2NiDQodCy0LXRgNC00LvQvtCy0YHQutCw0Y8g0L7QsdC70LDRgdGC0YwxITAfBgNVBAcMGNCV0LrQsNGC0LXRgNC40L3QsdGD0YDQszEsMCoGA1UECQwj0J/RgC4g0JrQvtGB0LzQvtC90LDQstGC0L7QsiDQtC4gNTYxMDAuBgNVBAsMJ9Cj0LTQvtGB0YLQvtCy0LXRgNGP0Y7RidC40Lkg0YbQtdC90YLRgDEpMCcGA1UECgwg0JDQniAi0J/QpCAi0KHQmtCRINCa0J7QndCi0KPQoCIxKTAnBgNVBAMMINCQ0J4gItCf0KQgItCh0JrQkSDQmtCe0J3QotCj0KAiAhEA80ngesQMx4DoEVYnDdK+TTAKBgYqhQMCAgkFAKCCAkowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTkwMTE0MDIyNjU2WjAvBgkqhkiG9w0BCQQxIgQg+KoZr/+KRagTx1DVFBj5VfNVbgqisXnxbsgUpG6BsWEwggHdBgsqhkiG9w0BCRACLzGCAcwwggHIMIIBxDCCAcAwCAYGKoUDAgIJBCDdOnIBSmKTgaiazNnFXjYz3LVvxCt/u4FjEVQr+vZJGjCCAZAwggF5pIIBdTCCAXExHjAcBgkqhkiG9w0BCQEWD2NhQHNrYmtvbnR1ci5ydTEYMBYGBSqFA2QBEg0xMDI2NjA1NjA2NjIwMRowGAYIKoUDA4EDAQESDDAwNjY2MzAwMzEyNzELMAkGA1UEBhMCUlUxMzAxBgNVBAgMKjY2INCh0LLQtdGA0LTQu9C+0LLRgdC60LDRjyDQvtCx0LvQsNGB0YLRjDEhMB8GA1UEBwwY0JXQutCw0YLQtdGA0LjQvdCx0YPRgNCzMSwwKgYDVQQJDCPQn9GALiDQmtC+0YHQvNC+0L3QsNCy0YLQvtCyINC0LiA1NjEwMC4GA1UECwwn0KPQtNC+0YHRgtC+0LLQtdGA0Y/RjtGJ0LjQuSDRhtC10L3RgtGAMSkwJwYDVQQKDCDQkNCeICLQn9CkICLQodCa0JEg0JrQntCd0KLQo9CgIjEpMCcGA1UEAwwg0JDQniAi0J/QpCAi0KHQmtCRINCa0J7QndCi0KPQoCICEQDzSeB6xAzHgOgRVicN0r5NMAoGBiqFAwICEwUABECsAj6OXNk2Y3TbYu0lsqIShzDGsbs6uWdgdrmvKRFOXqwVpaXOL7oYYHew9v7NM88Kdzcu46UwMRQa/DAp0nAO
</SignatureValue>
<ds:KeyInfo>
<wsse:SecurityTokenReference>
<wsse:Reference URI="#http://eln.fss.ru/actor/insurer/4210000443"/>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
</S:Header>
<soapenv:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="REGNO_4210000443">
<getPrivateLNData xmlns="http://ru/ibs/fss/ln/ws/FileOperationsLn.wsdl">
<regNum>4210000443</regNum>
<lnCode>900000010780</lnCode>
<snils>04746725785</snils>
</getPrivateLNData>
</soapenv:Body>
</soapenv:Envelope>
Для тестирования самого себя в процессе формирования XML сохранил блок SignedInfo и собственно сгенеренную подпись в файлы.
С помощью программы 'КриптоАРМ Стандарт 5' (https://cryptoarm.ru/) + КриптоПро CSP 4.0.9944 проверил корректность сформированной подписи. Все удачно.
2019-01-14_101312.jpg
(253kb) загружен 39 раз(а).Но. В ответ Web сервис говорит:
<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<SOAP-ENV:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" S:actor="http://eln.fss.ru/actor/fss/ca/1027739443236">
<wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="http://eln.fss.ru/actor/fss/ca/1027739443236">
MIIJRDCCCPOgAwIBAgIQAdQ2GMc2z0AAAABhA+gAAjAIBgYqhQMCAgMwggHYMRgwFgYFKoUDZAES DTEwMjc3Mzk0NDMyMzYxPTA7BgNVBAkMNNCe0YDQu9C40LrQvtCyINC/0LXRgNC10YPQu9C+0Los INC0LiAzLCDQutC+0YDQvy4g0JAxGjAYBggqhQMDgQMBARIMMDA3NzM2MDU2NjQ3MQswCQYDVQQG EwJSVTEZMBcGA1UEBwwQ0LMuINCc0L7RgdC60LLQsDEYMBYGA1UECAwPNzcg0JzQvtGB0LrQstCw MR0wGwYJKoZIhvcNAQkBFg5pbmZvLXVjQGZzcy5ydTFnMGUGA1UECgxe0KTQvtC90LQg0YHQvtGG 0LjQsNC70YzQvdC+0LPQviDRgdGC0YDQsNGF0L7QstCw0L3QuNGPINCg0L7RgdGB0LjQudGB0LrQ vtC5INCk0LXQtNC10YDQsNGG0LjQuDEuMCwGA1UECwwl0KbQtdC90YLRgNCw0LvRjNC90YvQuSDQ sNC/0L/QsNGA0LDRgjFnMGUGA1UEAwxe0KTQvtC90LQg0YHQvtGG0LjQsNC70YzQvdC+0LPQviDR gdGC0YDQsNGF0L7QstCw0L3QuNGPINCg0L7RgdGB0LjQudGB0LrQvtC5INCk0LXQtNC10YDQsNGG 0LjQuDAeFw0xODA4MTcxMDU1MDBaFw0xOTA4MTcxMDU1MDBaMIIBojEuMCwGA1UECwwl0KbQtdC9 0YLRgNCw0LvRjNC90YvQuSDQsNC/0L/QsNGA0LDRgjEaMBgGCCqFAwOBAwEBEgwwMDc3MzYwNTY2 NDcxGDAWBgUqhQNkARINMTAyNzczOTQ0MzIzNjFnMGUGA1UECgxe0KTQvtC90LQg0YHQvtGG0LjQ sNC70YzQvdC+0LPQviDRgdGC0YDQsNGF0L7QstCw0L3QuNGPINCg0L7RgdGB0LjQudGB0LrQvtC5 INCk0LXQtNC10YDQsNGG0LjQuDEzMDEGA1UECQwq0J7RgNC70LjQutC+0LIg0L/QtdGA0LXRg9C7 0L7QuiDQtNC+0LwgM9CwMRkwFwYDVQQHDBDQsy4g0JzQvtGB0LrQstCwMQswCQYDVQQIDAI3NzEL MAkGA1UEBhMCUlUxZzBlBgNVBAMMXtCk0L7QvdC0INGB0L7RhtC40LDQu9GM0L3QvtCz0L4g0YHR gtGA0LDRhdC+0LLQsNC90LjRjyDQoNC+0YHRgdC40LnRgdC60L7QuSDQpNC10LTQtdGA0LDRhtC4 0LgwYzAcBgYqhQMCAhMwEgYHKoUDAgIkAAYHKoUDAgIeAQNDAARAAUyu0lp+U6y5q498v/OHz/wa GkTJcuaUm5Pq5VLzbQruTuAVlkAtzbUV64Vvh3cFnTgiqyrde55bgGW17eqqNIEJADAzRTgwMDAy o4IEvDCCBLgwDgYDVR0PAQH/BAQDAgPYMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAd BgNVHSAEFjAUMAgGBiqFA2RxATAIBgYqhQNkcQIwMgYFKoUDZG8EKQwn0JrRgNC40L/RgtC+0J/R gNC+IENTUCDQstC10YDRgdC40Y8gNC4wMIIBoAYFKoUDZHAEggGVMIIBkQxv0KHRgNC10LTRgdGC 0LLQviDQutGA0LjQv9GC0L7Qs9GA0LDRhNC40YfQtdGB0LrQvtC5INC30LDRidC40YLRiyDQuNC9 0YTQvtGA0LzQsNGG0LjQuCAo0KHQmtCX0JgpICJWaVBOZXQgQ1NQIDQiDFrQn9GA0L7Qs9GA0LDQ vNC80L3Ri9C5INC60L7QvNC/0LvQtdC60YEgIlZpUE5ldCDQo9C00L7RgdGC0L7QstC10YDRj9GO 0YnQuNC5INGG0LXQvdGC0YAgNCIMXNCX0LDQutC70Y7Rh9C10L3QuNC1INC+INGB0L7QvtGC0LLQ tdGC0YHRgtCy0LjQuCDihJYgMTQ5LzMvMi8yLTIwNTIg0L7RgiAyOS4wMS4yMDE0INCz0L7QtNCw DGTQodC10YDRgtC40YTQuNC60LDRgiDRgdC+0L7RgtCy0LXRgtGB0YLQstC40Y8g4oSWINCh0KQv MTI4LTI5MzIg0L7RgiAxMCDQsNCy0LPRg9GB0YLQsCAyMDE2INCz0L7QtNCwMAwGA1UdEwEB/wQC MAAwgYAGCCsGAQUFBwEBBHQwcjBwBggrBgEFBQcwAoZkaHR0cHM6Ly9lLXRydXN0Lmdvc3VzbHVn aS5ydS9TaGFyZWQvRG93bmxvYWRDZXJ0P3RodW1icHJpbnQ9RDgxMjZGQzdFM0UxNDVDOEM2RkJD NjAzMDFBN0E1Q0Y1N0ZBN0Y5OTA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vd3d3LmZzcy5ydS91 Yy9HVUNfRlNTX1JGXzIwMTguY3JsMIIBhgYDVR0jBIIBfTCCAXmAFHryiNHPYJWHd6dCQtPPPybq PWumoYIBUqSCAU4wggFKMR4wHAYJKoZIhvcNAQkBFg9kaXRAbWluc3Z5YXoucnUxCzAJBgNVBAYT AlJVMRwwGgYDVQQIDBM3NyDQsy4g0JzQvtGB0LrQstCwMRUwEwYDVQQHDAzQnNC+0YHQutCy0LAx PzA9BgNVBAkMNjEyNTM3NSDQsy4g0JzQvtGB0LrQstCwLCDRg9C7LiDQotCy0LXRgNGB0LrQsNGP LCDQtC4gNzEsMCoGA1UECgwj0JzQuNC90LrQvtC80YHQstGP0LfRjCDQoNC+0YHRgdC40LgxGDAW BgUqhQNkARINMTA0NzcwMjAyNjcwMTEaMBgGCCqFAwOBAwEBEgwwMDc3MTA0NzQzNzUxQTA/BgNV BAMMONCT0L7Qu9C+0LLQvdC+0Lkg0YPQtNC+0YHRgtC+0LLQtdGA0Y/RjtGJ0LjQuSDRhtC10L3R gtGAggsAou/wWAAAAAAC2TAbBgNVHREEFDASgRBnLnByeWFtb3ZAZnNzLnJ1MB0GA1UdDgQWBBQj MUVEQp0eyKC9SajlVfaiT9qVCDAIBgYqhQMCAgMDQQBGE9BPJ6jI/Cfc5R4is0t8BrStEiZqOUSo XFJGC1QuiqTcPELHUjg4b7FUfDjDyqjtkYmbEEmBRqwt1Gq7dxcO
</wsse:BinarySecurityToken>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments"/>
<SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411"/>
<Reference URI="#OGRN_1027739443236">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#gostr3411"/>
<DigestValue>YSShbwgPfIhk8QEog/xbn2RQPh8Qz+qFVQ/TO2YIs1I=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>
S4BD7N6UBdvGH4035gpQS5omusKlzCqOt/MPt0JiPbugff449AHMXTTefiND5jKej7z7h71n3yQK QmL0GAiffw==
</SignatureValue>
<KeyInfo>
<wsse:SecurityTokenReference>
<wsse:Reference URI="#http://eln.fss.ru/actor/fss/ca/1027739443236" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
</wsse:SecurityTokenReference>
</KeyInfo>
</Signature>
</wsse:Security>
</SOAP-ENV:Header>
<S:Body wsu:Id="OGRN_1027739443236">
<ns1:getPrivateLNDataResponse xmlns:ns1="http://ru/ibs/fss/ln/ws/FileOperationsLn.wsdl" xmlns:ns2="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<ns1:FileOperationsLnUserGetPrivateLNDataOut>
<ns1:REQUEST_ID>GETLNINS_4210000443_2019_01_14_00004</ns1:REQUEST_ID>
<ns1:STATUS>0</ns1:STATUS>
<ns1:MESS>
ORA-20001: Некорректная подпись головной организации: ЭЦП неверна. INVALID_SIGNATURE ЭП недействительна. Обратитесь к разработчику программного обеспечения, на котором осуществлялось подписание данных.
</ns1:MESS>
</ns1:FileOperationsLnUserGetPrivateLNDataOut>
</ns1:getPrivateLNDataResponse>
</S:Body>
</S:Envelope>
Вобщем не понимает ФСС мою подпись.
В процессе общения с техподдержкой ФСС удалось выяснить, что они в качестве криптопровайдера используют КриптоПро JCP 2.0.
Также удалось получить от них рабочий XML запрос к их тестовому серверу:
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" signAlgorithm="http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411">
<S:Header xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
<wsse:Security xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" S:actor="http://eln.fss.ru/actor/insurer/5400002121">
<ds:Signature>
<SignedInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod Algorithm="urn:ietf:params:xml:ns:cpxmlsec:algorithms:gostr34102001-gostr3411"/>
<Reference URI="#REGNO_5400002121">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="urn:ietf:params:xml:ns:cpxmlsec:algorithms:gostr3411"/>
<DigestValue>w2runTShbGz55HSF/GSTiGWqp6LScfJmThtjR9oLiVE=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue xmlns="http://www.w3.org/2000/09/xmldsig#">
x8DCiKoIJuy4BlSxpjRxTGuO8ACJuAHLio92mQ6UlOh5lfdVo/7q5xrNsDBmrp5sz1HbofCLvEMtNsq1H7Hyig==
</SignatureValue>
<ds:KeyInfo>
<wsse:SecurityTokenReference>
<wsse:Reference URI="#http://eln.fss.ru/actor/insurer/5400002121"/>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
<wsse:BinarySecurityToken wsu:Id="http://eln.fss.ru/actor/insurer/5400002121" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">
MIIFEDCCBLugAwIBAgIQAdRrYqY7ogAAAAASAAUAATAMBggqhQMHAQEDAgUAMIHqMUwwSgYDVQQDDEPQkNC00LzQuNC90LjRgdGC0YDQsNGC0L7RgCDQotC10YHRgtC+0LLQvtCz0L4g0KPQpiDQmNC90YTQvtCi0LXQmtChMS8wLQY DVQQKDCbQotC10YHRgtC+0LLRi9C5INCj0KYg0JjQvdGE0L7QotC10JrQoTFEMEIGA1UECww70KPQtNC+0YHRgtC+0LLQtdGA0Y/RjtGJ0LjQuSDQuCDQutC70Y7Rh9C10LLQvtC5INGG0LXQvdGC0YAxIzAhBgNVBAwMGtCQ0LTQvN C40L3QuNGB0YLRgNCw0YLQvtGAMB4XDTE4MTAyNDA2MjcwMFoXDTE5MTAxNzA3NTMwMFowgfoxPTA7BgNVBAMMNDIwMDFf0KHRgtGA0LDRhdC+0LLQsNGC0LXQu9GMINCd0L7QstC+0YHQuNCx0LjRgNGB0LoxJjAkBgNVBAoMHdCe0 J7QniDQndC+0LLQvtGB0LjQsdC40YDRgdC6MQswCQYDVQQGEwJSVTEmMCQGA1UEBAwdMjAwMV/QodGC0YDQsNGF0L7QstCw0YLQtdC70YwxJjAkBgNVBCoMHdCe0J7QniDQndC+0LLQvtGB0LjQsdC40YDRgdC6MRowGAYIKoUDA4ED AQESDDAwOTg1NDEyMzQwNjEYMBYGBSqFA2QBEg01NDA5ODIzNDU2NzA4MGMwHAYGKoUDAgITMBIGByqFAwICJAAGByqFAwICHgEDQwAEQAF2OlWN7vJV0bIYIB9/STct2i22LfMsAxW0EYyI+q85owbBHGdQ13FdfYP1czivKDC7ZV5 Z8grQlGHkwtFdiLmBCQAwMDA1MDAwMaOCAhgwggIUMA4GA1UdDwEB/wQEAwIE8DAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFDw2PWFDMIig6Wv7ykhCWiYecE92MAwGA1UdEwEB/wQCMAAwggEoBgNVHS MEggEfMIIBG4AUbLGBApi3/G0zm7Ra6BndRFV9i2yhgfCkge0wgeoxTDBKBgNVBAMMQ9CQ0LTQvNC40L3QuNGB0YLRgNCw0YLQvtGAINCi0LXRgdGC0L7QstC+0LPQviDQo9CmINCY0L3RhNC+0KLQtdCa0KExLzAtBgNVBAoMJtCi0 LXRgdGC0L7QstGL0Lkg0KPQpiDQmNC90YTQvtCi0LXQmtChMUQwQgYDVQQLDDvQo9C00L7RgdGC0L7QstC10YDRj9GO0YnQuNC5INC4INC60LvRjtGH0LXQstC+0Lkg0YbQtdC90YLRgDEjMCEGA1UEDAwa0JDQtNC80LjQvdC40YHR gtGA0LDRgtC+0YCCEAHUZe5+wrtgAAAAEAAFAAEwYgYKKoUDAgQBAQEBBgRUMFKkUDBOMRswGQYDVQQDDBJSZWdpc3RyYXRpb24gUG9pbnQxLzAtBgNVBAoMJtCi0LXRgdGC0L7QstGL0Lkg0KPQpiDQmNC90YTQvtCi0LXQmtChMCY GCiqFAwIEAQEBAQcEGDAWgBTIkMDiTuzsVb6EuJqlrKvQXRnXszAMBggqhQMHAQEDAgUAA0EAPs69S239rIZt5BqcEs5muXkmD8+/NJWGYbgrUiMk6TEa5moAromYNmx0pWpVTE+Wh3qlghJyvoC1Gqu8biyWzw==
</wsse:BinarySecurityToken>
</wsse:Security>
</S:Header>
<soapenv:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="REGNO_5400002121">
<getPrivateLNData xmlns="http://ru/ibs/fss/ln/ws/FileOperationsLn.wsdl">
<regNum>5400002121</regNum>
<lnCode>900000010780</lnCode>
<snils>04746725785</snils>
</getPrivateLNData>
</soapenv:Body>
</soapenv:Envelope>
Попытался проверить с помощью программы 'КриптоАРМ Стандарт 5' подпись в этом рабочем примере. Не получилось.
2019-01-14_102858.jpg
(178kb) загружен 23 раз(а).Получается то что подписано с помощью КриптоПро JCP 2.0 не могу проверить с помощью КриптоПро CSP 4.0.9944. И наоборот.
Предлагаю делиться идеями, опытом решения проблемы.
