I am aware that my server can send a request to Apple server (/verifyReceipt) in order to validate an App Store receipt.
But in some cases it would be preferrable to validate the receipt locally on my server, just like desktop Mac apps do.
The problem boils down to two tasks:
1. Verify signature of the CMS in PKCS7 container using Apple's public keys
2. Parse the ASN.1 content and extract receipt fields.
I am using PHP and I find that there are surprisingly no tools for that.
For example, there is no built-in ASN.1 parser in PHP, but I've found a few third-party ones, like this: http://www.phpkode.com/source/s/mistpark-server/library/asn1.php
As for verifying CMS PKCS7 signature, there is openssl_pkcs7_verify() function but it only works for verifying S/MIME signed messages but seemingly not for CMS content. All I found is the advice to launch openssl task from PHP code, but it seems lame.
Could someone please point me to a solution or a third-party library that can do this job?
P.S. In Ruby it's much easier to natively solve the both problems. However, the rest of my code is in PHP and it's expensive to call Ruby from PHP, almost as lame as call openssl from PHP. I just can't believe there are no better solutions!
