openssl_verify verifies a supplied digital signature with a public key, returning a validity status rather than plaintext.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: openssl_verify verifies a supplied digital signature with a public key, returning a validity status rather than plaintext.
The OpenSSL extension must be enabled.
Syntax and Return Value
openssl_verify(string $data, string $signature, $public_key, string|int $algorithm = ...): int|false| Parameter | Purpose |
|---|---|
| $data (string) | The input data bytes. Use the exact original bytes when verifying. |
| $signature (string) | A signature or MAC produced by the matching signing/authentication function. |
| $public_key (mixed) | A public key that belongs to the intended, verified peer. |
| $algorithm (string|int) | A supported hash, encryption, signing or password-hash algorithm identifier. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Verification results are 1 for valid, 0 for invalid and -1 or false for errors. Never confuse verification with decrypting the message.
Example 1: Basic Operation
The public key must be authenticated separately; a signature is not encryption.
<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_sign("annual report", $signature, $private, OPENSSL_ALGO_SHA256);
var_dump(openssl_verify("annual report", $signature, $public, OPENSSL_ALGO_SHA256) === 1);Example 2: A Different Use Case
The public key must be authenticated separately; a signature is not encryption.
<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_sign("invoice 42", $signature, $private, OPENSSL_ALGO_SHA256);
var_dump(openssl_verify("invoice 42", $signature, $public, OPENSSL_ALGO_SHA256) === 1);Practical Example: Checking the Result
The public key must be authenticated separately; a signature is not encryption.
<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_sign("signed event", $signature, $private, OPENSSL_ALGO_SHA256);
var_dump(openssl_verify("signed event", $signature, $public, OPENSSL_ALGO_SHA256) === 1);Important Behavior and Edge Cases
Verification results are 1 for valid, 0 for invalid and -1 or false for errors. Never confuse verification with decrypting the message.
Verification results are 1 for valid, 0 for invalid and -1 or false for errors. Never confuse verification with decrypting the message.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| openssl_verify | openssl_verify verifies a supplied digital signature with a public key, returning a validity status rather than plaintext. |
| Related technique | Use a private key to sign and the matching public key to verify. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | Use a private key to sign and the matching public key to verify. |
| Ignoring a security prerequisite or failure case | Verification results are 1 for valid, 0 for invalid and -1 or false for errors. Never confuse verification with decrypting the message. |
Key Takeaways
- openssl_verify verifies a supplied digital signature with a public key, returning a validity status rather than plaintext.
- Verification results are 1 for valid, 0 for invalid and -1 or false for errors. Never confuse verification with decrypting the message.
- Use a private key to sign and the matching public key to verify.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.