passkit-pkcs7-signature

OpenSSL-compatible detached PKCS#7 signatures for Apple Wallet pass manifests using Web Crypto.

This package is designed for JavaScript runtimes that expose the Web Crypto API, including Cloudflare Workers, modern browsers, Deno, Bun, and Node.js 19+.

Install

npm install passkit-pkcs7-signature

Usage

import { createOpenSslCompatiblePkcs7Signature } from 'passkit-pkcs7-signature';

const signature = await createOpenSslCompatiblePkcs7Signature({
  manifest: JSON.stringify(manifest),
  signerCertPem: env.SIGNER_CERT_PEM,
  privateKeyPkcs8Pem: env.SIGNER_KEY_PKCS8_PEM,
  wwdrPem: env.WWDR_PEM,
});

privateKeyPkcs8Pem must be an unencrypted PKCS#8 private key. Convert an existing pass signing key with:

openssl pkcs8 -topk8 -nocrypt -in signerKey.pem -out signerKey.pkcs8.pem

Notes

The signature includes the signer certificate and WWDR intermediate certificate, signs the authenticated attributes set, and keeps issuer/serial bytes copied from the signer certificate DER to avoid re-encoding differences.