Attempting to Sign a AuthnRequest I Always Receive a Fatal Error

[TheWitness]

I'm trying to use the method on the main website to sign a AuthNRequest to the IDP, but I'm always receiving the following error.

Fatal error: Uncaught Exception: Failure Signing Data: error:0480006C:PEM routines::no start line - 1 in /var/www/html/vendor/robrichards/xmlseclibs/src/XMLSecurityKey.php:564 
Stack trace: 
#0 /var/www/html/vendor/robrichards/xmlseclibs/src/XMLSecurityKey.php(644): RobRichards\XMLSecLibs\XMLSecurityKey->signOpenSSL('<ds:SignedInfo ...') 
#1 /var/www/html/vendor/robrichards/xmlseclibs/src/XMLSecurityDSig.php(832): RobRichards\XMLSecLibs\XMLSecurityKey->signData('<ds:SignedInfo ...') 
#2 /var/www/html/vendor/robrichards/xmlseclibs/src/XMLSecurityDSig.php(856): RobRichards\XMLSecLibs\XMLSecurityDSig->signData(Object(RobRichards\XMLSecLibs\XMLSecurityKey), '<ds:SignedInfo ...') 
#3 /var/www/html/vendor/litesaml/lightsaml/src/Model/XmlDSig/SignatureWriter.php(162): RobRichards\XMLSecLibs\XMLSecurityDSig->sign(Object(RobRichards\XMLSecLibs\XMLSecurityKey)) 
#4 /var/www/html/vendor/litesaml/lightsaml/src/Model/AbstractSamlModel.php(47): LightSaml\Model\XmlDSig\SignatureWriter->serialize(Object(DOMElement), Object(LightSaml\Model\Context\SerializationContext)) 
#5 /var/www/html/vendor/litesaml/lightsaml/src/Model/AbstractSamlModel.php(67): LightSaml\Model\AbstractSamlModel->oneElementToXml('Signature', Object(DOMElement), Object(LightSaml\Model\Context\SerializationContext), NULL) 
#6 /var/www/html/vendor/litesaml/lightsaml/src/Model/Protocol/AuthnRequest.php(297): LightSaml\Model\AbstractSamlModel->singleElementsToXml(Array, Object(DOMElement), Object(LightSaml\Model\Context\SerializationContext)) 
#7 /var/www/html/login_saml.php(65): LightSaml\Model\Protocol\AuthnRequest->serialize(Object(DOMDocument), Object(LightSaml\Model\Context\SerializationContext)) 
#8 {main} thrown in /var/www/html/vendor/robrichards/xmlseclibs/src/XMLSecurityKey.php on line 564

I'm using the example here:

<?php
$authnRequest = new \LightSaml\Model\Protocol\AuthnRequest();
$authnRequest
    ->setAssertionConsumerServiceURL('https://my.site/acs')
    ->setProtocolBinding(\LightSaml\SamlConstants::BINDING_SAML2_HTTP_POST)
    ->setID(\LightSaml\Helper::generateID())
    ->setIssueInstant(new \DateTime())
    ->setDestination('https://idp.com/login')
    ->setIssuer(new \LightSaml\Model\Assertion\Issuer('https://my.entity.id'))
;

$certificate = \LightSaml\Credential\X509Certificate::fromFile('certificate.crt');
$privateKey = \LightSaml\Credential\KeyHelper::createPrivateKey('private.key', '', true);

$authnRequest->setSignature(new \LightSaml\Model\XmlDSig\SignatureWriter($certificate, $privateKey));

$serializationContext = new \LightSaml\Model\Context\SerializationContext();
$authnRequest->serialize($serializationContext->getDocument(), $serializationContext);

It's got me scratching my head again.

[TheWitness]

I generated the keypair here as instructed. I figured that if I followed the doco very specifically, it might work, but no.

https://litesaml.github.io/cookbook/docs/security/generate-key-pair

[TheWitness]

If I don't sign the AuthnRequest, the IDP accepts it and does redirect me to my ACS page for session creation, but see issue #89 for my woes there.

[TheWitness]

Here is the fix:

 putenv('OPENSSL_ENABLE_SHA1_SIGNATURES=1');

[TheWitness]

Final working code is:

$authnRequest = new \LightSaml\Model\Protocol\AuthnRequest();
$authnRequest
    ->setAssertionConsumerServiceURL($saml_sp_acs_url)
    ->setProtocolBinding(\LightSaml\SamlConstants::BINDING_SAML2_HTTP_POST)
    ->setID(\LightSaml\Helper::generateID())
    ->setIssueInstant(new \DateTime())
    ->setDestination($saml_idp_sso_url)
    ->setIssuer(new \LightSaml\Model\Assertion\Issuer($saml_sp_entity_id));

if ($saml_sign != '') {
    putenv('OPENSSL_ENABLE_SHA1_SIGNATURES=1');

    $cert = '/tmp/certs/sp_cert.crt';
    $key  = '/tmp/certs/sp_priv.key';

    if (!is_dir(dirname($cert))) {
        mkdir(dirname($cert), 0755, true);
    }

    if (file_exists($cert)) {
        unlink($cert);
    }

    file_put_contents($cert, $saml_sp_cert);

    if (file_exists($key)) {
        unlink($key);
    }

    file_put_contents($key, $saml_sp_priv_key);

    $certificate = \LightSaml\Credential\X509Certificate::fromFile($cert);
    $privateKey  = \LightSaml\Credential\KeyHelper::createPrivateKey($key, '', true);

    $authnRequest->setSignature(new \LightSaml\Model\XmlDSig\SignatureWriter($certificate, $privateKey));
}

$bindingFactory = new \LightSaml\Binding\BindingFactory();

...