Hello everyone,

I am reaching out to the community because I am stuck on a really tricky issue concerning the verification of an RSA signature via the OpenSSL extension of PHP.

Versions:

• PHP 8.4.10 / OpenSSL 3.0.16 (same version used everywhere)
• Symfony 6.4.23
• Public key in PEM format provided by Paybox
• Data and signature from a payment service (Paybox, standard RSA with SHA1)

Problem:
During an online payment, Paybox performs a callback on a route in my application. To ensure the authenticity of the request, I want to verify the signature transmitted in the response. To do this, I take the query string and isolate the signature. Then, I base64_decode, urldecode, and perform the verification with openssl_verify.

In most cases, the verification works correctly (tested in CLI, in a minimal PHP script, and in the Symfony application). But for certain values, the verification fails in Symfony with an error such as ‘invalid padding’ or ‘padding check failed’. I was able to isolate a string that generates this error. And the fact is that this ONLY happens on Symfony: in CLI or with the script, it's OK. I compared the variables in base64 and they are strictly identical.

In my case, the only variable that changes is the date. But the string is always the same length.

The string is always formatted in the same way:
amount=1000&reference=pel|Nom|Prenom|Ref|Date&error=00001

For example, the following string will not work:
amount=1000&reference=pel|Dupont|Jean|1086|20250723113457&error=00001

But this one will work, only replacing 7 by 6 at the end:
amount=1000&reference=pel|Dupont|Jean|1086|20250723113456&error=00001

I cannot explain this behaviour at all, let alone the fact that it only occurs on Symfony and not on a classic PHP script.

What I have already checked:

• All data is identical (dumps, logs, diff, etc.).
• OpenSSL and PHP versions are strictly identical on all tested environments (CLI, script, Symfony, Windows, Debian).
• Cross-tested on several strings, references and signatures: the problem is intermittent, it only occurs with certain values, for which I have not identified any differences. I was able to isolate one string that works every time, and one that fails every time.

I'm completely lost on this one. I've easily spent the whole day on it.

Many thanks to anyone who tries to help me!