Signature verification & trust

Every cryptographic primitive comes from crypto-for-laravel; every trust decision stays in this package. Purchases calls no openssl_* function of its own:

Crypto exceptions are translated into VerificationException at every provider boundary, so one catch covers every store. Apple’s pinned fingerprints prove only that Apple signed a notification — Apple signs every app’s notifications with that chain — so purchases also binds each one to your app: bundle id, environment and, in production, Apple ID (see Apple App Store).

Apple certificate validity

An App Store notification is rejected when any certificate in its x5c chain — leaf, intermediate or root — is outside its notBefore..notAfter window. A clock-skew leeway, applied to both ends of the window, absorbs a host clock that runs slightly fast or slow:

// config/purchases.php
'settings' => [
    'apple' => [
        // Seconds, 0–3600. Default 60. Anything outside that range is a
        // misconfiguration and throws InvalidConfigurationException — a
        // fat-fingered value can never silently switch the check off.
        'certificate_clock_skew' => env('PURCHASES_APPLE_CERTIFICATE_CLOCK_SKEW', 60),
    ],
],

The rejection has its own message, naming the certificate and the instant it lapsed, so an expired chain is never mistaken for a bad signature:

RoundlyConsulting\Purchases\Exceptions\VerificationException:
Apple certificate [Apple Worldwide Developer Relations Certification Authority] expired at
2026-01-01T00:00:00+00:00; the notification's certificate chain is outside its validity period.

Re-verifying archived notifications

Re-verifying an archived Apple notification signed by a since-rotated, now-expired certificate fails — the correct outcome, since an expired certificate proves nothing. Raise certificate_clock_skew only to absorb clock drift; it is not a grace period and is capped at one hour. purchases:replay is unaffected: it rebuilds results from the audit snapshots, which were verified when they arrived.