# Step 1: Generate Private Key (2048-bit RSA)
openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048

# Step 2: Generate Certificate Signing Request
openssl req -new -key private_key.pem -out request.csr \
  -subj "/C=US/ST=State/L=City/O=YourCompany/CN=yourdomain.com"

# Step 3: Generate Public Certificate (Valid for 2 years)
openssl x509 -req -in request.csr -signkey private_key.pem -out public_cert.pem \
  -days 730 -sha256

Content-Type: application/json
x-Merchant-ID: <your-unique-merchant-identifier>
token: <base64-rsa-sha256-signature>

/**
 * Generates a base64-encoded signature for API requests
 * @param array $value Request payload
 * @return string Base64-encoded signature
 * @throws Exception On signing failure
 */
public function sign(array $value): string {
    try {
        $privateKey = $this->loadMerchantPrivateKey();

        // Step 1: Convert JSON to UTF-8 bytes
        $utf8Bytes = json_encode($value, JSON_UNESCAPED_UNICODE);

        // Step 2: Sign using RSA private key with SHA256
        $signature = '';
        $success = openssl_sign($utf8Bytes, $signature, $privateKey, OPENSSL_ALGO_SHA256);

        if (!$success) {
            $error = openssl_error_string();
            throw new Exception('Failed to sign hash: ' . $error);
        }

        openssl_free_key($privateKey);

        // Step 3: Encode result into Base64 string
        $base64Signature = base64_encode($signature);

        Log::info('QPay Security Service - Data signed successfully', [
            'algorithm' => OPENSSL_ALGO_SHA256,
            'data_length' => strlen($utf8Bytes),
            'signature_length' => strlen($signature),
            'base64_length' => strlen($base64Signature)
        ]);

        return $base64Signature;
    } catch (Exception $e) {
        Log::error('QPay Security Service - Sign failed', [
            'error' => $e->getMessage()
        ]);
        throw new Exception('Failed to sign data: ' . $e->getMessage());
    }
}