# Step 1: Generate Private Key (2048-bit RSA)
openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048

# Step 2: Generate Certificate Signing Request
openssl req -new -key private_key.pem -out request.csr \
  -subj "/C=US/ST=State/L=City/O=YourCompany/CN=yourdomain.com"

# Step 3: Generate Public Certificate (Valid for 2 years)
openssl x509 -req -in request.csr -signkey private_key.pem -out public_cert.pem \
  -days 730 -sha256
    

Content-Type: application/json
x-Merchant-ID: <your-unique-merchant-identifier>
token: <generated-signature>
    

/**
 * Generates a base64-encoded signature for API requests
 * @param array $value Request payload
 * @return string Base64-encoded signature
 * @throws Exception On signing failure
 */
public function sign(array $value): string {
    try {
        $privateKey = $this->loadMerchantPrivateKey();
        
        // Step 1: Convert JSON string to UTF-8 bytes
        $utf8Bytes = json_encode($value);
        
        // Step 2: Sign using RSA private key with SHA256
        $signature = '';
        $success = openssl_sign(
            $utf8Bytes, 
            $signature, 
            $privateKey, 
            OPENSSL_ALGO_SHA256
        );
        
        if (!$success) {
            $error = openssl_error_string();
            throw new Exception('Failed to sign hash: ' . $error);
        }
        
        openssl_free_key($privateKey);
        
        // Step 3: Encode result into Base64 string
        $base64Signature = base64_encode($signature);
        
        Log::info('QPay Security Service - Data signed successfully', [
            'algorithm' => self::HASHING_ALGORITHM,
            'data_length' => strlen($utf8Bytes),
            'signature_length' => strlen($signature),
            'base64_length' => strlen($base64Signature),
            'private_key_source' => 'merchant-certs'
        ]);
        
        return $base64Signature;
    } catch (Exception $e) {
        Log::error('QPay Security Service - Sign failed', [
            'error' => $e->getMessage(),
            'algorithm' => self::HASHING_ALGORITHM,
            'private_key_path' => $this->MerchantPrivateKeyPath
        ]);
        throw new Exception('Failed to sign data: ' . $e->getMessage());
    }
}