Tearing my hair out trying to get Azure Key Vault’s digest sign/verify operations to work with OpenSSL.

Basically, I want to be able to sign a hash with a Key Vault certificate, and then allow end users to verify that using the public key and openssl.

For various reasons, signing/verifying requires using the REST API to work reliably. (TL;DR – there is no pwsh cmdlet for that and the az cli is broken). So I’m signing by sending to https://[myvault]/keys/[myCert]/[CertVersion]/sign?api-Version="7.4" the following body

{
  alg = "RS256"
  value = $base64EncodedSHA256Digest
}

That works and I get back a base64 encoded signature. And if send that signature back to be verified it does, using the following endpoint: https://[myvault]/keys/[myCert]/[CertVersion]/verify?api-Version="7.4" and body

{
  alg = "RS256"
  digest = $base64EncodedSHA256Digest
  value = $responseReturnedFromCallToSign
}

The problem comes when I try to do the same thing in openssl. I downloaded the key/cert pfx file for the key from the Key Vault (using the portal) and extract the private key as private.pem. I would then expect that running this operation would give me the exact same base64 encoded signature as what i get from the api:

echo $base64EncodedSHA256Digest | base64 -d | openssl dgst -sha256 -sign private.pem | base64

But it doesn’t — it gives me a completely different base64 encoded signature.

I’m at a lost as to what I’m missing here. From everything I’ve read, it would seem that using RS256 with Azure Key Vault should give me the same result as using dgst -sha256 with an RSA key in openssl, but I’m obviously missing something.

I’m more than happy to be told I’m an idiot and have missed some conversion or something here, but I’ve been over it and over it and can’t find what it is.

Thanks!