如何验证PHP中的Paypal webhook签名？

我遇到的问题是我在调用openssl_verify()并返回结果为(0)后收到以下错误：

OpenSSL error openssl_verify error:04091068:rsa routines:INT_RSA_VERIFY:bad signature

我试图解决这个问题,但关于错误和网络功能的文档很少见.

我当前的代码如下所示：

// get the header post to my php file by PayPal
 $headers = apache_request_headers();
 // get the body post to me php file by PayPal
 $body = @file_get_contents('php://input');
 $json = json_decode($body);

 // TransmissionId|TransmissionTimeStamp|WebhookId|CRC32 as per PayPal documentation
 $sigString = $headers['Paypal-Transmission-Id'].'|'.$headers['Paypal-Transmission-Time'].'|'.$json->id.'|'.crc32($body);

 // $headers['Paypal-Cert-Url'] contains the "-----BEGIN CERTIFICATE---MIIHmjCCBoKgAwIBAgIQDB8 ... -----END CERTIFICATE-----"
 $pubKey = openssl_pkey_get_public(file_get_contents($headers['Paypal-Cert-Url']));

 // and this is the call to verify that returns result (0)
 $verifyResult = openssl_verify($sigString,base64_decode($headers['Paypal-Transmission-Sig']),$pubKey,'sha256WithRSAEncryption');

只是与我使用的参考代码不同,我不使用openssl_pkey_get_details($pubKey),因为除了现有的签名错误之外我还会得到以下错误：

OpenSSL error openssl_verify error:0906D06C:PEM routines:PEM_read_bio:no start line
OpenSSL error openssl_verify error:04091068:rsa routines:INT_RSA_VERIFY:bad signature

此外,我通过不在标题上使用base64_decode()尝试了一个变体,但是会得到相同的返回结果(0),错误说明：

OpenSSL error openssl_verify error:04091077:rsa routines:INT_RSA_VERIFY:wrong signature length

签名有什么问题？