Php get https certificate

openssl_x509_read

openssl_x509_read() parses the certificate supplied by certificate and returns an OpenSSLCertificate object for it.

Parameters

X509 certificate. See Key/Certificate parameters for a list of valid values.

Return Values

Returns an OpenSSLCertificate on success or false on failure.

Changelog

Version	Description
8.0.0	On success, this function returns an OpenSSLCertificate instance now; previously, a resource of type OpenSSL X.509 was returned.
8.0.0	certificate accepts an OpenSSLCertificate instance now; previously, a resource of type OpenSSL X.509 was accepted.

User Contributed Notes 3 notes

To get the real timestamps as integer values for the validity daterange you can use as follows:

$data = openssl_x509_parse ( file_get_contents ( ‘/path/to/cert.crt’ ));

$validFrom = date ( ‘Y-m-d H:i:s’ , $data [ ‘validFrom_time_t’ ]);
$validTo ) date ( ‘Y-m-d H:i:s’ , $data [ ‘validTo_time_t’ ]);

echo $validFrom . «\n» ;
echo $validTo . «\n» ;

After some tests I’ve been able to get some results this way .

$fp = fopen ( «/etc/httpd/conf/ssl/moncertif.crt» , «r» );
$cert = fread ( $fp , 8192 );
fclose ( $fp );

echo «Read
» ;
echo openssl_x509_read ( $cert );
echo «
» ;
echo «*********************» ;
echo «
» ;
echo «Parse
» ;
print_r ( openssl_x509_parse ( $cert ));
/*
// or
print_r(openssl_x509_parse( openssl_x509_read($cert) ) );
*/

Short HOWTO for getting data out of a client certificate via an SSL enabled iPlanet (Netscape Enterprise or Sun ONE) web server.

The iPlanet server sets $_SERVER[«CLIENT_CERT»] whenever a client authenticates with a certificate. This variable contains an encoded representation of the certificate presented by the client. This in itself is useless to scripts or applications, we need to extract the actual information from the encoding. It turns out that we are in luck, the encoding is NEARLY a standard PEM encoding which can be read by the openssl_x509_read() function. A standard PEM has a begin line, an end line and inbetween is a base64 encoding of the DER representation of the certificate. PEM requires that linefeeds be present every 64 characters, however this is already the case with our CLIENT_CERT variable. For some reason the iPlanet server neglects to attach the begin and end headers, all that is required to allow access to the certificate is replacing these headers. Here is a small code excerpt for doing just that and printing out the raw certificate data.

$beginpem = «——BEGIN CERTIFICATE——\n» ;
$endpem = «——END CERTIFICATE——\n» ;

// Small function to print the data recursivly.
function print_element ( $item , $key )
if( is_array ( $item ) )
echo » $key is Array:\n» ;
array_walk ( $item , ‘print_element’ );
echo » $key done\n» ;
>
else
echo » $key = $item \n» ;
>

// Build the PEM string.
$pemdata = $beginpem . $_SERVER [ «CLIENT_CERT» ]. «\n» . $endpem ;

// Get a certificate resource from the PEM string.
$cert = openssl_x509_read ( $pemdata );

// Parse the resource and print out the contents.
$cert_data = openssl_x509_parse ( $cert );
array_walk ( $cert_data , ‘print_element’ );

// Free the resource
openssl_x509_free ( $cert );
?>

• OpenSSL Functions
  • openssl_​cipher_​iv_​length
  • openssl_​cipher_​key_​length
  • openssl_​cms_​decrypt
  • openssl_​cms_​encrypt
  • openssl_​cms_​read
  • openssl_​cms_​sign
  • openssl_​cms_​verify
  • openssl_​csr_​export_​to_​file
  • openssl_​csr_​export
  • openssl_​csr_​get_​public_​key
  • openssl_​csr_​get_​subject
  • openssl_​csr_​new
  • openssl_​csr_​sign
  • openssl_​decrypt
  • openssl_​dh_​compute_​key
  • openssl_​digest
  • openssl_​encrypt
  • openssl_​error_​string
  • openssl_​free_​key
  • openssl_​get_​cert_​locations
  • openssl_​get_​cipher_​methods
  • openssl_​get_​curve_​names
  • openssl_​get_​md_​methods
  • openssl_​get_​privatekey
  • openssl_​get_​publickey
  • openssl_​open
  • openssl_​pbkdf2
  • openssl_​pkcs12_​export_​to_​file
  • openssl_​pkcs12_​export
  • openssl_​pkcs12_​read
  • openssl_​pkcs7_​decrypt
  • openssl_​pkcs7_​encrypt
  • openssl_​pkcs7_​read
  • openssl_​pkcs7_​sign
  • openssl_​pkcs7_​verify
  • openssl_​pkey_​derive
  • openssl_​pkey_​export_​to_​file
  • openssl_​pkey_​export
  • openssl_​pkey_​free
  • openssl_​pkey_​get_​details
  • openssl_​pkey_​get_​private
  • openssl_​pkey_​get_​public
  • openssl_​pkey_​new
  • openssl_​private_​decrypt
  • openssl_​private_​encrypt
  • openssl_​public_​decrypt
  • openssl_​public_​encrypt
  • openssl_​random_​pseudo_​bytes
  • openssl_​seal
  • openssl_​sign
  • openssl_​spki_​export_​challenge
  • openssl_​spki_​export
  • openssl_​spki_​new
  • openssl_​spki_​verify
  • openssl_​verify
  • openssl_​x509_​check_​private_​key
  • openssl_​x509_​checkpurpose
  • openssl_​x509_​export_​to_​file
  • openssl_​x509_​export
  • openssl_​x509_​fingerprint
  • openssl_​x509_​free
  • openssl_​x509_​parse
  • openssl_​x509_​read
  • openssl_​x509_​verify

  Источник

  Как прочитать SSL сертификат из PHP

  

  SSL сертификат можно получить с помощью контекста потоков (Stream Context), а разобрать его поможет функция openssl_x509_parse() . Если сертификат отсутствует или просрочен, то код ошибки и текст будет в переменных $err_no и $err_str .

  $url = 'ssl://snipp.ru:443'; $context = stream_context_create( array( 'ssl' => array( 'capture_peer_cert' => true, 'verify_peer' => false, // Т.к. промежуточный сертификат может отсутствовать, 'verify_peer_name' => false // отключение его проверки. ) ) ); $fp = stream_socket_client($url, $err_no, $err_str, 30, STREAM_CLIENT_CONNECT, $context); $cert = stream_context_get_params($fp); if (empty($err_no))

  Результат:

  Array( [name] => /CN=snipp.ru [subject] => Array( [CN] => snipp.ru ) [hash] => d29c8ea7 [issuer] => Array( [C] => US [O] => Let's Encrypt [CN] => Let's Encrypt Authority X3 ) [version] => 2 [serialNumber] => 295366585736462130072577585684820136690675 [serialNumberHex] => 0364011F3441AE879CE07F8A1018FDFA03F3 [validFrom] => 200214143414Z [validTo] => 200514143414Z [validFrom_time_t] => 1581690854 [validTo_time_t] => 1589466854 [signatureTypeSN] => RSA-SHA256 [signatureTypeLN] => sha256WithRSAEncryption [signatureTypeNID] => 668 [purposes] => Array( [1] => Array( [0] => 1 [1] => [2] => sslclient ) [2] => Array( [0] => 1 [1] => [2] => sslserver ) [3] => Array( [0] => 1 [1] => [2] => nssslserver ) [4] => Array( [0] => [1] => [2] => smimesign ) [5] => Array( [0] => [1] => [2] => smimeencrypt ) [6] => Array( [0] => [1] => [2] => crlsign ) [7] => Array( [0] => 1 [1] => 1 [2] => any ) [8] => Array( [0] => 1 [1] => [2] => ocsphelper ) [9] => Array( [0] => [1] => [2] => timestampsign ) ) [extensions] => Array( Php get https certificate => Digital Signature, Key Encipherment [extendedKeyUsage] => TLS Web Server Authentication, TLS Web Client Authentication [basicConstraints] => CA:FALSE [subjectKeyIdentifier] => 93:5E:0E:54:E4:68:87:51:61:07:15:45:04:76:EB:AC:53:69:00:AE [authorityKeyIdentifier] => keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1 [authorityInfoAccess] => OCSP - URI:http://ocsp.int-x3.letsencrypt.org CA Issuers - URI:http://cert.int-x3.letsencrypt.org/ [subjectAltName] => DNS:snipp.ru, DNS:www.snipp.ru [certificatePolicies] => Policy: 2.23.140.1.2.1 Policy: 1.3.6.1.4.1.44947.1.1.1 CPS: http://cps.letsencrypt.org ) )

  Вывод основных данных

  echo 'Домен: ' . $info['subject']['CN'] . "\r\n"; echo 'Выдан: ' . $info['issuer']['CN'] . "\r\n"; echo 'Истекает: ' . date('d.m.Y H:i', $info['validTo_time_t']);

  Домен: snipp.ru Выдан: Let's Encrypt Authority X3 Истекает: 14.05.2020 17:34

  Источник

  Saved searches

  Use saved searches to filter your results more quickly

  You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

  Easily retrieve the ssl certificate for any host

  License

  joelwmale/php-ssl-certificate

  This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

  Name already in use

  A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

  Sign In Required

  Please sign in to use Codespaces.

  Launching GitHub Desktop

  If nothing happens, download GitHub Desktop and try again.

  Launching GitHub Desktop

  If nothing happens, download GitHub Desktop and try again.

  Launching Xcode

  If nothing happens, download Xcode and try again.

  Launching Visual Studio Code

  Your codespace will open once ready.

  There was a problem preparing your codespace, please try again.

  Latest commit

  Git stats

  Files

  Failed to load latest commit information.

  README.md

  Easily retrieve the ssl certificate for any host

  This package makes it easy to download a certificate for a host.

  use Joelwmale\SslCertificate\Certificate; $certificate = Certificate::forHost('joelmale.com');

  You can install the package via composer:

  composer require joelwmale/php-ssl-certificate

  Available Properties & Methods

  /** @var string */ $certificate->issuer; // returns the issuer of the certificate /** @var string */ $certificate->domain; // returns the primary domain on the certificate /** @var array */ $certificate->additionalDomains; // returns all the additional/alt domains on the certificate /** @var bool */ $certificate->isValid; // returns true if valid, false if not /** @var Carbon */ $certificate->issued; // returns a carbon instance of when the certificate was issued /** @var Carbon */ $certificate->expires; // returns a carbon instance of when the certificate expires /** @var int */ $certificate->expiresIn; // returns the amount of days until the certificate expires /** @var bool */ $certificate->expired; // returns true if the certificate is expired, false if not /** @var string */ $certificate->signatureAlgorithm; // returns the signature algorithm used to sign the certificate /** @var bool */ $certificate->isSelfSigned; // returns true if the certificate was self signed

  Get raw certificate as JSON

  $certificate->getRawCertificateFieldsAsJson();

  Determining if the certificate is valid at a given date

  Returns true if the certificate will still be valid. Takes a Carbon instance as the first parameter.

  $certificate->isValidAt(Carbon::today()->addMonth(1));

  Determining if certificate contains/convers a domain

  Returns true if the certificate contains the domain

  $certificate->containsDomain('joelmale.dev');

  Please see CHANGELOG for a list of recent changes.

  About

  Easily retrieve the ssl certificate for any host

  Источник

  Читайте также:  Wordpress inline all css