LimeSurvey API - Master branch
Back to top  

X509

Pure-PHP X.509 Parser

author

Jim Wigginton terrafrost@php.net
package

Default

Methods

Default Constructor.

__construct(): \phpseclib3\File\X509

Response

\phpseclib3\File\X509

Compute a public key identifier.

computeKeyIdentifier(mixed $key = null,integer $method = 1): string

Although key identifiers may be set to any unique value, this function computes key identifiers from public key according to the two recommended methods (4.2.1.2 RFC 3280). Highly polymorphic: try to accept all possible forms of key:

  • Key object
  • \phpseclib3\File\X509 object with public or private key defined
  • Certificate or CSR array
  • \phpseclib3\File\ASN1\Element object
  • PEM or DER string

Arguments

$key

mixed

optional

$method

integer

optional

Response

string

binary key identifier

Decodes an IP address

decodeIP(string $ip): string
static

Takes in a base64 encoded "blob" and returns a human readable IP address

Arguments

$ip

string

Response

string

Decodes an IP address in a name constraints extension

decodeNameConstraintIP(string $ip): array
static

Takes in a base64 encoded "blob" and returns a human readable IP address / mask

Arguments

$ip

string

Response

array

Prevents URIs from being automatically retrieved

disableURLFetch()
static

Helper function to build domain array

dnsName(string $domain): array
static

Arguments

$domain

string

Response

array

Allows URIs to be automatically retrieved

enableURLFetch()
static

Encodes an IP address

encodeIP(string|array $ip): string
static

Takes a human readable IP address into a base64-encoded "blob"

Arguments

$ip

string|array

Response

string

Get a reference to an extension subarray

extensions(array &$root = null,string $path = null,boolean $create = false): array|false

Arguments

$root

array

$path

string

optional absolute path with / as component separator

$create

boolean

optional

Response

array|false

Fetches a URL

fetchURL(string $url): boolean|string
static

Arguments

$url

string

Response

boolean|string

Format a public key as appropriate

formatSubjectPublicKey(): array|false

Response

array|false

Get a CSR attribute

getAttribute(string $id,integer $disposition = self::ATTR_ALL,array $csr = null): mixed

Returns the attribute if it exists and false if not

Arguments

$id

string

$disposition

integer

optional

$csr

array

optional

Response

mixed

Returns a list of all CSR attributes in use

getAttributes(array $csr = null): array

Arguments

$csr

array

optional

Response

array

Get the certificate chain for the current cert

getChain(): mixed

Response

mixed

Returns the current cert

getCurrentCert(): array|boolean

Response

array|boolean

Get the Distinguished Name for a certificates subject

getDN(mixed $format = self::DN_ARRAY,array $dn = null): array|boolean|string

Arguments

$format

mixed

optional

$dn

array

optional

Response

array|boolean|string

Get Distinguished Name properties

getDNProp(string $propName,array $dn = null,boolean $withType = false): mixed

Arguments

$propName

string

$dn

array

optional

$withType

boolean

optional

Response

mixed

Get a certificate, CSR or CRL Extension

getExtension(string $id,array $cert = null,string $path = null): mixed

Returns the extension if it exists and false if not

Arguments

$id

string

$cert

array

optional

$path

string

Response

mixed

Get an Extension

getExtensionHelper(string $id,array $cert = null,string $path = null): mixed

Returns the extension if it exists and false if not

Arguments

$id

string

$cert

array

optional

$path

string

optional

Response

mixed

Returns a list of all extensions in use in certificate, CSR or CRL

getExtensions(array $cert = null,string $path = null): array

Arguments

$cert

array

optional

$path

string

optional

Response

array

Returns a list of all extensions in use

getExtensionsHelper(array $cert = null,string $path = null): array

Arguments

$cert

array

optional

$path

string

optional

Response

array

Get the Distinguished Name for a certificate/crl issuer

getIssuerDN(integer $format = self::DN_ARRAY): mixed

Arguments

$format

integer

optional

Response

mixed

Get an individual Distinguished Name property for a certificate/crl issuer

getIssuerDNProp(string $propName,boolean $withType = false): mixed

Arguments

$propName

string

$withType

boolean

optional

Response

mixed

Associate an extension ID to an extension mapping

getMapping(string $extnId): mixed

Arguments

$extnId

string

Response

mixed

Gets the public key

getPublicKey(): mixed

Returns a \phpseclib3\Crypt\RSA object or a false.

Response

mixed

Register the mapping for a custom/unsupported extension.

getRegisteredExtension(string $id): array|null
static

Arguments

$id

string

Response

array|null

Get a revoked certificate.

getRevoked(string $serial): mixed

Arguments

$serial

string

Response

mixed

Get a Revoked Certificate Extension

getRevokedCertificateExtension(string $serial,string $id,array $crl = null): mixed

Returns the extension if it exists and false if not

Arguments

$serial

string

$id

string

$crl

array

optional

Response

mixed

Returns a list of all extensions in use for a given revoked certificate

getRevokedCertificateExtensions(string $serial,array $crl = null): array|boolean

Arguments

$serial

string

$crl

array

optional

Response

array|boolean

Get the Distinguished Name for a certificate/csr subject Alias of getDN()

getSubjectDN(integer $format = self::DN_ARRAY): mixed

Arguments

$format

integer

optional

Response

mixed

Get an individual Distinguished Name property for a certificate/csr subject

getSubjectDNProp(string $propName,boolean $withType = false): mixed

Arguments

$propName

string

$withType

boolean

optional

Response

mixed

Identify signature algorithm from key settings

identifySignatureAlgorithm(\phpseclib3\Crypt\Common\PrivateKey $key): string
static
Throws
\phpseclib3\Exception\UnsupportedAlgorithmException

if the algorithm is unsupported

Arguments

$key

\phpseclib3\Crypt\Common\PrivateKey

Response

string

Helper function to build IP Address array

iPAddress(string $address): array

(IPv6 is not currently supported)

Arguments

$address

string

Response

array

Check for validity of subarray

isSubArrayValid(array $root,string $path): boolean

This is intended for use in conjunction with _subArrayUnchecked(), implementing the checks included in _subArray() but without copying a potentially large array by passing its reference by-value to is_array().

Arguments

$root

array

$path

string

Response

boolean

List revoked certificates

listRevoked(array $crl = null): array|boolean

Arguments

$crl

array

optional

Response

array|boolean

Load an X.509 certificate as a certificate authority

loadCA(string $cert): boolean

Arguments

$cert

string

Response

boolean

Load a Certificate Revocation List

loadCRL(string $crl,integer $mode = self::FORMAT_AUTO_DETECT): mixed

Arguments

$crl

string

$mode

integer

Response

mixed

Load a Certificate Signing Request

loadCSR(string $csr,integer $mode = self::FORMAT_AUTO_DETECT): mixed

Arguments

$csr

string

$mode

integer

Response

mixed

Load a SPKAC CSR

loadSPKAC(string $spkac): mixed

SPKAC's are produced by the HTML5 keygen element:

https://developer.mozilla.org/en-US/docs/HTML/Element/keygen

Arguments

$spkac

string

Response

mixed

Load X.509 certificate

loadX509(array|string $cert,integer $mode = self::FORMAT_AUTO_DETECT): mixed

Returns an associative array describing the X.509 cert or a false if the cert failed to load

Arguments

$cert

array|string

$mode

integer

Response

mixed

Turns the certificate into a certificate authority

makeCA()

Map attribute values from ANY type to attribute-specific internal format.

mapInAttributes(array &$root,string $path)

Arguments

$root

array

(by reference)

$path

string

Map DN values from ANY type to DN-specific internal format.

mapInDNs(array &$root,string $path)

Arguments

$root

array

(by reference)

$path

string

Map extension values from octet string to extension-specific internal format.

mapInExtensions(array &$root,string $path)

Arguments

$root

array

(by reference)

$path

string

Map attribute values from attribute-specific internal format to ANY type.

mapOutAttributes(array &$root,string $path)

Arguments

$root

array

(by reference)

$path

string

Map DN values from DN-specific internal format to ANY type.

mapOutDNs(array &$root,string $path)

Arguments

$root

array

(by reference)

$path

string

Map extension values from extension-specific internal format to octet string.

mapOutExtensions(array &$root,string $path)

Arguments

$root

array

(by reference)

$path

string

Register the mapping for a custom/unsupported extension.

registerExtension(string $id,array $mapping)
static

Arguments

$id

string

$mapping

array

Remove a CSR attribute.

removeAttribute(string $id,integer $disposition = self::ATTR_ALL): boolean

Arguments

$id

string

$disposition

integer

optional

Response

boolean

Remove Distinguished Name properties

removeDNProp(string $propName)

Arguments

$propName

string

Remove a certificate, CSR or CRL Extension

removeExtension(string $id): boolean

Arguments

$id

string

Response

boolean

Remove an Extension

removeExtensionHelper(string $id,string $path = null): boolean

Arguments

$id

string

$path

string

optional

Response

boolean

Remove a Revoked Certificate Extension

removeRevokedCertificateExtension(string $serial,string $id): boolean

Arguments

$serial

string

$id

string

Response

boolean

Revoke a certificate.

revoke(string $serial,string $date = null): boolean

Arguments

$serial

string

$date

string

optional

Response

boolean

Get the index of a revoked certificate.

revokedCertificate(array &$rclist,string $serial,boolean $create = false): integer|false

Arguments

$rclist

array

$serial

string

$create

boolean

optional

Response

integer|false

Save Certificate Revocation List.

saveCRL(array $crl,integer $format = self::FORMAT_PEM): string

Arguments

$crl

array

$format

integer

optional

Response

string

Save CSR request

saveCSR(array $csr,integer $format = self::FORMAT_PEM): string

Arguments

$csr

array

$format

integer

optional

Response

string

Save a SPKAC CSR request

saveSPKAC(array $spkac,integer $format = self::FORMAT_PEM): string

Arguments

$spkac

array

$format

integer

optional

Response

string

Save X.509 certificate

saveX509(array $cert,integer $format = self::FORMAT_PEM): string

Arguments

$cert

array

$format

integer

optional

Response

string

Set a CSR attribute

setAttribute(string $id,mixed $value,integer $disposition = self::ATTR_ALL): boolean

Arguments

$id

string

$value

mixed

$disposition

integer

optional

Response

boolean

Set challenge

setChallenge(string $challenge)

Used for SPKAC CSR's

Arguments

$challenge

string

Set a Distinguished Name

setDN(mixed $dn,boolean $merge = false,string $type = 'utf8String'): boolean

Arguments

$dn

mixed

$merge

boolean

optional

$type

string

optional

Response

boolean

Set a Distinguished Name property

setDNProp(string $propName,mixed $propValue,string $type = 'utf8String'): boolean

Arguments

$propName

string

$propValue

mixed

$type

string

optional

Response

boolean

Set the domain name's which the cert is to be valid for

setDomain(mixed $domains): void

Arguments

$domains

mixed

Set certificate end date

setEndDate(\DateTimeInterface|string $date)

Arguments

$date

\DateTimeInterface|string

Set a certificate, CSR or CRL Extension

setExtension(string $id,mixed $value,boolean $critical = false,boolean $replace = true): boolean

Arguments

$id

string

$value

mixed

$critical

boolean

optional

$replace

boolean

optional

Response

boolean

Set an Extension

setExtensionHelper(string $id,mixed $value,boolean $critical = false,boolean $replace = true,string $path = null): boolean

Arguments

$id

string

$value

mixed

$critical

boolean

optional

$replace

boolean

optional

$path

string

optional

Response

boolean

Register the mapping for a custom/unsupported extension.

setExtensionValue(string $id,mixed $value,boolean $critical = false,boolean $replace = false)

Arguments

$id

string

$value

mixed

$critical

boolean

$replace

boolean

Set the IP Addresses's which the cert is to be valid for

setIPAddress(array<mixed,mixed> $ipAddresses)

Arguments

$ipAddresses

array<mixed,mixed>

Sets the subject key identifier

setKeyIdentifier(string $value)

This is used by the id-ce-authorityKeyIdentifier and the id-ce-subjectKeyIdentifier extensions.

Arguments

$value

string

Set private key

setPrivateKey(\phpseclib3\Crypt\Common\PrivateKey $key)

Key needs to be a \phpseclib3\Crypt\RSA object

Arguments

$key

\phpseclib3\Crypt\Common\PrivateKey

Set public key

setPublicKey(\phpseclib3\Crypt\Common\PublicKey $key): void

Key needs to be a \phpseclib3\Crypt\RSA object

Arguments

$key

\phpseclib3\Crypt\Common\PublicKey

Sets the recursion limit

setRecurLimit(integer $count)
static

When validating a signature it may be necessary to download intermediate certs from URI's. An intermediate cert that linked to itself would result in an infinite loop so to prevent that we set a recursion limit. A negative number means that there is no recursion limit.

Arguments

$count

integer

Set a Revoked Certificate Extension

setRevokedCertificateExtension(string $serial,string $id,mixed $value,boolean $critical = false,boolean $replace = true): boolean

Arguments

$serial

string

$id

string

$value

mixed

$critical

boolean

optional

$replace

boolean

optional

Response

boolean

Set Serial Number

setSerialNumber(string $serial,integer $base = -256)

Arguments

$serial

string

$base

integer

optional

Set certificate start date

setStartDate(\DateTimeInterface|string $date)

Arguments

$date

\DateTimeInterface|string

Sign an X.509 certificate

sign(\phpseclib3\File\X509 $issuer,\phpseclib3\File\X509 $subject): mixed

$issuer's private key needs to be loaded. $subject can be either an existing X.509 cert (if you want to resign it), a CSR or something with the DN and public key explicitly set.

Arguments

$issuer

\phpseclib3\File\X509

$subject

\phpseclib3\File\X509

Response

mixed

Sign a CRL

signCRL(\phpseclib3\File\X509 $issuer,\phpseclib3\File\X509 $crl): mixed

$issuer's private key needs to be loaded.

Arguments

$issuer

\phpseclib3\File\X509

$crl

\phpseclib3\File\X509

Response

mixed

Sign a CSR

signCSR(): mixed

Response

mixed

Sign a SPKAC

signSPKAC(): mixed

Response

mixed

Get a reference to a subarray

subArray(array &$root = null,string $path,boolean $create = false): array|false

Arguments

$root

array

$path

string

absolute path with / as component separator

$create

boolean

optional

Response

array|false

Get a reference to a subarray

subArrayUnchecked(array &$root,string $path,boolean $create = false): array|false

This variant of _subArray() does no is_array() checking, so $root should be checked with _isSubArrayValid() first.

This is here for performance reasons: Passing a reference (i.e. $root) by-value (i.e. to is_array()) creates a copy. If $root is an especially large array, this is expensive.

Arguments

$root

array

$path

string

absolute path with / as component separator

$create

boolean

optional

Response

array|false

Validates an intermediate cert as identified via authority info access extension

testForIntermediate(boolean $caonly,integer $count): boolean

See https://tools.ietf.org/html/rfc4325 for more info

Arguments

$caonly

boolean

$count

integer

Response

boolean

Helper function to build a time field according to RFC 3280 section - 4.1.2.5 Validity - 5.1.2.4 This Update - 5.1.2.5 Next Update - 5.1.2.6 Revoked Certificates by choosing utcTime iff year of date given is before 2050 and generalTime else.

timeField(string $date): array|\phpseclib3\File\ASN1\Element

Arguments

$date

string

in format date('D, d M Y H:i:s O')

Response

array|\phpseclib3\File\ASN1\Element

"Normalizes" a Distinguished Name property

translateDNProp(string $propName): mixed

Arguments

$propName

string

Response

mixed

Unrevoke a certificate.

unrevoke(string $serial): boolean

Arguments

$serial

string

Response

boolean

Validate a date

validateDate(\DateTimeInterface|string $date = null): boolean

If $date isn't defined it is assumed to be the current date.

Arguments

$date

\DateTimeInterface|string

optional

Response

boolean

Validate a signature

validateSignature(boolean $caonly = true): mixed

Works on X.509 certs, CSR's and CRL's. Returns true if the signature is verified, false if it is not correct or null on error

By default returns false for self-signed certs. Call validateSignature(false) to make this support self-signed.

The behavior of this function is inspired by openssl_verify.

Arguments

$caonly

boolean

optional

Response

mixed

Validate a signature

validateSignatureCountable(boolean $caonly,integer $count): mixed

Performs said validation whilst keeping track of how many times validation method is called

Arguments

$caonly

boolean

$count

integer

Response

mixed

Validates a signature

validateSignatureHelper(string $publicKeyAlgorithm,string $publicKey,string $signatureAlgorithm,string $signature,string $signatureSubject): boolean

Returns true if the signature is verified and false if it is not correct. If the algorithms are unsupposed an exception is thrown.

Throws
\phpseclib3\Exception\UnsupportedAlgorithmException

if the algorithm is unsupported

Arguments

$publicKeyAlgorithm

string

$publicKey

string

$signatureAlgorithm

string

$signature

string

$signatureSubject

string

Response

boolean

Validate an X.509 certificate against a URL

validateURL(string $url): boolean

From RFC2818 "HTTP over TLS":

Matching is performed using the matching rules specified by [RFC2459]. If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character which is considered to match any single domain name component or component fragment. E.g., .a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.

Arguments

$url

string

Response

boolean

Constants

Flag to only accept signatures signed by certificate authorities

VALIDATE_SIGNATURE_BY_CA

Not really used anymore but retained all the same to suppress E_NOTICEs from old installs

Return internal array representation

DN_ARRAY
see

Return string

DN_STRING
see

Return ASN.1 name string

DN_ASN1
see

Return OpenSSL compatible array

DN_OPENSSL
see

Return canonical ASN.1 RDNs string

DN_CANON
see

Return name hash for file indexing

DN_HASH
see

Save as PEM

FORMAT_PEM

ie. a base64-encoded PEM with a header and a footer

see

Save as DER

FORMAT_DER
see

Save as a SPKAC

FORMAT_SPKAC
see

Only works on CSRs. Not currently supported.

Auto-detect the format

FORMAT_AUTO_DETECT

Used only by the load*() functions

see

Attribute value disposition.

ATTR_ALL

If disposition is >= 0, this is the index of the target value.

ATTR_APPEND

ATTR_APPEND

ATTR_REPLACE

ATTR_REPLACE

Properties

Distinguished Name

dn :array
var

Type(s)

array

Public key

publicKey :string|\phpseclib3\Crypt\Common\PublicKey
var

Type(s)

string|\phpseclib3\Crypt\Common\PublicKey

Private key

privateKey :string|\phpseclib3\Crypt\Common\PrivateKey
var

Type(s)

string|\phpseclib3\Crypt\Common\PrivateKey

The certificate authorities

CAs :array
var

Type(s)

array

The currently loaded certificate

currentCert :array
var

Type(s)

array

The signature subject

signatureSubject :string

There's no guarantee \phpseclib3\File\X509 is going to re-encode an X.509 cert in the same way it was originally encoded so we take save the portion of the original cert that the signature would have made for.

var

Type(s)

string

Certificate Start Date

startDate :string
var

Type(s)

string

Certificate End Date

endDate :string|\phpseclib3\File\ASN1\Element
var

Type(s)

string|\phpseclib3\File\ASN1\Element

Serial Number

serialNumber :string
var

Type(s)

string

Key Identifier

currentKeyIdentifier :string

See RFC5280#section-4.2.1.1 and RFC5280#section-4.2.1.2.

var

Type(s)

string

CA Flag

caFlag :boolean
var

Type(s)

boolean

SPKAC Challenge

challenge :string
var

Type(s)

string

extensionValues

extensionValues :array
var

Type(s)

array

OIDs loaded

oidsLoaded :boolean
static
var

Type(s)

boolean

Recursion Limit

recur_limit :integer
static
var

Type(s)

integer

URL fetch flag

disable_url_fetch :boolean
static
var

Type(s)

boolean

extensions

extensions :array
static
var

Type(s)

array

ipAddresses

ipAddresses :\phpseclib3\File\?array
var

Type(s)

\phpseclib3\File\?array

domains

domains :\phpseclib3\File\?array
var

Type(s)

\phpseclib3\File\?array