X509

Default Constructor.

Load X.509 certificate

Returns an associative array describing the X.509 cert or a false if the cert failed to load

Save X.509 certificate

Map extension values from octet string to extension-specific internal format.

Map extension values from extension-specific internal format to octet string.

Map attribute values from ANY type to attribute-specific internal format.

Map attribute values from attribute-specific internal format to ANY type.

Map DN values from ANY type to DN-specific internal format.

Map DN values from DN-specific internal format to ANY type.

Associate an extension ID to an extension mapping

Load an X.509 certificate as a certificate authority

Validate an X.509 certificate against a URL

From RFC2818 "HTTP over TLS":

Matching is performed using the matching rules specified by [RFC2459]. If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., .a.com matches foo.a.com but not bar.foo.a.com. f.com matches foo.com but not bar.com.

Validate a date

If $date isn't defined it is assumed to be the current date.

Fetches a URL

Validates an intermediate cert as identified via authority info access extension

See https://tools.ietf.org/html/rfc4325 for more info

Validate a signature

Works on X.509 certs, CSR's and CRL's. Returns true if the signature is verified, false if it is not correct or null on error

By default returns false for self-signed certs. Call validateSignature(false) to make this support self-signed.

The behavior of this function is inspired by {@link http://php.net/openssl-verify openssl_verify}.

Validate a signature

Performs said validation whilst keeping track of how many times validation method is called

Validates a signature

Returns true if the signature is verified, false if it is not correct or null on error

Sets the recursion limit

When validating a signature it may be necessary to download intermediate certs from URI's. An intermediate cert that linked to itself would result in an infinite loop so to prevent that we set a recursion limit. A negative number means that there is no recursion limit.

Prevents URIs from being automatically retrieved

Allows URIs to be automatically retrieved

Reformat public keys

Reformats a public key to a format supported by phpseclib (if applicable)

Decodes an IP address

Takes in a base64 encoded "blob" and returns a human readable IP address

Decodes an IP address in a name constraints extension

Takes in a base64 encoded "blob" and returns a human readable IP address / mask

Encodes an IP address

Takes a human readable IP address into a base64-encoded "blob"

"Normalizes" a Distinguished Name property

Set a Distinguished Name property

Remove Distinguished Name properties

Get Distinguished Name properties

Set a Distinguished Name

Get the Distinguished Name for a certificates subject

Get the Distinguished Name for a certificate/crl issuer

Get the Distinguished Name for a certificate/csr subject Alias of getDN()

Get an individual Distinguished Name property for a certificate/crl issuer

Get an individual Distinguished Name property for a certificate/csr subject

Get the certificate chain for the current cert

Set public key

Key needs to be a \phpseclib\Crypt\RSA object

Set private key

Key needs to be a \phpseclib\Crypt\RSA object

Set challenge

Used for SPKAC CSR's

Gets the public key

Returns a \phpseclib\Crypt\RSA object or a false.

Load a Certificate Signing Request

Save CSR request

Load a SPKAC CSR

SPKAC's are produced by the HTML5 keygen element:

https://developer.mozilla.org/en-US/docs/HTML/Element/keygen

Save a SPKAC CSR request

Load a Certificate Revocation List

Save Certificate Revocation List.

Helper function to build a time field according to RFC 3280 section - 4.1.2.5 Validity - 5.1.2.4 This Update - 5.1.2.5 Next Update - 5.1.2.6 Revoked Certificates by choosing utcTime iff year of date given is before 2050 and generalTime else.

Sign an X.509 certificate

$issuer's private key needs to be loaded. $subject can be either an existing X.509 cert (if you want to resign it), a CSR or something with the DN and public key explicitly set.

Sign a CSR

Sign a SPKAC

Sign a CRL

$issuer's private key needs to be loaded.

X.509 certificate signing helper function.

Set certificate start date

Set certificate end date

Set Serial Number

Turns the certificate into a certificate authority

Check for validity of subarray

This is intended for use in conjunction with _subArrayUnchecked(), implementing the checks included in _subArray() but without copying a potentially large array by passing its reference by-value to is_array().

Get a reference to a subarray

This variant of _subArray() does no is_array() checking, so $root should be checked with _isSubArrayValid() first.

This is here for performance reasons: Passing a reference (i.e. $root) by-value (i.e. to is_array()) creates a copy. If $root is an especially large array, this is expensive.

Get a reference to a subarray

Get a reference to an extension subarray

Remove an Extension

Get an Extension

Returns the extension if it exists and false if not

Returns a list of all extensions in use

Set an Extension

Remove a certificate, CSR or CRL Extension

Get a certificate, CSR or CRL Extension

Returns the extension if it exists and false if not

Returns a list of all extensions in use in certificate, CSR or CRL

Set a certificate, CSR or CRL Extension

Remove a CSR attribute.

Get a CSR attribute

Returns the attribute if it exists and false if not

Returns a list of all CSR attributes in use

Set a CSR attribute

Sets the subject key identifier

This is used by the id-ce-authorityKeyIdentifier and the id-ce-subjectKeyIdentifier extensions.

Compute a public key identifier.

Although key identifiers may be set to any unique value, this function computes key identifiers from public key according to the two recommended methods (4.2.1.2 RFC 3280). Highly polymorphic: try to accept all possible forms of key: - Key object - \phpseclib\File\X509 object with public or private key defined - Certificate or CSR array - \phpseclib\File\ASN1\Element object - PEM or DER string

Format a public key as appropriate

Set the domain name's which the cert is to be valid for

Set the IP Addresses's which the cert is to be valid for

Helper function to build domain array

Helper function to build IP Address array

(IPv6 is not currently supported)

Get the index of a revoked certificate.

Revoke a certificate.

Unrevoke a certificate.

Get a revoked certificate.

List revoked certificates

Remove a Revoked Certificate Extension

Get a Revoked Certificate Extension

Returns the extension if it exists and false if not

Returns a list of all extensions in use for a given revoked certificate

Set a Revoked Certificate Extension

Extract raw BER from Base64 encoding

Returns the OID corresponding to a name

What's returned in the associative array returned by loadX509() (or load*()) is either a name or an OID if no OID to name mapping is available. The problem with this is that what may be an unmapped OID in one version of phpseclib may not be unmapped in the next version, so apps that are looking at this OID may not be able to work from version to version.

This method will return the OID if a name is passed to it and if no mapping is avialable it'll assume that what's being passed to it already is an OID and return that instead. A few examples.

getOID('2.16.840.1.101.3.4.2.1') == '2.16.840.1.101.3.4.2.1' getOID('id-sha256') == '2.16.840.1.101.3.4.2.1' getOID('zzz') == 'zzz'