X509

Default Constructor.

Load X.509 certificate

Returns an associative array describing the X.509 cert or a false if the cert failed to load

Save X.509 certificate

Load an X.509 certificate as a certificate authority

Validate an X.509 certificate against a URL

From RFC2818 "HTTP over TLS":

Matching is performed using the matching rules specified by [RFC2459]. If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., .a.com matches foo.a.com but not bar.foo.a.com. f.com matches foo.com but not bar.com.

Validate a date

If $date isn't defined it is assumed to be the current date.

Validate a signature

Works on X.509 certs, CSR's and CRL's. Returns true if the signature is verified, false if it is not correct or null on error

By default returns false for self-signed certs. Call validateSignature(false) to make this support self-signed.

The behavior of this function is inspired by {@link http://php.net/openssl-verify openssl_verify}.

Sets the recursion limit

When validating a signature it may be necessary to download intermediate certs from URI's. An intermediate cert that linked to itself would result in an infinite loop so to prevent that we set a recursion limit. A negative number means that there is no recursion limit.

Prevents URIs from being automatically retrieved

Allows URIs to be automatically retrieved

Decodes an IP address

Takes in a base64 encoded "blob" and returns a human readable IP address

Decodes an IP address in a name constraints extension

Takes in a base64 encoded "blob" and returns a human readable IP address / mask

Encodes an IP address

Takes a human readable IP address into a base64-encoded "blob"

Set a Distinguished Name property

Remove Distinguished Name properties

Get Distinguished Name properties

Set a Distinguished Name

Get the Distinguished Name for a certificates subject

Get the Distinguished Name for a certificate/crl issuer

Get the Distinguished Name for a certificate/csr subject Alias of getDN()

Get an individual Distinguished Name property for a certificate/crl issuer

Get an individual Distinguished Name property for a certificate/csr subject

Get the certificate chain for the current cert

Returns the current cert

Set public key

Key needs to be a \phpseclib3\Crypt\RSA object

Set private key

Key needs to be a \phpseclib3\Crypt\RSA object

Set challenge

Used for SPKAC CSR's

Gets the public key

Returns a \phpseclib3\Crypt\RSA object or a false.

Load a Certificate Signing Request

Save CSR request

Load a SPKAC CSR

SPKAC's are produced by the HTML5 keygen element:

https://developer.mozilla.org/en-US/docs/HTML/Element/keygen

Save a SPKAC CSR request

Load a Certificate Revocation List

Save Certificate Revocation List.

Sign an X.509 certificate

$issuer's private key needs to be loaded. $subject can be either an existing X.509 cert (if you want to resign it), a CSR or something with the DN and public key explicitly set.

Sign a CSR

Sign a SPKAC

Sign a CRL

$issuer's private key needs to be loaded.

Set certificate start date

Set certificate end date

Set Serial Number

Turns the certificate into a certificate authority

Remove a certificate, CSR or CRL Extension

Get a certificate, CSR or CRL Extension

Returns the extension if it exists and false if not

Returns a list of all extensions in use in certificate, CSR or CRL

Set a certificate, CSR or CRL Extension

Remove a CSR attribute.

Get a CSR attribute

Returns the attribute if it exists and false if not

Returns a list of all CSR attributes in use

Set a CSR attribute

Sets the subject key identifier

This is used by the id-ce-authorityKeyIdentifier and the id-ce-subjectKeyIdentifier extensions.

Compute a public key identifier.

Although key identifiers may be set to any unique value, this function computes key identifiers from public key according to the two recommended methods (4.2.1.2 RFC 3280). Highly polymorphic: try to accept all possible forms of key: - Key object - \phpseclib3\File\X509 object with public or private key defined - Certificate or CSR array - \phpseclib3\File\ASN1\Element object - PEM or DER string

Set the domain name's which the cert is to be valid for

Set the IP Addresses's which the cert is to be valid for

Revoke a certificate.

Unrevoke a certificate.

Get a revoked certificate.

List revoked certificates

Remove a Revoked Certificate Extension

Get a Revoked Certificate Extension

Returns the extension if it exists and false if not

Returns a list of all extensions in use for a given revoked certificate

Set a Revoked Certificate Extension

Register the mapping for a custom/unsupported extension.

Register the mapping for a custom/unsupported extension.

Register the mapping for a custom/unsupported extension.