Как узнать что openssl включен в php

openssl_verify

openssl_verify() verifies that the signature is correct for the specified data using the public key associated with public_key . This must be the public key corresponding to the private key used for signing.

Parameters

The string of data used to generate the signature previously

A raw binary string, generated by openssl_sign() or similar means

string — a PEM formatted key (e.g. ——BEGIN PUBLIC KEY—— MIIBCgK. )

string — a valid string returned by openssl_get_md_methods() example, «sha1WithRSAEncryption» or «sha512».

Return Values

Returns 1 if the signature is correct, 0 if it is incorrect, and -1 or false on error.

Changelog

Version	Description
8.0.0	public_key accepts an OpenSSLAsymmetricKey or OpenSSLCertificate instance now; previously, a resource of type OpenSSL key or OpenSSL X.509 was accepted.

Examples

Example #1 openssl_verify() example

// $data and $signature are assumed to contain the data and the signature

// fetch public key from certificate and ready it
$pubkeyid = openssl_pkey_get_public ( «file://src/openssl-0.9.6/demos/sign/cert.pem» );

// state whether signature is okay or not
$ok = openssl_verify ( $data , $signature , $pubkeyid );
if ( $ok == 1 ) echo «good» ;
> elseif ( $ok == 0 ) echo «bad» ;
> else echo «ugly, error checking signature» ;
>
// free the key from memory
openssl_free_key ( $pubkeyid );
?>

Example #2 openssl_verify() example

//data you want to sign
$data = ‘my data’ ;

//create new private and public key
$private_key_res = openssl_pkey_new (array(
«private_key_bits» => 2048 ,
«private_key_type» => OPENSSL_KEYTYPE_RSA ,
));
$details = openssl_pkey_get_details ( $private_key_res );
$public_key_res = openssl_pkey_get_public ( $details [ ‘key’ ]);

//create signature
openssl_sign ( $data , $signature , $private_key_res , «sha256WithRSAEncryption» );

//verify signature
$ok = openssl_verify ( $data , $signature , $public_key_res , OPENSSL_ALGO_SHA256 );
if ( $ok == 1 ) echo «valid» ;
> elseif ( $ok == 0 ) echo «invalid» ;
> else echo «error: » . openssl_error_string ();
>
?>

User Contributed Notes 8 notes

17 years ago

I’ve finally found a way to verify signature. Sample in the documentation doesn’t work. Code bellow DOES work 🙂

// $data is assumed to contain the data to be signed

// fetch certificate from file and ready it
$fp = fopen ( «path/file.pem» , «r» );
$cert = fread ( $fp , 8192 );
fclose ( $fp );

// state whether signature is okay or not
// use the certificate, not the public key
$ok = openssl_verify ( $data , $signature , $cert );
if ( $ok == 1 ) echo «good» ;
> elseif ( $ok == 0 ) echo «bad» ;
> else echo «ugly, error checking signature» ;
>
?>

13 years ago

I spent days scouring the php openssl documentation trying to figure out how to do what sounds like a simple task — given two PEM encoded certificates, is one the signer of the other? Nowhere in the openssl_verify() documentation or comments is it explained where to obtain the signature of an existing certificate. The openssl_x509_parse() function looked promising, but it is an unstable API that may change.

I had to write my own code to determine if one cert signed another, it is located here: http://badpenguins.com/source/misc/isCertSigner.php?viewSource

In a nutshell here is what I learned.

The signature data in a signed X.509 certificate contains DER formatted data about the signature that is encrypted with the signers public key. The data contains a hash of the original subject certificate and information about what encryption algorithm was used to create the signature.

So you need to get this signature data and a copy of the original certificate with the issuer and signature sequences removed. Hash a copy of the original certificate (sans issuer/signature sequences) with the same algorithm the issuer used and if the hashes match, you have the issuer cert that signed the certificate.

21 years ago

A note about the openssl_verify() (and some of the other functions). The public key comes from a certificate in any of the support formats (as the example shows, use openssl_get_publickey() to get the resource id). But after some trial and error I found the signature string MUST BE BINARY. While no error occurs, passing a base64-formatted signature string (PEM format?), you simply get a mismatch. When I did the base64 decode myself, the verify returned a match (return value 1). You can simply drop the begin/end lines and take the output of the ‘base64_decode()’ function.

2 years ago

As stated from the doc: «Returns 1 if the signature is correct, 0 if it is incorrect, and -1 or false on error. «

In the second example as a well as in Stiv’s note, following condition will match for both 0 or false, which have different meaning:
elseif ($ok == 0) echo «bad»;
>

On should do an identical test here (===) instead of an equal test (==):
elseif ($ok === 0) echo «bad»;
>
—
var_dump(0==false); //==> true
var_dump(0===false);//==> false

5 years ago

openssl_verify() is populating openssl_error_string() even on false.

When openssl_verify() returns 0, openssl_error_string() is populated with 1.
I spent lot of time to understand, while my next call to openssl was failing with checks for error.

$c = file_get_contents ( $filename );
$publicKey = openssl_pkey_get_public ( $c );
$result = openssl_verify ( ‘freedom’ , ‘someirrelevantnosign’ , $publicKey );

while ( $msg = openssl_error_string () !== false ) $error .= $msg ;
>

if (!empty( $error )) echo $error ; // 1
>

9 years ago

mikey at badpenguins dot com — validating an X509 certificate chain in php seems to be possible with openssl_x509_checkpurpose()

12 years ago

You can actually use the public key as third parameter and not the certificate.

If you can’t make it work, make sure that :

1) Your public key is well formatted. It seems that it must have the —-BEGIN PUBLIC KEY—- and —-END PUBLIC KEY—-

2) Your signature is in binary format. You can use the php base64_decode for this.

22 years ago

Anbybody trying to get a Win32 CryptoAPI based digital signature component to work with the openssl_verify() function should be aware that the CryptoAPI PKCS1 (RSA) method uses bytes in reverse order while the openssl_verify() method expects a correctly formatted PKCS1 digital signature (as should be). I learned this the hard way and it took me some time to dig this out. A simple solution in VBScript to reverse the byte order:

‘ reverse bytes in the signature using Hex format
For i = 1 To N — 1 Step 2
s = Mid(Blob, i, 2) & s
Next

s contains the digital signature in reverse order. Blob is an arbitrary binary container.

Send the signature off in Hex format and use a hex2bin method in PHP to convert to the correct format for openssl_verify(), i.e.

$len = strlen($data);
return pack(«H» . $len, $data);

That’s it, hope it helps out. BTW I used ASPEncrypt to toy around with on Win32 platform. Works only with Internet Explorer but you could also use a Java applet and have none of the abovementioned problems 🙂

OpenSSL Functions

openssl_cipher_iv_length
openssl_cipher_key_length
openssl_cms_decrypt
openssl_cms_encrypt
openssl_cms_read
openssl_cms_sign
openssl_cms_verify
openssl_csr_export_to_file
openssl_csr_export
openssl_csr_get_public_key
openssl_csr_get_subject
openssl_csr_new
openssl_csr_sign
openssl_decrypt
openssl_dh_compute_key
openssl_digest
openssl_encrypt
openssl_error_string
openssl_free_key
openssl_get_cert_locations
openssl_get_cipher_methods
openssl_get_curve_names
openssl_get_md_methods
openssl_get_privatekey
openssl_get_publickey
openssl_open
openssl_pbkdf2
openssl_pkcs12_export_to_file
openssl_pkcs12_export
openssl_pkcs12_read
openssl_pkcs7_decrypt
openssl_pkcs7_encrypt
openssl_pkcs7_read
openssl_pkcs7_sign
openssl_pkcs7_verify
openssl_pkey_derive
openssl_pkey_export_to_file
openssl_pkey_export
openssl_pkey_free
openssl_pkey_get_details
openssl_pkey_get_private
openssl_pkey_get_public
openssl_pkey_new
openssl_private_decrypt
openssl_private_encrypt
openssl_public_decrypt
openssl_public_encrypt
openssl_random_pseudo_bytes
openssl_seal
openssl_sign
openssl_spki_export_challenge
openssl_spki_export
openssl_spki_new
openssl_spki_verify
openssl_verify
openssl_x509_check_private_key
openssl_x509_checkpurpose
openssl_x509_export_to_file
openssl_x509_export
openssl_x509_fingerprint
openssl_x509_free
openssl_x509_parse
openssl_x509_read
openssl_x509_verify

Copyright © 2001-2023 The PHP Group
My PHP.net
Contact
Other PHP.net sites
Privacy policy

openssl_csr_get_subject

openssl_csr_get_subject() returns subject distinguished name information encoded in the csr including fields commonName (CN), organizationName (O), countryName (C) etc.

Parameters

See CSR parameters for a list of valid values.

shortnames controls how the data is indexed in the array — if shortnames is true (the default) then fields will be indexed with the short name form, otherwise, the long name form will be used — e.g.: CN is the shortname form of commonName.

Return Values

Returns an associative array with subject description, or false on failure.

Changelog

Version	Description
8.0.0	csr accepts an OpenSSLCertificateSigningRequest instance now; previously, a resource of type OpenSSL X.509 CSR was accepted.

Examples

Example #1 openssl_csr_get_subject() example

$subject = array(
«countryName» => «CA» ,
«stateOrProvinceName» => «Alberta» ,
«localityName» => «Calgary» ,
«organizationName» => «XYZ Widgets Inc» ,
«organizationalUnitName» => «PHP Documentation Team» ,
«commonName» => «Wez Furlong» ,
«emailAddress» => «wez@example.com» ,
);
$private_key = openssl_pkey_new (array(
«private_key_bits» => 2048 ,
«private_key_type» => OPENSSL_KEYTYPE_RSA ,
));
$configargs = array(
‘digest_alg’ => ‘sha512WithRSAEncryption’
);
$csr = openssl_csr_new ( $subject , $privkey , $configargs );
print_r ( openssl_csr_get_subject ( $csr ));
?>

The above example will output something similar to:

Array ( [C] => CA [ST] => Alberta [L] => Calgary [O] => XYZ Widgets Inc [OU] => PHP Documentation Team [CN] => Wez Furlong [emailAddress] => wez@example.com )

User Contributed Notes 4 notes

8 years ago

openssl_csr_get_subject(‘somedomain.com’,false);
return
array(7) [«countryName»]=> string «XX»
[«stateOrProvinceName»]=> string «xxxxxxxxx»
[«localityName»]=> string «xxxxxxxx»
[«organizationName»]=> string «xxxxxxxxx»
[«organizationalUnitName»]=>string «xxxx»
[«commonName»]=>string «xxx»
[«emailAddress»]=>string «xxx»
>

openssl_csr_get_subject(‘somedomain.com’,true);
return
array(7) [«C»]=> string «XX»
[«ST»]=> string «xxxxxxxxx»
[«L»]=> string «xxxxxxxx»
[«O»]=> string «xxxxxxxxx»
[«OU»]=>string «xxxx»
[«CN»]=>string «xxx»
[«emailAddress»]=>string «xxx»
>

13 years ago

this function does not yet return SANs (subject alternative names) fields for UC certificates like those used in exchange 2007.

7 years ago

This function may not return name fields in the order they appear in the certificate. For example, this CSR:

——BEGIN CERTIFICATE REQUEST——
MIHsMIGUAgEAMDIxEDAOBgNVBAsMB3VuaXQgIzExDDAKBgNVBAoMA29yZzEQMA4G
A1UECwwHdW5pdCAjMjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGvZnFxGuVzJ
hOKPs5RNxZBS4vY6ERaqm5tKMGOhxLSfv/dpjDtNNdSHkIGNjYxclHYhxG0ku7BY
PA5uPIjng1SgADAKBggqhkjOPQQDAgNHADBEAiB4GXhhbEU1UFTCe0dwJnKHTQuI
xzYL5FnyhmKdixN/0gIgBXSm9S8L/oJ6rBxemin/V/xKv5jy4TEZuz84nnshxQQ=
——END CERTIFICATE REQUEST——

When processed by ‘openssl -noout -subject’ gives this:

subject=/OU=unit #1/O=org/OU=unit #2

On the other hand, ‘var_dump( openssl_csr_get_subject( «. » ) )’ will produce this:

As you can see, ordering information (which may be important for some applications) is lost.

14 years ago

The returning assoziative array is indexed with the fields
in the subject so you should have a array key named CN,OU and so on.

OpenSSL Functions

openssl_cipher_iv_length
openssl_cipher_key_length
openssl_cms_decrypt
openssl_cms_encrypt
openssl_cms_read
openssl_cms_sign
openssl_cms_verify
openssl_csr_export_to_file
openssl_csr_export
openssl_csr_get_public_key
openssl_csr_get_subject
openssl_csr_new
openssl_csr_sign
openssl_decrypt
openssl_dh_compute_key
openssl_digest
openssl_encrypt
openssl_error_string
openssl_free_key
openssl_get_cert_locations
openssl_get_cipher_methods
openssl_get_curve_names
openssl_get_md_methods
openssl_get_privatekey
openssl_get_publickey
openssl_open
openssl_pbkdf2
openssl_pkcs12_export_to_file
openssl_pkcs12_export
openssl_pkcs12_read
openssl_pkcs7_decrypt
openssl_pkcs7_encrypt
openssl_pkcs7_read
openssl_pkcs7_sign
openssl_pkcs7_verify
openssl_pkey_derive
openssl_pkey_export_to_file
openssl_pkey_export
openssl_pkey_free
openssl_pkey_get_details
openssl_pkey_get_private
openssl_pkey_get_public
openssl_pkey_new
openssl_private_decrypt
openssl_private_encrypt
openssl_public_decrypt
openssl_public_encrypt
openssl_random_pseudo_bytes
openssl_seal
openssl_sign
openssl_spki_export_challenge
openssl_spki_export
openssl_spki_new
openssl_spki_verify
openssl_verify
openssl_x509_check_private_key
openssl_x509_checkpurpose
openssl_x509_export_to_file
openssl_x509_export
openssl_x509_fingerprint
openssl_x509_free
openssl_x509_parse
openssl_x509_read
openssl_x509_verify

My PHP.net
Contact
Other PHP.net sites
Privacy policy

openssl_x509_verify

openssl_x509_verify() verifies that the certificate certificate was signed by the private key corresponding to public key public_key .

Parameters

See Key/Certificate parameters for a list of valid values.

string — a PEM formatted key (e.g. ——BEGIN PUBLIC KEY—— MIIBCgK. )

Return Values

Returns 1 if the signature is correct, 0 if it is incorrect, and -1 on error.

Changelog

Version	Description
8.0.0	certificate accepts an OpenSSLCertificate instance now; previously, a resource of type OpenSSL X.509 was accepted.
8.0.0	public_key accepts an OpenSSLAsymmetricKey or OpenSSLCertificate instance now; previously, a resource of type OpenSSL key or OpenSSL X.509 was accepted.

Examples

Example #1 openssl_x509_verify() example

$hostname = «news.php.net» ;
$ssloptions = array(
«capture_peer_cert» => true ,
«capture_peer_cert_chain» => true ,
«allow_self_signed» => false ,
«CN_match» => $hostname ,
«verify_peer» => true ,
«SNI_enabled» => true ,
«SNI_server_name» => $hostname ,
);

$ctx = stream_context_create ( array( «ssl» => $ssloptions ) );
$result = stream_socket_client ( «ssl:// $hostname :443» , $errno , $errstr , 30 , STREAM_CLIENT_CONNECT , $ctx );
$cont = stream_context_get_params ( $result );
$x509 = $cont [ «options» ][ «ssl» ][ «peer_certificate» ];
$certparsed = openssl_x509_parse ( $x509 );

foreach( $cont [ «options» ][ «ssl» ][ «peer_certificate_chain» ] as $chaincert )
$chainparsed = openssl_x509_parse ( $chaincert );
$chain_public_key = openssl_get_publickey ( $chaincert );
$r = openssl_x509_verify ( $x509 , $chain_public_key );
if ( $r == 1 )
echo $certparsed [ ‘subject’ ][ ‘CN’ ];
echo » was digitally signed by » ;
echo $chainparsed [ ‘subject’ ][ ‘CN’ ]. «\n» ;
>
>
?>

User Contributed Notes

There are no user contributed notes for this page.

OpenSSL Functions
- openssl_cipher_iv_length
- openssl_cipher_key_length
- openssl_cms_decrypt
- openssl_cms_encrypt
- openssl_cms_read
- openssl_cms_sign
- openssl_cms_verify
- openssl_csr_export_to_file
- openssl_csr_export
- openssl_csr_get_public_key
- openssl_csr_get_subject
- openssl_csr_new
- openssl_csr_sign
- openssl_decrypt
- openssl_dh_compute_key
- openssl_digest
- openssl_encrypt
- openssl_error_string
- openssl_free_key
- openssl_get_cert_locations
- openssl_get_cipher_methods
- openssl_get_curve_names
- openssl_get_md_methods
- openssl_get_privatekey
- openssl_get_publickey
- openssl_open
- openssl_pbkdf2
- openssl_pkcs12_export_to_file
- openssl_pkcs12_export
- openssl_pkcs12_read
- openssl_pkcs7_decrypt
- openssl_pkcs7_encrypt
- openssl_pkcs7_read
- openssl_pkcs7_sign
- openssl_pkcs7_verify
- openssl_pkey_derive
- openssl_pkey_export_to_file
- openssl_pkey_export
- openssl_pkey_free
- openssl_pkey_get_details
- openssl_pkey_get_private
- openssl_pkey_get_public
- openssl_pkey_new
- openssl_private_decrypt
- openssl_private_encrypt
- openssl_public_decrypt
- openssl_public_encrypt
- openssl_random_pseudo_bytes
- openssl_seal
- openssl_sign
- openssl_spki_export_challenge
- openssl_spki_export
- openssl_spki_new
- openssl_spki_verify
- openssl_verify
- openssl_x509_check_private_key
- openssl_x509_checkpurpose
- openssl_x509_export_to_file
- openssl_x509_export
- openssl_x509_fingerprint
- openssl_x509_free
- openssl_x509_parse
- openssl_x509_read
- openssl_x509_verify
- Copyright © 2001-2023 The PHP Group
- My PHP.net
- Contact
- Other PHP.net sites
- Privacy policy
OpenSSL Functions

Currently, all OpenSSL Functions defined in PHP only utilize the PEM format. Use the following code to convert from DER to PEM and PEM to DER.

$pem_data = file_get_contents ( $cert_path . $pem_file );
$pem2der = pem2der ( $pem_data );

$der_data = file_get_contents ( $cert_path . $der_file );
$der2pem = der2pem ( $der_data );

function pem2der ( $pem_data ) $begin = «CERTIFICATE——» ;
$end = «——END» ;
$pem_data = substr ( $pem_data , strpos ( $pem_data , $begin )+ strlen ( $begin ));
$pem_data = substr ( $pem_data , 0 , strpos ( $pem_data , $end ));
$der = base64_decode ( $pem_data );
return $der ;
>

function der2pem ( $der_data ) $pem = chunk_split ( base64_encode ( $der_data ), 64 , «\n» );
$pem = «——BEGIN CERTIFICATE——\n» . $pem . «——END CERTIFICATE——\n» ;
return $pem ;
>
?>

19 years ago

In case you’re wondering what’s a «correctly hashed» directory for the use with cainfo: it’s simply a directory which contains CA public certificates in PEM/X.509 format. You can get such certificates either from the CA’s website (they advertise it in visible places) or from your browser. In Explorer for instance you can click on the little yellow padlock, go to the CA entry and export it.

The only trick with the directory is that file names must be in the form «hash.#». The «hash» part is the 8-digit hex hash of the certificate, while the # part is a number which serves to differentiate certificates which give the same hash (yes, it can happen with certificates coming from the same CA). Usually # is 0, but you also can use 1, 2 and so on when having more certs with the same hash.

In order to obtain the hash of a certificate you can use the openssl command line utility like this:

openssl x509 -hash -in certfile.cer | head -1

15 years ago

Win32 users having trouble getting php_openssl to work should make sure that they replace ALL the versions of libeay32.dll and ssleay32.dll, with the ones included with PHP. This is especially true while using Apache2 and OpenSSL together, as some OpenSSL win32 packages include older versions of these two files.

17 years ago

For w32 users to enable OpenSSL support. As well as copying «libeay32.dll» to the windows system32 folder you also need to copy «ssleay32.dll». The documentation above should probably be updated to note this.

This requirement was documented at the libcurl pages:

10 years ago

If you want to verify that a csr was generated properly from your private key you can do the following:

$countryName = «UK» ;
$stateOrProvinceName = «London» ;
$localityName = «Blah» ;
$organizationName = «Blah1» ;
$organizationalUnitName = «Blah2» ;
$commonName = «Joe Bloggs» ;
$emailAddress = «openssl@example.com» ;

$dn = array(
«countryName» => $countryName ,
«stateOrProvinceName» => $stateOrProvinceName ,
«localityName» => $localityName ,
«organizationName» => $organizationName ,
«organizationalUnitName» => $organizationalUnitName ,
«commonName» => $commonName ,
«emailAddress» => $emailAddress
);

// generate a bad csr
$badCsr = openssl_csr_new ( $dn , $badPriv );

// generate private key
$priv = openssl_pkey_new ();

// generate csr
$csr = openssl_csr_new ( $dn , $priv );

$badCsrDetails = openssl_pkey_get_details ( openssl_csr_get_public_key ( $badCsr ));
$privDetails = openssl_pkey_get_details ( $priv );
$csrDetails = openssl_pkey_get_details ( openssl_csr_get_public_key ( $csr ));

echo md5 ( $badCsrDetails [ ‘rsa’ ][ ‘n’ ]);
echo «\nDoes not match\n» ;
echo md5 ( $privDetails [ ‘rsa’ ][ ‘n’ ]);
echo «\nMatches\n» ;
echo md5 ( $csrDetails [ ‘rsa’ ][ ‘n’ ]);
echo «\n» ;
?>

This output is an md5 hash of the modulus. The same check can be accomplished with openssl:
openssl rsa -noout -modulus -in server.key | openssl md5
openssl req -noout -modulus -in server.csr | openssl md5

15 years ago

This note is primarily aimed at folks storing encrypted things in MySQL as I’m unfamiliar with other database setups. If you store, for example, a credit card number that has been encrypted by openssl_public_encrypt inside of a database, the column type for the column you are storing the number in must be a blob. This is because «the result might contain arbitrary byte values» (MySQL Reference Manual). Basically, if you try to store it in a VARCHAR, LONGTEXT, etc, certain parts of the encrypted data may be dropped, truncated, etc. This will of course make the data impossible to decrypt. Hopefully this will help someone, because it had me stumped for about an hour!

18 years ago

«You need to have a valid openssl.cnf installed for this function to operate correctly» includes most openssl functions. You can force php to find your openssl.cnf file as follows:

$config = array(‘config’=>’/path/to/openssl.cnf’);
$pkey = openssl_pkey_new($config);
$csr = openssl_csr_new(‘MyCSR’,$pkey,$config);

15 years ago

There is a little problem with Matt Alexander’s code below.
Both public and private key are generated internally and saved into OpenSSL class object properties but only private key is then used.
Public key is taken from an external file and if it differs from the one stored internally, OpenSSL fails to decrypt the text.

6 years ago

May be useful for cyphers execution speed.

const TEST_COUNT = 100000 ;
const SOURCE = ‘Note that HTML tags are not allowed in the posts, but the note formatting is preserved.’ ;
const KEY = «password» ;

function TESTER ( $testing_function , $argument )
$t = microtime ( true );

for ( $test_iterator = 0 ; $test_iterator < TEST_COUNT ; $test_iterator ++) $testing_function ( $argument );
>
return round ( microtime ( true ) — $t , 4 );
>

$crypt = function( $cipher ) $ivlen = openssl_cipher_iv_length ( $cipher );
$iv = openssl_random_pseudo_bytes ( $ivlen );
openssl_encrypt ( SOURCE , $cipher , KEY , $options = 0 , $iv );
>;

$methods = openssl_get_cipher_methods ( false );

array_splice ( $methods , 0 , count ( $methods ) / 2 );

foreach ( $methods as $cypher ) $time = TESTER ( $crypt , $cypher );
$timings [ $cypher ] = $time ;
echo str_pad ( $cypher , 40 , ‘ ‘ , STR_PAD_LEFT ), » have time » , str_pad ( $time , 8 , STR_PAD_LEFT ), ‘ seconds. ‘ , PHP_EOL ;
>

uasort ( $timings , function( $a , $b ) return $a $b ;
>);

$min_time = round ( reset ( $timings ) / TEST_COUNT , 7 );
$min_cypher = key ( $timings );

$max_time = round ( end ( $timings ) / TEST_COUNT , 7 );
$max_cypher = key ( $timings );

echo ‘————-‘ , PHP_EOL ;
echo «Total tests: » , count ( $timings ), PHP_EOL ;
echo «Max timing : < $max_time >seconds for ` < $max_cypher >` algorithm.» , PHP_EOL ;
echo «Min timing : < $min_time >seconds for ` < $min_cypher >` algorithm.» , PHP_EOL ;

echo ‘Details: ‘ , PHP_EOL ;

foreach ( $timings as $m => $t ) echo ‘- ‘ , str_pad ( $t , 8 , STR_PAD_LEFT ), » seconds for ` < $m >`» , PHP_EOL ;
>

16 years ago

For working of openssl in windows platform IIS webserver, we need to enable in php.ini, tne copy libeay32.dll and ssleay32.dll to the php folder (or windows’s system32 folder) and add both dll’s path to the window’s PATH variable. It seems to be working for me after I did these changes.

16 years ago

Windows users be warned that you need the following file in system32:

It has to go in system32, is not picked up from php/dlls

18 years ago

The openssl functions were disabled in Debian release 3.0 (woody), but as of release 3.1 (sarge) they’re available again.

18 years ago

Sorry, the code in my previous note doesn’t work. the last line should read:

2 years ago

Improvement to the first comment, this function will handle correctly cert chains when converting from PEM to DER format:

function pemToDer ( string $pem_data ): string
$der_data = » ;

$begin = «——BEGIN CERTIFICATE——» ;
$end = «——END CERTIFICATE——» ;
while ( strpos ( $pem_data , $begin ) !== false ) $pem_data = substr ( $pem_data , strpos ( $pem_data , $begin ) + strlen ( $begin ));
$der_data .= substr ( $pem_data , 0 , strpos ( $pem_data , $end ));
$pem_data = substr ( $pem_data , strpos ( $pem_data , $end ) + strlen ( $end ));
>

return base64_decode ( $der_data );
>

19 years ago

For newbies (as me):
If you want to try at home on win32, you can learn how to install apache+ssl on this url: http://tud.at/programm/apache-ssl-win32-howto.php3

Versions on English, Spanish and French.

Just I have read and install and run perfectly.

19 years ago

Debian maintainers have disabled the openssl support because it seems to help break apache on startup. (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=193343 and http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=165699)

13 years ago

for changing serial no of cert following is the solution:

$sscert = openssl_csr_sign ( $csr , $cacert , $privkey , $days , $config , $serial );
?>

16 years ago

There doesn’t seem to be a function here to test if a cert is valid (i.e. not corrupt). This bash snippet should help. Sorry it’s not PHP. slap it in a system(); call or make it a bash script and call it that way or something.

if [ «`openssl x509 -in /etc/certs/my.crt -noout -modulus`» = «`openssl rsa -in /etc/keys/my.key -noout -modulus`» ]; then echo «Match»; else echo «Different»; fi

16 years ago

There is a note below regarding the need to copy BOTH ssleay32.dll AND libeay32.dll to a folder in the system PATH on Win32 systems.

That is absolutely true. It should be noted also that Windows will search the Windows system directories before it will search the PATH. If you have existing .dlls in these directories — rename (rather than deleting in case you need to undo your changes) them and copy over the latest version of these files.

Key locations may include the /i386, /windows/system32, and ~/apache/. /modules directories.

I also updated my ~/subversion/bin directory.

17 years ago

The php4 distribution for Windows/IIS has a README-SSL.txt which strongly implies that just the path needs to be added to the OPENSLL_CONF variable in the server’s environment variables. Be sure to add the file name and extension too.

16 years ago

I generate certificates in such a way.

$config = array(«config» => «d:/sslcert/openssl.cnf»);
$dn = array(
«countryName» => «RU»,
«stateOrProvinceName» => «Russia»,
«localityName» => «Saint-Petersburg»,
«organizationName» => «temp»,
«organizationalUnitName» => «temp»,
«commonName» => «temp»,
«emailAddress» => «temp@temp.com»
);
$privkey_enc = openssl_pkey_new($config);
$csr = openssl_csr_new($dn, $privkey_enc, $config);
$sscert = openssl_csr_sign($csr, null, $privkey_enc, 365);
openssl_x509_export_to_file($sscert, «d:/cert_enc.crt»);
openssl_pkey_export_to_file($privkey_enc, «d:/privkey_enc.pem»);

As a result all the received certificates have identical serial number (00). But it should not be! How to avoid it?

16 years ago

Use this for simple public/private key encryption.

/**
* Point to your config file
*
*/
define ( «OPEN_SSL_CONF_PATH» , «/usr/share/ssl/openssl.cnf» );
/**
* Length of time certificate is valid (in days)
*
*/
define ( «OPEN_SSL_CERT_DAYS_VALID» , 365 );
/**
* Passphrase required with private key
*
*/
define ( «OPEN_SSL_PASSPHRASE» , «lkdfjbjeyrasdfvkajwdeblsolkdkdjfbvzslalsmdbfvksb» );
/**
* Enter description here.
*
*/
define ( «OPEN_SSL_PUBKEY_PATH» , «/docs/domains/mywebsite.com/docs/key.pem» ); // Public key path

/**
* A wrapper class for a simple subset of the PHP OpenSSL functions. Use for public key encryption jobs.
*
*
*
* // To configure
* // 1. Set OPEN_SSL_CONF_PATH to the path of your openssl.cnf file.
* // 2. Set OPEN_SSL_PASSPHRASE to any passphrase.
* // 3. Use the OpenSSL::do_csr method to generate your private and public keys (see next section).
* // 4. Save the private key somewhere offline and save your public key somewhere on this machine.
* // 5. Set OPEN_SSL_PUBKEY_PATH to the public key’s path.
*
* // To generate keys
* $ossl = new OpenSSL;
* $ossl->do_csr();
* $privatekey = $ossl->privatekey;
* $publickey = $ossl->publickey;
* unset($ossl);
*
* // Encrypt
* $text = «Secret text»;
* $ossl = new OpenSSL;
* $ossl->encrypt($text);
* $encrypted_text = $ossl->crypttext;
* $ekey = $ossl->ekey;
* unset($ossl);
*
* // Decrypt
* $ossl = new OpenSSL;
* $decrypted_text = $ossl->decrypt($encrypted_text, $privatekey, $ekey);
* unset($ossl);
*
* @author Matt Alexander (mattalexx@gmail.com) [based on code by Alex Poole (php@wwwcrm.com)]
* @copyright 2007
*
*/
class OpenSSL

public $privatekey ;
public $publickey ;
public $csr ;
public $crypttext ;
public $ekey ;

public function encrypt ( $plain )

// Turn public key into resource
$publickey = openssl_get_publickey ( is_file ( OPEN_SSL_PUBKEY_PATH )? file_get_contents ( OPEN_SSL_PUBKEY_PATH ) : OPEN_SSL_PUBKEY_PATH );

// Encrypt
openssl_seal ( $plain , $crypttext , $ekey , array( $publickey ));
openssl_free_key ( $publickey );

// Set values
$this -> crypttext = $crypttext ;
$this -> ekey = $ekey [ 0 ];
>

public function decrypt ( $crypt , $privatekey , $ekey = «» )

// Turn private key into resource
$privatekey = openssl_get_privatekey (( is_file ( $privatekey )? file_get_contents ( $privatekey ) : $privatekey ), OPEN_SSL_PASSPHRASE );

// Decrypt
openssl_open ( $crypt , $plaintext , $ekey , $privatekey );
openssl_free_key ( $privatekey );

// Return value
return $plaintext ;
>

public function do_csr (
$countryName = «UK» ,
$stateOrProvinceName = «London» ,
$localityName = «Blah» ,
$organizationName = «Blah1» ,
$organizationalUnitName = «Blah2» ,
$commonName = «Joe Bloggs» ,
$emailAddress = «openssl@domain.com»
) <
$dn = array(
«countryName» => $countryName ,
«stateOrProvinceName» => $stateOrProvinceName ,
«localityName» => $localityName ,
«organizationName» => $organizationName ,
«organizationalUnitName» => $organizationalUnitName ,
«commonName» => $commonName ,
«emailAddress» => $emailAddress
);
$config = array(
«config» => OPEN_SSL_CONF_PATH
);
$privkey = openssl_pkey_new ();
$csr = openssl_csr_new ( $dn , $privkey , $config );
$sscert = openssl_csr_sign ( $csr , null , $privkey , OPEN_SSL_CERT_DAYS_VALID , $config );
openssl_x509_export ( $sscert , $this -> publickey );
openssl_pkey_export ( $privkey , $this -> privatekey , OPEN_SSL_PASSPHRASE , $config );
openssl_csr_export ( $csr , $this -> csr );
>

Читать:
Как убрать пробелы при копировании из пдф

openssl_verify

Parameters

Return Values

Changelog

Examples

See Also

User Contributed Notes 8 notes

openssl_csr_get_subject

Parameters

Return Values

Changelog

Examples

See Also

User Contributed Notes 4 notes

openssl_x509_verify

Parameters

Return Values

Changelog

Examples

See Also

User Contributed Notes

OpenSSL Functions

Похожие записи