| Methods |
public
|
__construct(string $cert)
Create a new X509Cert object.
Create a new X509Cert object.
Parameters
| $cert |
An X.509 certificate (public key) in PEM format.
|
Throws
|
#
|
public
|
getPem(): String
Get the certificate (public key) in PEM format.
Get the certificate (public key) in PEM format.
Returns
The certificate (public key) in PEM format.
|
#
|
public
|
getFingerprint(string $algorithm = 'sha256'): string
Get the fingerprint of the certificate: the hash of its DER encoding.
Get the fingerprint of the certificate: the hash of its DER encoding.
Two certificates are the same certificate if, and only if, their
fingerprints are equal.
Parameters
| $algorithm |
The hash algorithm. Default: 'sha256'.
|
Returns
The fingerprint, as a lowercase hexadecimal string.
Throws
|
#
|
public
|
getIssuer(): array
Get the issuer information of the certificate.
Get the issuer information of the certificate.
Returns
The issuer information of the certificate.
|
#
|
public
|
getSubject(): array
Get the subject information of the certificate.
Get the subject information of the certificate.
Returns
The subject information of the certificate.
|
#
|
public
|
getDN(): string
Get the Distinguished Name of the certificate.
Get the Distinguished Name of the certificate.
Returns
The Distinguished Name of the certificate.
|
#
|
public
|
getValidFrom(string $dateFormat = 'ymdHise'): string|false
Get the UTC date from which the certificate is valid.
Get the UTC date from which the certificate is valid.
Parameters
| $dateFormat |
The format of the returned date.
Default: 'ymdHise'
|
Returns
The date from which the certificate is valid,
FALSE if $dateFormat is invalid.
|
#
|
public
|
getValidTo(string $dateFormat = 'ymdHise'): string|false
Get the UTC date to which the certificate is valid.
Get the UTC date to which the certificate is valid.
Parameters
| $dateFormat |
The format of the returned date.
Default: 'ymdHise'
|
Returns
The date to which the certificate is valid,
FALSE if $dateFormat is invalid.
|
#
|
public
|
isOutOfDate(): boolean
Indicates whether the certificate is out of date or not.
Indicates whether the certificate is out of date or not.
Returns
TRUE if embedded certificate is out of date,
FALSE otherwise.
|
#
|
public
|
canSign(): boolean
Indicates whether the key usage of the certificate allows it to sign
data.
Indicates whether the key usage of the certificate allows it to sign
data.
The "keyUsage" extension, when the certificate has one, must allow
"digitalSignature" or "nonRepudiation". A certificate without this
extension is not restricted.
Returns
TRUE if the certificate may sign data, FALSE otherwise.
|
#
|
public
|
isTrustedBy(string|array $caCertPaths): boolean
Check that the certificate is trusted: OpenSSL builds and verifies its
chain up to a certificate of the given CA files.
Check that the certificate is trusted: OpenSSL builds and verifies its
chain up to a certificate of the given CA files.
Every certificate of the given files is trusted, and the chain is built
from these certificates only. OpenSSL verifies the signature of each
link, the validity dates of every certificate of the chain at the
current date, that each issuer is a CA (basic constraints, key usage,
path length) and that the chain ends at a self-signed certificate of
the given files. A chain that stops at an intermediate CA is rejected:
to trust the certificates issued by an intermediate CA, give its
certificate and the certificates up to its root (in one file or in
several). A certificate issued by another intermediate CA of the same
root is then rejected, since the chain cannot be built without that
other intermediate certificate.
Parameters
| $caCertPaths |
The path, or the list of paths, of PEM
files that hold the trusted CA certificates.
|
Returns
TRUE if the chain of the certificate has been verified,
FALSE otherwise.
Throws
|
#
|
public
|
isValidCA(string $caCert): boolean
Check the origin of the certificate.
Check the origin of the certificate.
Verify that the X.509 certificate has been issued by the given CA
certificate: OpenSSL verifies the signature of the certificate with the
public key of the CA certificate, the issuer name of the certificate
must be the subject name of the CA certificate, and the CA certificate
must be a CA ("CA:TRUE" basic constraint and, if it has a "keyUsage"
extension, "keyCertSign").
Only this link is checked: neither the validity dates nor the chain of
the CA certificate. Use isTrustedBy() to verify the whole chain.
NOTE: More than one CA certificate can give a positive result,
some CAs re-issue signing certificates after having only
changed the expiration dates.
Note that it also works with self-signed CA certificates. In this
case, pass the X.509 certificate itself to the function.
Parameters
| $caCert |
The certificate (in PEM format) corresponding to
the private key that is supposed to be used by the CA to sign the X.509
certificate.
|
Returns
TRUE if origin of the X.509 certificate has been
validated, FALSE otherwise.
Throws
|
#
|
public
static
|
pemToDer(string $pemCertificate): string|false
Convert PEM encoded X.509 certificate to DER encoding.
Convert PEM encoded X.509 certificate to DER encoding.
Parameters
| $pemCertificate |
PEM encoded X.509 certificate.
|
Returns
DER encoded X.509 certificate on success,
FALSE on failure.
|
#
|
public
static
|
derToPem(string $derCertificate): string|false
Convert DER encoded X.509 certificate to PEM encoding.
Convert DER encoded X.509 certificate to PEM encoding.
Parameters
| $derCertificate |
DER encoded X.509 certificate.
|
Returns
PEM encoded X.509 certificate on success,
FALSE on failure.
|
#
|