VALIDATE_SIGNATURE_BY_CA
VALIDATE_SIGNATURE_BY_CA
Flag to only accept signatures signed by certificate authorities
Not really used anymore but retained all the same to suppress E_NOTICEs from old installs
Pure-PHP X.509 Parser
$currentKeyIdentifier : string
Key Identifier
See RFC5280#section-4.2.1.1 and RFC5280#section-4.2.1.2.
__construct() : \phpseclib\File\X509
Default Constructor.
validateURL(string $url) : boolean
Validate an X.509 certificate against a URL
From RFC2818 "HTTP over TLS":
Matching is performed using the matching rules specified by [RFC2459]. If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character which is considered to match any single domain name component or component fragment. E.g., .a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.
| string | $url |
_testForIntermediate(boolean $caonly, integer $count) : boolean
Validates an intermediate cert as identified via authority info access extension
See https://tools.ietf.org/html/rfc4325 for more info
| boolean | $caonly | |
| integer | $count |
validateSignature(boolean $caonly = true) : mixed
Validate a signature
Works on X.509 certs, CSR's and CRL's. Returns true if the signature is verified, false if it is not correct or null on error
By default returns false for self-signed certs. Call validateSignature(false) to make this support self-signed.
The behavior of this function is inspired by openssl_verify.
| boolean | $caonly | optional |
_validateSignature(string $publicKeyAlgorithm, string $publicKey, string $signatureAlgorithm, string $signature, string $signatureSubject) : integer
Validates a signature
Returns true if the signature is verified, false if it is not correct or null on error
| string | $publicKeyAlgorithm | |
| string | $publicKey | |
| string | $signatureAlgorithm | |
| string | $signature | |
| string | $signatureSubject |
setRecurLimit(integer $count)
Sets the recursion limit
When validating a signature it may be necessary to download intermediate certs from URI's. An intermediate cert that linked to itself would result in an infinite loop so to prevent that we set a recursion limit. A negative number means that there is no recursion limit.
| integer | $count |
loadSPKAC( $spkac) : mixed
Load a SPKAC CSR
SPKAC's are produced by the HTML5 keygen element:
https://developer.mozilla.org/en-US/docs/HTML/Element/keygen
| $spkac |
_timeField(string $date) : array
Helper function to build a time field according to RFC 3280 section - 4.1.2.5 Validity - 5.1.2.4 This Update - 5.1.2.5 Next Update - 5.1.2.6 Revoked Certificates by choosing utcTime iff year of date given is before 2050 and generalTime else.
| string | $date | in format date('D, d M Y H:i:s O') |
sign(\phpseclib\File\X509 $issuer, \phpseclib\File\X509 $subject, string $signatureAlgorithm = 'sha1WithRSAEncryption') : mixed
Sign an X.509 certificate
$issuer's private key needs to be loaded. $subject can be either an existing X.509 cert (if you want to resign it), a CSR or something with the DN and public key explicitly set.
| \phpseclib\File\X509 | $issuer | |
| \phpseclib\File\X509 | $subject | |
| string | $signatureAlgorithm | optional |
signCRL(\phpseclib\File\X509 $issuer, \phpseclib\File\X509 $crl, string $signatureAlgorithm = 'sha1WithRSAEncryption') : mixed
Sign a CRL
$issuer's private key needs to be loaded.
| \phpseclib\File\X509 | $issuer | |
| \phpseclib\File\X509 | $crl | |
| string | $signatureAlgorithm | optional |
_isSubArrayValid(array $root, string $path) : boolean
Check for validity of subarray
This is intended for use in conjunction with _subArrayUnchecked(), implementing the checks included in _subArray() but without copying a potentially large array by passing its reference by-value to is_array().
| array | $root | |
| string | $path |
_subArrayUnchecked(array $root, string $path, boolean $create = false) : array|false
Get a reference to a subarray
This variant of _subArray() does no is_array() checking, so $root should be checked with _isSubArrayValid() first.
This is here for performance reasons: Passing a reference (i.e. $root) by-value (i.e. to is_array()) creates a copy. If $root is an especially large array, this is expensive.
| array | $root | |
| string | $path | absolute path with / as component separator |
| boolean | $create | optional |
computeKeyIdentifier(mixed $key = null, integer $method = 1) : string
Compute a public key identifier.
Although key identifiers may be set to any unique value, this function computes key identifiers from public key according to the two recommended methods (4.2.1.2 RFC 3280). Highly polymorphic: try to accept all possible forms of key:
| mixed | $key | optional |
| integer | $method | optional |
binary key identifier
setRevokedCertificateExtension(string $serial, string $id, mixed $value, boolean $critical = false, boolean $replace = true) : boolean
Set a Revoked Certificate Extension
| string | $serial | |
| string | $id | |
| mixed | $value | |
| boolean | $critical | optional |
| boolean | $replace | optional |
getOID( $name) : string
Returns the OID corresponding to a name
What's returned in the associative array returned by loadX509() (or load*()) is either a name or an OID if no OID to name mapping is available. The problem with this is that what may be an unmapped OID in one version of phpseclib may not be unmapped in the next version, so apps that are looking at this OID may not be able to work from version to version.
This method will return the OID if a name is passed to it and if no mapping is avialable it'll assume that what's being passed to it already is an OID and return that instead. A few examples.
getOID('2.16.840.1.101.3.4.2.1') == '2.16.840.1.101.3.4.2.1' getOID('id-sha256') == '2.16.840.1.101.3.4.2.1' getOID('zzz') == 'zzz'
| $name |