Skip to main content
Version: 3.0

CSR

Reading CSRs​

use phpseclib3\File\X509;

$x509 = new X509();
$csr = $x509->loadCSR(file_get_contents('csr.csr'));

var_dump($csr);
(download csr.csr)

Running the above will produce an array that looks something like this:

certificationRequestInfo
version
v1
subject
rdnSequence
0
0
type
id-at-organizationName
value
utf8String
phpseclib demo cert
subjectPKInfo
algorithm
algorithm
rsaEncryption
subjectPublicKey
-----BEGIN PUBLIC KEY-----
MIGdMAsGCSqGSIb3DQEBAQOBjQAwgYkCgYEApQBlwwoORvSZqUmpL5poADLWsRBx
55tLs3Yq8ZfbkSo8nHetbPnOukIP/Nlxn3n/MGOvsXQa9NLisLQ6UmyLyJXXVW8F
n6pCQIpnygjNbocgs6uj47UEXDwMwlfLKPZ80M7hmMphZZ4Ub/IBe0S5KN77YxYv
FKGKfMNXKZWx1/8CAwEAAQ==
-----END PUBLIC KEY-----
signatureAlgorithm
algorithm
sha1WithRSAEncryption
signature
...

getDNProp()​

print_r($x509->getDNProp('O'));

That will produce the following:

0
phpseclib demo cert

An array is returned because each distinguished name property can (in theory) have multiple values

Valid property names are enumerated upon at Distinguished Property Names.

getDN()​

print_r($x509->getDN());

getDN() accepts several different parameters:

  • X509::DN_ARRAY (the default value) returns an array who's keys are based on the ASN.1 syntax for X.509:

    rdnSequence
    0
    0
    type
    id-at-organizationName
    value
    utf8String
    phpseclib demo cert

  • X509::DN_STRING returns an OpenSSL-style string:

    O=phpseclib demo cert

  • X509::DN_OPENSSL returns an OpenSSL-style array:

    O
    phpseclib demo cert

  • X509::DN_ASN1 returns a DER encoded binary string

  • X509::DN_CANON returns a "canonicalized" DER encoded binary string wherein SEQUENCE around RDNs and all string values normalized as trimmed lowercase UTF-8 with all spacing as one blank. Constructed RDNs are not canonicalized.

getPublicKey()​

echo $x509->getPublicKey();

Returns a \phpseclib3\Crypt\Common\PublicKey object that, by default, gets cast to a PKCS8-encoded public key:

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQClAGXDCg5G9JmpSakvmmgAMtax
EHHnm0uzdirxl9uRKjycd61s+c66Qg/82XGfef8wY6+xdBr00uKwtDpSbIvIlddV
bwWfqkJAimfKCM1uhyCzq6PjtQRcPAzCV8so9nzQzuGYymFlnhRv8gF7RLko3vtj
Fi8UoYp8w1cplbHX/wIDAQAB
-----END PUBLIC KEY-----

Validating Signatures​

CSR's are always self-signed.

$x509 = new X509();
$csr = $x509->loadCSR(file_get_contents('csr.csr'));
echo $x509->validateSignature() ? 'valid' : 'invalid';

Creating CSRs: An Example​

use phpseclib3\File\X509;
use phpseclib3\Crypt\RSA;

$privKey = RSA::createKey();

$x509 = new X509();
$x509->setPrivateKey($privKey);
$x509->setDNProp('id-at-organizationName', 'phpseclib demo cert');

$csr = $x509->signCSR();

echo $x509->saveCSR($csr);

Domains can be added to a CSR by doing $x509->setDomain('www.domain.tld'). Note that whereas $x509->setDomain() can be used to add multiple domains for X.509 certificates only one domain can be added, with this approach, to CSRs. This is a limitation of phpseclib - not of the CSR format.

Multiple domains may be added by doing the following (using the phpBB MOD Text Template):

#
#-----[ FIND ]------------------------------------------
#
$csr = $x509->signCSR();
#
#-----[ BEFORE, ADD ]-----------------------------------
#
$x509->loadCSR($x509->saveCSR($x509->signCSR()));
$x509->setExtension('id-ce-subjectAltName', [
    ['dNSName' => 'www.domain.tld'],
    ['dNSName' => 'domain.tld']
]);