|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2007-10-08 10:52 UTC] tokul at users dot sourceforge dot net
Description:
------------
According to last chapter in openssl_x509_checkpurpose() manual function should return true, false or int(-1). Synopsis line shows that function returns integer.
If I check public certificate file with OpenSSL binary (openssl x509 -purpose -in certfile.pem), it shows purposes as
----
SSL client : Yes
SSL client CA : No
SSL server : Yes
SSL server CA : No
Netscape SSL server : Yes
Netscape SSL server CA : No
S/MIME signing : Yes
S/MIME signing CA : No
S/MIME encryption : Yes
S/MIME encryption CA : No
CRL signing : Yes
CRL signing CA : No
Any Purpose : Yes
Any Purpose CA : Yes
OCSP helper : Yes
OCSP helper CA : No
----
If I check it with PHP
----
var_dump(openssl_x509_checkpurpose(file_get_contents('./certfile.pem'),X509_PURPOSE_SMIME_SIGN));
---
it returns int(0). Int(0) is evaluated as boolean false in PHP.
Tested PHP 5.2.0 and PHP 5.2-dev (200710080830). OpenSSL 0.9.8c (Debian 0.9.8c-4 package). Used Thawte free email certificate for testing. Certificate is valid from 2007.02.24 till 2008.02.24. System clock is correct.
Reproduce code:
---------------
var_dump(openssl_x509_checkpurpose(file_get_contents('./certfile.pem'),X509_PURPOSE_SMIME_SIGN));
Expected result:
----------------
bool(true) or int(1)
Actual result:
--------------
int(0)
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sun Nov 23 05:00:01 2025 UTC |
The problem is not resolved in PHP 5.2.6, provided you call it correctly. openssl_x509_checkpurpose expects to be able to build a full chain of certificates to verify its purpose. Furthermore, it expects there to be a trusted certificate as part of the chain. When invoked as var_dump(openssl_x509_checkpurpose(file_get_contents('./certfile.pem'). X509_PURPOSE_SMIME_SIGN)); this fails, because a chain cannot properly be built to a trusted root. My test case involved: - Obtaining Using the Thawte intermediate and root certificates, obtained via http://www.thawte.com/repository/index.html - Copying the contents of the Thawte Personal Freemail Issuing CA and Thawte Personal Freemail CA PEM files from that list into a new file, called 'chain.pem'. The certs were simply appended one after the other - Setting the system time to be during the validity period of the certificate (2007-10-10 00:00:00 GMT) - executing as var_dump(openssl_x509_checkpurpose(file_get_contents('./certfile.pem'). X509_PURPOSE_SMIME_SIGN, array('./chain.pem')); - I received int(1) as the result I do not believe the reporter's initial case should be supported. Purpose checking requires checking each of the CAs that issued the certificate to make sure there are no purpose constraints. The absence of the CA certificates makes this impossible, hence the failure. If one wishes to obtain any X509 certificate extensions for a single certificate, openssl_x509_parse is able to provide this information. However, it should not be treated as authoritative, as it does not reflect the full chain policy being enforced for that certificate. My OpenSSL version was 0.9.8f, running Linux kernel 2.6.14.6 and PHP 5.2.6. While these versions do differ from the original submission, with the above explanation, it should provide enough information to see if this does resolve the situation with purpose verification.