PHPのお勉強！

PHP TOP
PHP 8.4.2 Released!

    OpenSSL

    Found A Problem?

    Learn How To Improve This Page • Submit a Pull Request • Report a Bug
    ＋add a note

    User Contributed Notes 2 notes

    up
    65
    bdh dot hall at gmail dot com
    15 years ago
    I was having a heck of a time finding help on making asynchronous encryption/decryption using private key/public key systems working, and I had to have it for creating a credit card module that uses recurring billing.

    You'd be a fool to use normal, 'synchronous' or two-way encryption for this, so the whole mcrypt library won't help.

    But, it turns out OpenSSL is extremely easy to use...yet it is so sparsely documented that it seems it would be incredibly hard.

    So I share my day of hacking with you - I hope you find it helpful!

    <?php

    if (isset($_SERVER['HTTPS']) )
    {
    echo     "SECURE: This page is being accessed through a secure connection.<br><br>";
    }
    else
    {
    echo     "UNSECURE: This page is being access through an unsecure connection.<br><br>";
    }

    // Create the keypair
    $res=openssl_pkey_new();

    // Get private key
    openssl_pkey_export($res, $privatekey);

    // Get public key
    $publickey=openssl_pkey_get_details($res);
    $publickey=$publickey["key"];

    echo     "Private Key:<BR>$privatekey<br><br>Public Key:<BR>$publickey<BR><BR>";

    $cleartext = '1234 5678 9012 3456';

    echo     "Clear text:<br>$cleartext<BR><BR>";

    openssl_public_encrypt($cleartext, $crypttext, $publickey);

    echo     "Crypt text:<br>$crypttext<BR><BR>";

    openssl_private_decrypt($crypttext, $decrypted, $privatekey);

    echo     "Decrypted text:<BR>$decrypted<br><br>";
    ?>

    Many thanks to other contributors in the docs for making this less painful.

    Note that you will want to use these sorts of functions to generate a key ONCE - save your privatekey offline for decryption, and put your public key in your scripts/configuration file. If your data is compromised you don't care about the encrypted stuff or the public key, it's only the private key and cleartext that really matter.

    Good luck!
    up
    -4
    koen dot thomeer at pubmed dot be
    16 years ago
    For checking the status of a client certificate using OCSP, you can use this script:

    <?php
    // User variables:
    $dir = '/path/to/temp/'; // Directory where apache has access to (chmod 777).
    $RootCA = '/path/to/Root.cer'; // Points to the Root CA in PEM format.
    $OCSPUrl = 'http://ocsp.url'; //Points to the OCSP URL
    // Script:
    $a = rand(1000,99999); // Needed if you expect more page clicks in one second!
    file_put_contents($dir.$a.'cert_i.pem', $_SERVER['SSL_CLIENT_CERT_CHAIN_0']); // Issuer certificate.
    file_put_contents($dir.$a.'cert_c.pem', $_SERVER['SSL_CLIENT_CERT']); // Client (authentication) certificate.
    $output = shell_exec('openssl ocsp -CAfile '.$RootCA.' -issuer '.$dir.$a.'cert_i.pem -cert '.$dir.$a.'cert_c.pem -url '.$OCSPUrl);
    $output2 = preg_split('/[\r\n]/', $output);
    $output3 = preg_split('/: /', $output2[0]);
    $ocsp = $output3[1];
    echo     "OCSP status: ".$ocsp; // will be "good", "revoked", or "unknown"
    unlink($dir.$a.'cert_i.pem');
    unlink($dir.$a.'cert_c.pem');
    ?>

    It can be ameliorated, but it's just a beginning!

    Normally, you can extract the ocsp url from the client certificate. Also, an OCSP request contains only the hash of the issuer name, the hash of the issuer's key, and the serial number of the client certificate. All three can be extracted directly from the client certificate.
    ＋add a note
    To Top