Bug #77416 [Opn]: openssl_csr_new add fields to subject
Edit report at https://bugs.php.net/bug.php?id=77416&edit=1
ID: 77416
User updated by: joose dot vettenranta at kompassi dot fi
Reported by: joose dot vettenranta at kompassi dot fi
Summary: openssl_csr_new add fields to subject
Status: Open
Type: Bug
Package: OpenSSL related
Operating System: Linux
PHP Version: 7.2.13
Block user comment: N
Private report: N
New Comment:
If I create own openssl.cnf file containing:
distinguished_name = req_distinguished_name
[req_distinguished_name]
[v3_req]
[v3_ca]
it will work as expected
Previous Comments:
------------------------------------------------------------------------
[2019-01-06 21:12:44] joose dot vettenranta at kompassi dot fi
I need different kind of subjects when I am creating certificates for systems other than SSL. That
is why to subject is completely different what is normally (SSL) used.
------------------------------------------------------------------------
[2019-01-06 21:09:37] joose dot vettenranta at kompassi dot fi
I have not checked. But I have tried this with different distros, different php -versions and with
different operating systems (macos and linux). Also have tried docker images. And as I notided in
the test script, doing the same thing on the same computer using command line openssl command, it
will work as expected.
------------------------------------------------------------------------
[2019-01-06 19:27:25] requinix@php.net
How does your openssl.cnf look?
------------------------------------------------------------------------
[2019-01-06 19:22:45] joose dot vettenranta at kompassi dot fi
Description:
------------
When creating new CSR, it will add "ST=Some-State, O=Internet Widgits Pty Ltd" to the
subject if not defined in openssl_csr_new -function call. This has been a bug in PHP for a long
time.
Test script:
---------------
<?php
$config=array(
"private_key_bits" => 2048,
"private_key_type" => OPENSSL_KEYTYPE_RSA,
);
$privkey = openssl_pkey_new($config);
$csr = openssl_csr_new(array("C"=>"FI"), $privkey);
openssl_csr_export($csr, $csrout);
echo($csrout);
/* using same system, but command line openssl command to generate csr works just fine. I have been
using this code to do csr:
$csr = shell_exec('openssl req -new -sha256 -key '.$tempDir.'/private.key -outform
'.$format.' -subj "'.$subject.'"');
*/
?>
$ php test.php > /tmp/foo3
$ openssl req -in /tmp/foo3 -noout -text
Expected result:
----------------
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=FI
Actual result:
--------------
Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=FI, ST=Some-State, O=Internet Widgits Pty Ltd
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=77416&edit=1
Thread (7 messages)