Re: SPKAC support for openssl in PHP

Moving forwards a lot of authentication will be done in an HTTP friendly stateless manner, namely via HTTPS where the user is identified by client side ssl certificates. In order to give the user a certificate, you need to generate one, which you can currently do with openssl in php, and provide the user with a pkcs12 certificate+private key to install. However, pkcs12 has a security flaw in the the application giving the certificates also has the private key. SPKAC addresses this because the private key never leaves the users browser, thus it is the preferred option - and as mentioned there will be an ever increasing need for this in PHP once HTML5 takes off (due to the KEYGEN element which is widely supported already) and FOAF+SSL which as I mentioned will be going through standardisation in the near future. Best, Nathan Sriram Natarajan wrote:

I am curious as to why you need this feature within PHP. I would expect that web server administrators typically need such feature but I am missing the context of it within PHP script engine. - Sriram On Tue, May 18, 2010 at 2:05 AM, Nathan Rixham <nrixham@gmail.com> wrote:

Hi All, Wondering if there is any support for SPKAC [1] in the openssl extension for PHP? If not is it planned, and if not can it be? KEYGEN/SPKAC support is growing in the UA vendors and KEYGEN is part of HTML5, being the preferred way to generate client side SSL certificates since the private key never leaves the browser. Further the need for client side certificate generation will be growing somewhat over the next couple of years thanks to FOAF+SSL - which I believe is about to start going through standardisation. At the minute we have to take a rather hacky approach in PHP [2] and it get's much worse if you want to use x509 v3 extensions, you have to go through a nasty process of using a bash script to gen a custom openssl.conf on the fly to use in the SPKAC request. Best, Nathan [1] http://en.wikipedia.org/wiki/Spkac [2] http://lists.whatwg.org/pipermail/whatwg-whatwg.org/attachments/20080714/07ea5534/attachment.txt -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php