note 85444 added to book.openssl

For checking the status of a client certificate using OCSP, you can use this script: <?php // User variables: $dir = '/path/to/temp/'; // Directory where apache has access to (chmod 777). $RootCA = '/path/to/Root.cer'; // Points to the Root CA in PEM format. $OCSPUrl = 'http://ocsp.url'; //Points to the OCSP URL // Script: $a = rand(1000,99999); // Needed if you expect more page clicks in one second! file_put_contents($dir.$a.'cert_i.pem', $_SERVER['SSL_CLIENT_CERT_CHAIN_0']); // Issuer certificate. file_put_contents($dir.$a.'cert_c.pem', $_SERVER['SSL_CLIENT_CERT']); // Client (authentication) certificate. $output = shell_exec('openssl ocsp -CAfile '.$RootCA.' -issuer '.$dir.$a.'cert_i.pem -cert '.$dir.$a.'cert_c.pem -url '.$OCSPUrl); $output2 = preg_split('/[\r\n]/', $output); $output3 = preg_split('/: /', $output2[0]); $ocsp = $output3[1]; echo "OCSP status: ".$ocsp; // will be "good", "revoked", or "unknown" unlink($dir.$a.'cert_i.pem'); unlink($dir.$a.'cert_c.pem'); ?> It can be ameliorated, but it's just a beginning! Normally, you can extract the ocsp url from the client certificate. Also, an OCSP request contains only the hash of the issuer name, the hash of the issuer's key, and the serial number of the client certificate. All three can be extracted directly from the client certificate. ---- Server IP: 195.207.10.20 Probable Submitter: 88.197.178.228 ---- Manual Page -- http://www.php.net/manual/en/book.openssl.php Edit -- https://master.php.net/note/edit/85444 Del: integrated -- https://master.php.net/note/delete/85444/integrated Del: useless -- https://master.php.net/note/delete/85444/useless Del: bad code -- https://master.php.net/note/delete/85444/bad+code Del: spam -- https://master.php.net/note/delete/85444/spam Del: non-english -- https://master.php.net/note/delete/85444/non-english Del: in docs -- https://master.php.net/note/delete/85444/in+docs Del: other reasons-- https://master.php.net/note/delete/85444 Reject -- https://master.php.net/note/reject/85444 Search -- https://master.php.net/manage/user-notes.php