Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to define a particular purpose of an X509 certificate in PHP

How can I set the purpose of an X.509 certificate to X509_PURPOSE_ANY in PHP 5.x?

The following code outputs this warning:

Warning: openssl_csr_new() [function.openssl-csr-new.php]: dn: X509_PURPOSE is not a recognized name in /home/www/index.php on line 45

PHP Script:

$Configs = array(       
        'config' => 'test.cnf',
        'digest_alg' => 'sha1',
        'x509_extensions' => 'v3_ca',
        'req_extensions' => 'v3_req',
        'private_key_bits' => 2048,
        'private_key_type' => OPENSSL_KEYTYPE_RSA,
        'encrypt_key' => true,
        'encrypt_key_cipher' => OPENSSL_CIPHER_3DES);

$ExtraAttribs = array('X509_PURPOSE' => 'X509_PURPOSE_ANY');

//create cert
$dn      = array('commonName' => 'Chief');
$privkey = openssl_pkey_new($Configs);
$csr     = openssl_csr_new($dn, $privkey, $Configs, $ExtraAttribs);

The last line is line 45.

like image 873
Mike Avatar asked Mar 07 '12 01:03

Mike


People also ask

What does x509 command do?

The x509 command is a multi purpose certificate utility. It can be used to display certificate information, convert certificates to various forms, sign certificate requests like a "mini CA" or edit certificate trust settings. Since there are a large number of options they will split up into various sections.

Does x509 certificate contains private key?

An X. 509 certificate consists of two keys, namely a public key and a private key. This key pair, depending upon the application, allows you to sign documents using the private key so that the intended person can verify the signature using the public key related to it.

Where are x509 certificates stored?

As previously mentioned, each must be signed by an issuer CA as part of the X. 509 verification process. The CA is named and stored in the root of the certificate. Additional intermediate certificates can be included in the trust chain and must be validated.


1 Answers

I cannot find any indication that X509 certificates have a "purpose". I can find only "Basic Constraints", "Key Usage" and "Enhanced Key Usage".

The closest thing I could find is http://www.openssl.org/docs/apps/verify.html which says

For compatibility with previous versions of SSLeay and OpenSSL a certificate with no trust settings is considered to be valid for all purposes.

like image 105
Martin Avatar answered Oct 09 '22 19:10

Martin