pki/save_cert.php at main · creatica-soft/pki · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
<?php
require_once 'config.php';
require_once 'helper_functions.php';
require_once 'sql.php';
require_once 'certificate.php';

if ($argc < 2) {
  print "save_cert.php will save a certificate issued by the Signing CA into a database\n";
  print "Usage: php8 save_cert.php <certfile.der>\n";
  exit(1);
}

if (! file_exists($argv[1])) {
  print "File " . $argv[1] . " does not exist\n";
  exit(1);
}
$ca = new Certificate($signing_ca_der_path);
$cn = $ca->tbsCertificate->subject->getCN();
$der = file_get_contents($argv[1]);
$cert = new Certificate($argv[1]);
//verify our signature
while(openssl_error_string());
$encoded = $cert->tbsCertificate->encode();
$res = openssl_verify($encoded, hex2bin($cert->signature), openssl_x509_read('file://' . $signing_ca_path), oid2str($cert->signatureAlg->algorithm));
switch($res) {
  case 0: //invalid
    print "Invalid certificate signature, serialNumber " . $cert->tbsCertificate->serialNumber . ", subject " . $cert->tbsCertificate->subject . "\n";
    exit(1);
  break;
  case 1: //valid, need to verify the validity dates and revocation status
    $serial = $cert->tbsCertificate->serialNumber;
    $notBefore = $cert->tbsCertificate->validity->notBefore2timestamp();
    $notAfter = $cert->tbsCertificate->validity->notAfter2timestamp();
    $issuer = $cert->tbsCertificate->issuer->getCN();
    if ($issuer != $cn) {
      print "Certificate not issued by $cn\n";
      exit(1);
    }
    $owner = $cert->tbsCertificate->subject->getOwner();
    if (! $owner) $owner = '';
    $role = $cert->tbsCertificate->subject->getRole();
    if (! $role) $role = '';
    $ts = $now->getTimestamp();
    if ($notBefore <= $ts && $notAfter > $ts)
      $status = 0; //valid
    else $status = 1; //expired
  break;
  case -1: //error
    $error = "Certificate::verify() openssl verify error: ";
    while($err = openssl_error_string()) $error .= $err;
    print $error;
    exit(1);
}
$res = sqlSaveCert($serial, $status, $cert->tbsCertificate->subject, $notBefore, $notAfter, $owner, $role, $der);

if ($res)
  print "Certificate with sn $serial and subject " . $cert->tbsCertificate->subject . " saved in $sql_db\n";
else {
  print "Certificate with sn $serial and subject " . $cert->tbsCertificate->subject . " already exists in $sql_db\n";
  exit(1);
}