Last active
February 28, 2020 12:29
-
-
Save vreemt/7070fced19b0eddbce75edfc5cbf958e to your computer and use it in GitHub Desktop.
Generating SSL certificates with SANs in PHP with OpenSSL - see also https://gist.github.com/vreemt/d79a7ad0b5cb53242237b2c760eda8c7
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
//src on: https://gist.github.com/dol/e0b7f084e2e7158efc87 | |
// see also https://gist.github.com/Soarez/9688998 | |
// __DIR__ . '/tests/Helpers/openssl.cnf' | |
/* | |
[ req ] | |
distinguished_name = req_distinguished_name | |
req_extensions = v3_req | |
x509_extensions = v3_ca | |
[ req_distinguished_name ] | |
[ v3_req ] | |
basicConstraints = CA:FALSE | |
keyUsage = nonRepudiation, digitalSignature, keyEncipherment | |
subjectAltName = ${ENV::PHP_PASS_SUBJECTALTNAME} | |
[ v3_ca ] | |
subjectAltName = ${ENV::PHP_PASS_SUBJECTALTNAME} | |
*/ | |
$keyConfig = [ | |
'private_key_type' => OPENSSL_KEYTYPE_RSA, | |
'private_key_bits' => 2048, | |
]; | |
$key = openssl_pkey_new($keyConfig); | |
$sanDomains = [ | |
'test999.io', | |
'second.com', | |
'superthird.net' | |
]; | |
$dn = [ | |
'commonName' => reset($sanDomains), | |
]; | |
$csrConfig = [ | |
'config' => __DIR__ . '/tests/Helpers/openssl.cnf', | |
'req_extensions' => 'v3_req', | |
'x509_extensions' => 'v3_ca', | |
'digest_alg' => 'sha256', | |
]; | |
$addPrefix = function ($value) { | |
return 'DNS:' . $value; | |
}; | |
$sanDomainPrefixed = array_map($addPrefix, $sanDomains); | |
putenv('PHP_PASS_SUBJECTALTNAME=' . implode(',', $sanDomainPrefixed)); | |
$csr = openssl_csr_new($dn, $key, $csrConfig); | |
if (false === $csr) { | |
while (($e = openssl_error_string()) !== false) { | |
echo $e . '\n'; | |
} | |
return; | |
} | |
openssl_csr_export($csr, $csrout); | |
//openssl_x509_export(openssl_csr_sign($csr, null, $key, 30), $csrout); | |
echo "===== KEY v1 =======\r\n"; | |
echo $key; | |
echo "===== KEY exported =======\r\n"; | |
openssl_pkey_export($key, $expkey); | |
echo $expkey; | |
echo "===== EXPORT v1 =======\r\n"; | |
echo $csrout; | |
openssl_x509_export(openssl_csr_sign($csr, null, $key, 30, $csrConfig), $csrout); | |
echo "===== EXPORT x509 =======\r\n"; | |
echo $csrout; | |
echo "===== PARSED =======\r\n"; | |
$out = openssl_x509_parse($csrout); | |
var_dump($out); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
change 30 to a higher number to generate a certificate valid for more than 30 days