PKI Framework¶
PKI Framework reads, writes and validates the structures a public key infrastructure is made of: X.509 certificates, attribute certificates, certification requests, the ASN.1 types underneath them, and the textual encodings they travel in. It is a library of data structures and a validator, in pure PHP.
use SpomkyLabs\Pki\CryptoEncoding\PEM;
use SpomkyLabs\Pki\X509\Certificate\Certificate;
$certificate = Certificate::fromPEM(PEM::fromFile('server.crt'));
echo $certificate->tbsCertificate()->subject()->toString(); // cn=example.com
echo $certificate->tbsCertificate()->validity()->notAfter()->dateTime()->format('c');
What it covers¶
| Specification | What the library does with it |
|---|---|
| X.690 | ASN.1 DER encoding and decoding, every universal type, tagged types, indefinite length |
| RFC 5280 | X.509 certificates, their extensions, and certification path validation |
| RFC 5755 | Attribute certificates and their validation |
| RFC 2986 | PKCS #10 certification requests |
| RFC 5208, RFC 5958 | PKCS #8 private keys, one asymmetric key |
| RFC 7468 | PEM, the textual encoding of all of the above |
| X.501, X.520 | Distinguished names, attribute types, name comparison and string preparation |
| RFC 8410 | Ed25519, Ed448, X25519 and X448 keys |
Where to start¶
- Reading material you were handed — Reading a certificate, then Textual encoding (PEM).
- Checking that a chain leads somewhere you trust — Validating a path. Read What validation does not do before you rely on it.
- Issuing certificates — Issuing a certificate, and Issuing from a request when the subject sent a CSR.
- Working one level down, on the ASN.1 itself — ASN.1 and DER.
Two things to know before you build on it¶
The library never opens a network connection. Nothing is fetched from an authority information access extension, a CRL distribution point or an OCSP responder, and no system trust store is read. Everything the library trusts, the trust anchors included, is handed to it by your application. Path validation therefore says nothing about revocation; see What validation does not do.
Everything a certification request contains was chosen by whoever submitted it. TBSCertificate::fromCSR()
does not verify its signature and never copies the extensions that decide what a certificate may do. Name
the ones you are willing to honour; see Issuing from a request.
Credit¶
The framework started as a fork of the libraries published at github.com/sop by Joni Eskelinen. It has diverged substantially since — the code has been reworked, extended and maintained to meet the Spomky-Labs requirements — and the two are no longer interchangeable. All credit for the original work goes to its developer. Migrating from the sop libraries describes what changed.