openssl_pkcs12_read

(PHP 5 >= 5.2.2, PHP 7, PHP 8)

openssl_pkcs12_read — Analisa um armazenamento de certificados PKCS#12 em um array

Descrição

openssl_pkcs12_read(string $pkcs12, array &$certificates, #[\SensitiveParameter] string $passphrase): bool

openssl_pkcs12_read() analisa o armazenamento de certificado PKCS#12 informado em pkcs12 e insere o resultado em um array nomeado por certificates.

Parâmetros

pkcs12: O conteúdo do armazenamento de certificado, e não o nome de um arquivo.
certificates: Em caso de sucesso, esta variável conterá o array com os dados do armazenamento de certificado.
passphrase: Senha de criptografia para desbloquear o certificado PKCS#12.

Valor Retornado

Retorna true em caso de sucesso ou false em caso de falha.

Exemplos

Exemplo #1 Exemplo de openssl_pkcs12_read()

<?php
if (!$cert_store = file_get_contents("/certs/file.p12")) {
    echo "Erro: não é possível ler o arquivo do certificado\n";
    exit;
}

if (openssl_pkcs12_read($cert_store, $cert_info, "minha_senha_secreta")) {
    echo "Informação do certificado\n";
    print_r($cert_info);
} else {
    echo "Erro: não é possível ler o armazenamento de certificados.\n";
    exit;
}
?>

Melhore Esta Página

Aprenda Como Melhorar Esta Página • Envie uma Solicitação de Modificação • Reporte um Problema

＋adicione uma nota

Notas Enviadas por Usuários (em inglês) 8 notes

down

fran at fran dot cr ¶

1 year ago

Since OpenSSL 3, this function will fail with .p12 files that use legacy ciphers. Unfortunately, .p12 files generated today from a lot of Windows based CAs are using them by default.

OpenSSL 3 uses a provider mechanism where there is a legacy provider that supports these legacy ciphers, but it is disabled by default.

While PHP SSL module lacks a mechanism to enable the legacy provider, you need to modify the openssl.conf used by PHP by hand, it is usually the same used by the system openssl command, so the OPENSSLDIR path value returned by the "openssl version -d" command contains the openssl.conf file to modify. The llines that need to be added, modified or uncommented are the following to look like this:

openssl_conf = openssl_init

[openss_init]
providers = provider_sect

[provider_sect]
default = default_sect
legacy = legacy_sect

[default_sect]
activate = 1

[legacy_sect]
activate = 1

This may require restarting the involved php service (php-fpm usually) to load the OpenSSL configuration changes.

down

at jornane.no ¶

1 year ago

In response to Rovinson (https://www.php.net/manual/en/function.openssl-pkcs12-read.php#128854):

> In PHP versions 8.2.6 and 8.2.7, OpenSSL 1.1.1 is still utilized.
> However, starting from PHP version 8.2.8 onwards, OpenSSL 3.0.9 is employed.

This is not correct; Debian 12 currently uses PHP 8.2.7, yet it does use OpenSSL 3.0.11. So for a version check, I would rather target PHP 8.2+.

down

rrequalwt ¶

1 year ago

Instead of enabling legacy providers for your private key container to work with openssl3 one can simply repack the container using recent openssl

openssl pkcs12 -legacy -in key.p12 -nodes -out key_decrypted.tmp

openssl pkcs12 -in key_decrypted.tmp -export -out key_new.p12

down

Anonymous ¶

1 year ago

The openssl_pkcs12_read method does not work in PHP 8.2 due to the change in the OpenSSL library from version ^1 to ^3.

down

Also Anonymous ¶

1 year ago

In response to Anonymous' note:(https://www.php.net/manual/en/function.openssl-pkcs12-read.php#128790)

I'm using 8.2.6 on Windows and this function is working without issue.

down

Rovinson ¶

1 year ago

In response to Anonymous' note:(https://www.php.net/manual/es/function.openssl-pkcs12-read.php#128819)

In PHP versions 8.2.6 and 8.2.7, OpenSSL 1.1.1 is still utilized. However, starting from PHP version 8.2.8 onwards, OpenSSL 3.0.9 is employed.

I have conducted tests, and the function works correctly with all PHP versions using OpenSSL 1, but it fails with OpenSSL 3 versions.

down

InvisibleSmiley ¶

1 year ago

It really seems to depend on the OpenSSL version only. I checked:

OpenSSL 1:
- Linux Sury PHP 8.1 and 8.2
- Windows (according to what Anonymous reported here)

OpenSSL 3:
- Linux Ubuntu jammy (22.04 LTS) PHP 8.1
- Mac OS Homebrew PHP 8.1 and 8.2

down

quinn at strangecode dot com ¶

2 months ago

There may be no need to configure OpenSSL to use legacy algorithms. If possible, it's easier and more portable just to convert the encrypted certificates file. The steps below use a `.p12` file but it should work to swap these commands for a `.pfx` file.

1. Dump the certs from the old `.p12` (it will ask for the certificate password):

openssl pkcs12 -in old.p12 -out temp.pem -nodes -legacy

2. Make a new `.p12` encrypted with algorithms used in OpenSSL v3 (create a new certificate password):

openssl pkcs12 -export -in temp.pem -out new.p12 -certpbe AES-256-CBC -keypbe AES-256-CBC -iter 2048

3. Rename the `new.p12` so it's accessible by your app.

＋adicione uma nota