简介

This module uses the functions of » OpenSSL for generation and verification of signatures and for sealing (encrypting) and opening (decrypting) data. OpenSSL offers many features that this module currently doesn't support. Some of these may be added in the future.

需求

In order to use the OpenSSL functions you need to install the » OpenSSL package. PHP between versions 4.0.5 and 4.3.1 will work with OpenSSL >= 0.9.5. Other versions (PHP <=4.0.4 and >= 4.3.2) require OpenSSL >= 0.9.6.

安装

To use PHP's OpenSSL support you must also compile PHP --with-openssl[=DIR].

Note to Win32 Users: In order for this extension to work, there are DLL files that must be available to the Windows system PATH. See the FAQ titled "How do I add my PHP directory to the PATH on Windows" for information on how to do this. Although copying DLL files from the PHP folder into the Windows system directory also works (because the system directory is by default in the systems PATH), it is not recommended. This extension requires the following files to be in the PATH: libeay32.dll

Additionally, if you are planning to use the key generation and certificate signing functions, you will need to install a valid openssl.cnf on your system. As of PHP 4.3.0, we include a sample configuration file in the openssl folder of our win32 binary distribution. If you are using PHP 4.2.0 or later and are missing the file, you can obtain it from » the OpenSSL home page or by downloading the PHP 4.3.0 release and using the configuration file from there.

PHP will search for the openssl.cnf using the following logic:

• the OPENSSL_CONF environmental variable, if set, will be used as the path (including filename) of the configuration file.
• the SSLEAY_CONF environmental variable, if set, will be used as the path (including filename) of the configuration file.
• The file openssl.cnf will be assumed to be found in the default certificate area, as configured at the time that the openssl DLL was compiled. This is usually means that the default filename is c:\usr\local\ssl\openssl.cnf.

In your installation, you need to decide whether to install the configuration file at c:\usr\local\ssl\openssl.cnf or whether to install it someplace else and use environmental variables (possibly on a per-virtual-host basis) to locate the configuration file. Note that it is possible to override the default path from the script using the configargs of the functions that require a configuration file.

运行时配置

本扩展模块在 php.ini 中未定义任何配置选项。

资源类型

Key/Certificate parameters

Quite a few of the openssl functions require a key or a certificate parameter. PHP 4.0.5 and earlier have to use a key or certificate resource returned by one of the openssl_get_xxx functions. Later versions may use one of the following methods:

Certificate Verification

When calling a function that will verify a signature/certificate, the cainfo parameter is an array containing file and directory names that specify the locations of trusted CA files. If a directory is specified, then it must be a correctly formed hashed directory as the openssl command would use.

预定义常量

以下常量由本扩展模块定义，因此只有在本扩展模块被编译到 PHP 中，或者在运行时被动态加载后才有效。

目录

openssl_csr_export_to_file Exports a CSR to a file

openssl_csr_export Exports a CSR as a string

openssl_csr_get_public_key Returns the public key of a CERT

openssl_csr_get_subject Returns the subject of a CERT

openssl_csr_new Generates a CSR

openssl_csr_sign Sign a CSR with another certificate (or itself) and generate a certificate

openssl_error_string Return openSSL error message

openssl_free_key Free key resource

openssl_get_privatekey 别名 openssl_pkey_get_private()

openssl_get_publickey 别名 openssl_pkey_get_public()

openssl_open Open sealed data

openssl_pkcs7_decrypt Decrypts an S/MIME encrypted message

openssl_pkcs7_encrypt Encrypt an S/MIME message

openssl_pkcs7_sign Sign an S/MIME message

openssl_pkcs7_verify Verifies the signature of an S/MIME signed message

openssl_pkey_export_to_file Gets an exportable representation of a key into a file

openssl_pkey_export Gets an exportable representation of a key into a string

openssl_pkey_free Frees a private key

openssl_pkey_get_details Returns an array with the key details (bits, pkey, type)

openssl_pkey_get_private Get a private key

openssl_pkey_get_public Extract public key from certificate and prepare it for use

openssl_pkey_new Generates a new private key

openssl_private_decrypt Decrypts data with private key

openssl_private_encrypt Encrypts data with private key

openssl_public_decrypt Decrypts data with public key

openssl_public_encrypt Encrypts data with public key

openssl_seal Seal (encrypt) data

openssl_sign Generate signature

openssl_verify Verify signature

openssl_x509_check_private_key Checks if a private key corresponds to a certificate

openssl_x509_checkpurpose Verifies if a certificate can be used for a particular purpose

openssl_x509_export_to_file Exports a certificate to file

openssl_x509_export Exports a certificate as a string

openssl_x509_free Free certificate resource

openssl_x509_parse Parse an X509 certificate and return the information as an array

openssl_x509_read Parse an X.509 certificate and return a resource identifier for it