Skip to content
This repository was archived by the owner on Apr 23, 2023. It is now read-only.

Commit e2806e3

Browse files
fgrossefgrosse
authored
Merge pull request #82 from sanderkruger/unsigned_csr
Allow creating an unsigned CSR and adding the signature later.
2 parents d1978f7 + d10872a commit e2806e3

File tree

3 files changed

+186
-2
lines changed

3 files changed

+186
-2
lines changed

‎lib/ASN1/OID.php

+1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ class OID
1515
const RSA_ENCRYPTION = '1.2.840.113549.1.1.1';
1616
const MD5_WITH_RSA_ENCRYPTION = '1.2.840.113549.1.1.4';
1717
const SHA1_WITH_RSA_SIGNATURE = '1.2.840.113549.1.1.5';
18+
const SHA256_WITH_RSA_SIGNATURE = '1.2.840.113549.1.1.11';
1819
const PKCS9_EMAIL = '1.2.840.113549.1.9.1';
1920
const PKCS9_UNSTRUCTURED_NAME = '1.2.840.113549.1.9.2';
2021
const PKCS9_CONTENT_TYPE = '1.2.840.113549.1.9.3';

‎lib/X509/CSR/CSR.php

+24-2
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ class CSR extends Sequence
4141
* @param string $signature
4242
* @param string $signatureAlgorithm
4343
*/
44-
public function __construct($commonName, $email, $organization, $locality, $state, $country, $organizationalUnit, $publicKey, $signature, $signatureAlgorithm = OID::SHA1_WITH_RSA_SIGNATURE)
44+
public function __construct($commonName, $email, $organization, $locality, $state, $country, $organizationalUnit, $publicKey, $signature = null, $signatureAlgorithm = OID::SHA1_WITH_RSA_SIGNATURE)
4545
{
4646
$this->subject = new CertificateSubject(
4747
$commonName,
@@ -56,7 +56,9 @@ public function __construct($commonName, $email, $organization, $locality, $stat
5656
$this->signature = $signature;
5757
$this->signatureAlgorithm = $signatureAlgorithm;
5858

59-
$this->createCSRSequence();
59+
if (isset($signature)) {
60+
$this->createCSRSequence();
61+
}
6062
}
6163

6264
protected function createCSRSequence()
@@ -68,11 +70,31 @@ protected function createCSRSequence()
6870

6971
$certRequestInfo = new Sequence($versionNr, $this->subject, $publicKey);
7072

73+
// Clear the underlying Construct
74+
$this->rewind();
75+
$this->children = [];
7176
$this->addChild($certRequestInfo);
7277
$this->addChild($signatureAlgorithm);
7378
$this->addChild($signature);
7479
}
7580

81+
public function getSignatureSubject()
82+
{
83+
$versionNr = new Integer(self::CSR_VERSION_NR);
84+
$publicKey = new PublicKey($this->publicKey);
85+
86+
$certRequestInfo = new Sequence($versionNr, $this->subject, $publicKey);
87+
return $certRequestInfo->getBinary();
88+
}
89+
90+
public function setSignature($signature, $signatureAlgorithm = OID::SHA1_WITH_RSA_SIGNATURE)
91+
{
92+
$this->signature = $signature;
93+
$this->signatureAlgorithm = $signatureAlgorithm;
94+
95+
$this->createCSRSequence();
96+
}
97+
7698
public function __toString()
7799
{
78100
$tmp = base64_encode($this->getBinary());

‎tests/X509/CSR/CSRSignatureTest.php

+161
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
<?php
2+
/*
3+
* This file is part of the PHPASN1 library.
4+
*
5+
* Copyright © Friedrich Große <[email protected]>
6+
*
7+
* For the full copyright and license information, please view the LICENSE
8+
* file that was distributed with this source code.
9+
*/
10+
11+
namespace FG\Test\X509\CSR;
12+
13+
use FG\ASN1\ASNObject;
14+
use FG\X509\CSR\CSR;
15+
use FG\Test\ASN1TestCase;
16+
use FG\ASN1\OID;
17+
18+
class CSRSignatureTest extends ASN1TestCase
19+
{
20+
private $pem = '-----BEGIN RSA PRIVATE KEY-----
21+
MIIEpAIBAAKCAQEA06GG0gy12nbyp5yiuNfsgBAt4uRWmUgkA1kQuCdDoFhLTjMs
22+
ROreQJGKVbyPMiY1HwML/XaC0NRZtqMssrwmKvh7KGb6QEmz7dCVdk/eU7IF480/
23+
93BZmGYH2sdqG40pTwblagw8D21Cx+wTwHHkAmX4Rzc86Cw+GPSAgh0kD9TygEtJ
24+
xcA/xd/NUHj5FlwDclxGZH7B89g/OSVWOqrOYFpQfl5SSTAMc1bgyUQMW1rh5sIR
25+
W0xuCUCIcBsaoibYGE/R/5TPdoMhqYAmbyXlJAED8eozIeY5XKaWe+jnr+XlRkFY
26+
UOJbkt+91slQ+WS7zWMS2UVzkZT7ha7cgR+fIwIDAQABAoIBADCjUO75iNn6uG4Z
27+
K7S7u1j7XvBkdhqoX859K8CHFZ3GbRg93pDAQfApAtgNjAOEkHTeKGVKVWpVQ4Ec
28+
I2u4njUGApgYgq8/wSCI7bDRTlGB+qSOSYM+yPijim6XoiVO3g2Rkiw7P5p0DAMS
29+
mL+D7Vk3wkXrxg2+DU+C8f31YJJafY+1IW1GfNWsbUxzzN4k31Txxo3FNI0t+MlV
30+
tzmdwxQYiHXrHa5etqidH2KP/uelkyHPBNp3LCYWpnMA0BnnmKEWq4HvqrsmuZbh
31+
RA3yaXd1tqwuBf5lVIC3ertdADhRTNtOn3R7N8sygT5mhNDXnpvYC/m60GshTbcz
32+
pYqO0EECgYEA79AEp7FJwei8XAsJ1Ah73ZDV7BRrM6ymHLqJg4ob4SuFt5D62enM
33+
zjeOZHccO2p0iGQkKvHY5CoOx1NZZRZCfALzxdM/2r5P24DOkmoN4Bz9Ye0Rb8MQ
34+
nMOpCK6aA+62/w5hzyHNgH66ILpP2NlUJJXKnqdRU+FjA3UArr8c5BMCgYEA4eqH
35+
Idoh8xozvhR/8uG5Ksdu+WgucEo2WbXwwvZc4JjyKWOfcLujMzs1gCrezwJulGVy
36+
yS/VQevtlu7g/29GdDTqtJA3gb3rmsYZlJPA+VYHB6jIRhDVFie6BQAhycux9Kem
37+
hFaR172HMxsv0fH2j790JxG3CUECZg6vhpyUGrECgYEAkJ1wATQvV2kjFZpufdfz
38+
4kQyTOBvWUUXEyIGRTWm5F2bkHw0We7c28qy6rDNbKMgzRMeoGshsU4PhXIk6YnH
39+
5ALfwH9I9X9opuUBLVgZL/orbr9IkY4fWXnAWIT6Sb7NyfeBUih/RaqmUZApEIrW
40+
bA2Ml6osqBm13OLU24xSPtMCgYAKpfRCmzZ4b+a6cdrqBsukgYvwg4GU11qiddno
41+
RpZwG6VmYAS22pFBq+vEo8CmvzWZFwMHCpMhrU4gjBfc0lDez1O0uQt0uQ/u1qGE
42+
CEbTOcPRD5qI+uggSDUTYUM2cLxtjK1jlXUAVzWVKhXh7maxtdNyt/oJnJ/RUaXi
43+
UWUFsQKBgQCAuOnqi4CntD28a8rXCFK97YAmTsRI6Ax14AaoMf8hGRc69CeU1Od3
44+
kKnF0o/HC1mdL4ADeup/OfHZiXpCDuoG6N7MS5QxszbPVkZjznlNxJLu3oDdO48u
45+
dd0uSrw8HCy5VnOIpNvxsjCQs/LtPB4cJgZeUx91Yod1Fg2C04Nbnw==
46+
-----END RSA PRIVATE KEY-----';
47+
48+
private $cert = '-----BEGIN CERTIFICATE REQUEST-----
49+
MIICRzCCAbMCAQAwgYcxCzAJBgNVBAYTAlVTMQkwBwYDVQQIEwAxFjAUBgNVBAcT
50+
DVNhbiBGcmFuc2lzY28xDzANBgNVBAoTBkdpdGh1YjELMAkGA1UECxMCSVQxEzAR
51+
BgNVBAMTCmdpdGh1Yi5vcmcxIjAgBgkqhkiG9w0BCQEWE25vLXJlcGx5QGdpdGh1
52+
Yi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDToYbSDLXadvKn
53+
nKK41+yAEC3i5FaZSCQDWRC4J0OgWEtOMyxE6t5AkYpVvI8yJjUfAwv9doLQ1Fm2
54+
oyyyvCYq+HsoZvpASbPt0JV2T95TsgXjzT/3cFmYZgfax2objSlPBuVqDDwPbULH
55+
7BPAceQCZfhHNzzoLD4Y9ICCHSQP1PKAS0nFwD/F381QePkWXANyXEZkfsHz2D85
56+
JVY6qs5gWlB+XlJJMAxzVuDJRAxbWuHmwhFbTG4JQIhwGxqiJtgYT9H/lM92gyGp
57+
gCZvJeUkAQPx6jMh5jlcppZ76Oev5eVGQVhQ4luS373WyVD5ZLvNYxLZRXORlPuF
58+
rtyBH58jAgMBAAEwDQYJKoZIhvcNAQELBQADfwAKAAAEAQAAAAAACAAABQAAAAAA
59+
AAAAAAAAAgAAAAAAAAgABQAHAAAAAAAAANcAAAAAAAAAAAsAfgwAAAAAAAALAAAN
60+
DQAADwAAAAANAAAAAAAACwALAAAAAPYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
61+
AAAAAAAAAAAAAAg=
62+
-----END CERTIFICATE REQUEST-----';
63+
64+
public function testSignatureSubject()
65+
{
66+
$private_key = openssl_pkey_get_private($this->pem);
67+
$pem = openssl_pkey_get_details($private_key)['key'];
68+
$pemparts = explode("\n", trim($pem));
69+
array_pop($pemparts);
70+
array_shift($pemparts);
71+
$binarykey = base64_decode(implode('', $pemparts));
72+
$asn1KeyWrapper = ASNObject::fromBinary($binarykey);
73+
74+
// Now get the key out in hex format
75+
$asn1Key = $asn1KeyWrapper->getContent();
76+
$hexkey = $asn1Key[1]->getContent();
77+
78+
$csr = new CSR('github.org', '[email protected]', 'Github', 'San Fransisco', '', 'US', 'IT', $hexkey);
79+
$digest = $csr->getSignatureSubject();
80+
$this->assertEquals(bin2hex($digest), '308201b3020100308187310b30090603550406130255533109300706035504081300311630140603550407130d53616e204672616e736973636f310f300d060355040a1306476974687562310b3009060355040b13024954311330110603550403130a6769746875622e6f72673122302006092a864886f70d01090116136e6f2d7265706c79406769746875622e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100d3a186d20cb5da76f2a79ca2b8d7ec80102de2e456994824035910b82743a0584b4e332c44eade40918a55bc8f3226351f030bfd7682d0d459b6a32cb2bc262af87b2866fa4049b3edd095764fde53b205e3cd3ff77059986607dac76a1b8d294f06e56a0c3c0f6d42c7ec13c071e40265f847373ce82c3e18f480821d240fd4f2804b49c5c03fc5dfcd5078f9165c03725c46647ec1f3d83f3925563aaace605a507e5e5249300c7356e0c9440c5b5ae1e6c2115b4c6e094088701b1aa226d8184fd1ff94cf768321a980266f25e5240103f1ea3321e6395ca6967be8e7afe5e546415850e25b92dfbdd6c950f964bbcd6312d945739194fb85aedc811f9f230203010001');
81+
}
82+
83+
public function testAddSignature()
84+
{
85+
$private_key = openssl_pkey_get_private($this->pem);
86+
$pem = openssl_pkey_get_details($private_key)['key'];
87+
$pemparts = explode("\n", trim($pem));
88+
array_pop($pemparts);
89+
array_shift($pemparts);
90+
$binarykey = base64_decode(implode('', $pemparts));
91+
$asn1KeyWrapper = ASNObject::fromBinary($binarykey);
92+
93+
// Now get the key out in hex format
94+
$asn1Key = $asn1KeyWrapper->getContent();
95+
$hexkey = $asn1Key[1]->getContent();
96+
97+
$csr = new CSR('github.org', '[email protected]', 'Github', 'San Fransisco', '', 'US', 'IT', $hexkey);
98+
$digest = $csr->getSignatureSubject();
99+
$signature = null;
100+
openssl_sign($digest, $signature, $private_key, OPENSSL_ALGO_SHA256);
101+
$csr->setSignature($signature, OID::SHA256_WITH_RSA_SIGNATURE);
102+
103+
$cert = str_replace("\r\n", "\n", $csr->__toString());
104+
$expected = str_replace("\r\n", "\n", $this->cert);
105+
$this->assertEquals($expected, $cert);
106+
}
107+
108+
public function testAddSignatureTwice()
109+
{
110+
$private_key = openssl_pkey_get_private($this->pem);
111+
$pem = openssl_pkey_get_details($private_key)['key'];
112+
$pemparts = explode("\n", trim($pem));
113+
array_pop($pemparts);
114+
array_shift($pemparts);
115+
$binarykey = base64_decode(implode('', $pemparts));
116+
$asn1KeyWrapper = ASNObject::fromBinary($binarykey);
117+
118+
// Now get the key out in hex format
119+
$asn1Key = $asn1KeyWrapper->getContent();
120+
$hexkey = $asn1Key[1]->getContent();
121+
122+
$csr = new CSR('github.org', '[email protected]', 'Github', 'San Fransisco', '', 'US', 'IT', $hexkey);
123+
$digest = $csr->getSignatureSubject();
124+
$signature = null;
125+
openssl_sign($digest, $signature, $private_key, OPENSSL_ALGO_SHA256);
126+
$csr->setSignature($signature, OID::SHA256_WITH_RSA_SIGNATURE);
127+
$csr->setSignature($signature, OID::SHA256_WITH_RSA_SIGNATURE);
128+
129+
$cert = str_replace("\r\n", "\n", $csr->__toString());
130+
$expected = str_replace("\r\n", "\n", $this->cert);
131+
$this->assertEquals($expected, $cert);
132+
}
133+
134+
public function testCertificate()
135+
{
136+
$private_key = openssl_pkey_get_private($this->pem);
137+
$pem = openssl_pkey_get_details($private_key)['key'];
138+
$pemparts = explode("\n", trim($pem));
139+
array_pop($pemparts);
140+
array_shift($pemparts);
141+
$binarykey = base64_decode(implode('', $pemparts));
142+
$asn1KeyWrapper = ASNObject::fromBinary($binarykey);
143+
144+
// Now get the key out in hex format
145+
$asn1Key = $asn1KeyWrapper->getContent();
146+
$hexkey = $asn1Key[1]->getContent();
147+
148+
$csr = new CSR('github.org', '[email protected]', 'Github', 'San Fransisco', '', 'US', 'IT', $hexkey);
149+
$digest = $csr->getSignatureSubject();
150+
$signature = null;
151+
openssl_sign($digest, $signature, $private_key, OPENSSL_ALGO_SHA256);
152+
$csr->setSignature($signature, OID::SHA256_WITH_RSA_SIGNATURE);
153+
154+
$cert = $csr->__toString();
155+
$key = openssl_csr_get_public_key($cert);
156+
$certPem = openssl_pkey_get_details($key)['key'];
157+
158+
$this->assertEquals($certPem, $pem);
159+
}
160+
161+
}

0 commit comments

Comments
 (0)