openssl_x509_parse
(PHP 4 >= 4.0.6, PHP 5, PHP 7, PHP 8)
Parse an X509 certificate and return the information as an array
Description
openssl_x509_parse() returns information about the supplied certificate, including fields such as subject name, issuer name, purposes, valid from and valid to dates etc.
Parameters
certificateX509 certificate. See Key/Certificate parameters for a list of valid values.
short_namesshort_namescontrols how the data is indexed in the array - ifshort_namesis true (the default) then fields will be indexed with the short name form, otherwise, the long name form will be used - e.g.: CN is the shortname form of commonName.
Return Values
Returns an Array of certificate fields on success, or false on failure.
alias is present only when the certificate has an alias. Every other key listed below is always present.
| Key | Type | Description |
|---|---|---|
name | string | Subject distinguished name as a single string, with components separated by slashes. For example, /C=US/O=Example/CN=example.com. |
subject | array | Subject distinguished name. Keys are short names such as CN when short_names is true, and long names such as commonName otherwise. Each value is a UTF-8 String, or an Array of UTF-8 Strings when that component occurs more than once. |
hash | string | Lowercase hexadecimal hash of the subject name, as used to look up a certificate in an OpenSSL CA directory. This is an 8-digit value. It is not the certificate fingerprint; see openssl_x509_fingerprint(). |
issuer | array | Issuer distinguished name, in the same form as subject. |
version | int | Raw version field stored in the certificate. This value is one less than the certificate version usually displayed: a version 1 certificate is 0, a version 2 certificate is 1, and a version 3 certificate is 2. |
serialNumber | string | Decimal representation of the serial number. Large serial numbers are returned as a hexadecimal string prefixed with 0x instead. |
serialNumberHex | string | Uppercase hexadecimal representation of the serial number. |
validFrom | string | Not-before time in ASN.1 form, either UTCTime (YYMMDDHHMMSSZ) or GeneralizedTime (YYYYMMDDHHMMSSZ). |
validTo | string | Not-after time, in the same form as validFrom. |
validFrom_time_t | int | Not-before time as a Unix timestamp, or -1 if the time could not be parsed. |
validTo_time_t | int | Not-after time as a Unix timestamp, or -1 if the time could not be parsed. |
alias | string | Certificate alias (friendly name). Only present when one is set. |
signatureTypeSN | string | Short name of the signature algorithm. |
signatureTypeLN | string | Long name of the signature algorithm. |
signatureTypeNID | int | Numeric signature-algorithm identifier (OpenSSL NID). |
purposes | array | Purpose checks, indexed by purpose id. The ids are the X509_PURPOSE_* constants. Each value is an Array described below. |
extensions | array | Certificate extensions, indexed by short name (for example subjectAltName) or by OID when the extension has no short name. Each value is text describing that extension, or the raw extension data when it cannot be printed. Which keys are present depends on the certificate. This array does not follow short_names. |
Each element of purposes has the following keys:
| Key | Type | Description |
|---|---|---|
0 | bool | true if the certificate can be used for this purpose as an end-entity certificate. |
1 | bool | true if the certificate can be used for this purpose as a CA certificate. |
2 | string | Purpose name. A short name such as sslclient when short_names is true, and a long name such as SSL client otherwise. |
Changelog
| Version | Description |
|---|---|
| 8.4.0 | Parsing certificate with no seconds in UTCTime is no longer allowed for any OpenSSL version. It was already disallowed for OpenSSL version 3.3+. |
| 8.0.0 | certificate accepts an OpenSSLCertificate instance now; previously, a Resource of type OpenSSL X.509 was accepted. |