SSL PHP Server Key and Certificate generation: Difference between revisions

'''''Server key and certificate generation revisited.'''''

== Introduction ==

   

{|

TITLE UNIFORM SERVER - Certificate and Key generator  

COLOR B0

..\..\usr\local\php\php.exe -c ..\..\usr\local\php\php-cli.ini  gen.php

pause

|}

Double click Run.bat runs script cert.php it produces nothing spectacular other than to display test. It proves you have a working set-up for this tutorial.

Press any key to continue . . .

|

//=== Generate a new private (and public) key pair

$privkey = openssl_pkey_new();

|

Function openssl_pkey_new() is defined in the openssl library. Problem is extension php_openssl.dll is not being loaded because its not configured in configuration file php-cli.ini

Run (Run.bat) script again this time there will be no errors.

|

[PHP]

extension=php_curl.dll

extension=php_openssl.dll

error_reporting = E_ALL | E_STRICT

|}

'''''[[#top | Top]]'''''

=== Openssl configuration ===

{|

|

The above line creates private and public keys used in other function.

Reading the manual you will find  

Note: You need to have a valid openssl.cnf

installed for this function to operate correctly.

Most functions use this file; trouble is it cannot be found. Path assumed to be either defined by OPENSSL_CONF or SSLEAY_CONF environmental variables or on the default path c:\usr\local\ssl.

|

//=== Generate a new private (and public) key pair

$privkey = openssl_pkey_new();

//=== Create data array for certificate information

$dn = array(

);

//== Create a self-signed certificate valid for 365 days

|}

Uniform Server is portable hence the above default path is not applicable. Using environmental variables is not always a predictable solution.     

|-

|

#######################################################################

# File name: openssl.cnf

keyUsage                = digitalSignature, keyEncipherment

extendedKeyUsage        = serverAuth, nsSGC, msSGC

[ v3_req ]

keyUsage                = cRLSign, keyCertSign

extendedKeyUsage        = serverAuth, clientAuth

|}

We are interested only in defining a path to our configuration file. First absolute path is calculated and assigned to key.

//== Determine path

$ssl_path = getcwd();

//== Create a configuration array containing path to openssl.cnf  

$config = array(

);

'''''[[#top | Top]]'''''

|-

|

//=== Create data array for certificate information

$dn = array(

);

'''''Note'':''' Common name for a real signed certificate would be what a user would type into a browser e.g '''www.fred.com'''

=== Function openssl_pkey_new ===

Function openssl_pkey_new() generates a new private and public key pair.

resource openssl_pkey_new  ([  array $configargs  ] )

Code:

{|

|-

|

//=== Generate a new private (and public) key pair

$privkey = openssl_pkey_new($config);

|}

Function openssl_csr_new() generates a new CSR (Certificate Signing Request) based on the information provided by dn,

Code:

{|

|-

|

//=== Generate a certificate signing request

$csr = openssl_csr_new($dn, $privkey, $config);

|}

=== Function openssl_csr_sign ===

Function openssl_csr_sign() generates an x509 certificate resource from the given CSR.

resource openssl_csr_sign(mixed $csr, mixed $cacert, mixed $priv_key, int $days[,array $configargs[,int $serial = 0 ]])

Code:

{|

|-

|

//== Create a self-signed certificate valid for 365 days

$sscert = openssl_csr_sign($csr, null, $privkey, 365, $config);

|}

Essentially that completes certificate and key generation! They are currently resources these require extracting to appropriate files. Following function perform this task:

Function openssl_pkey_export_to_file()saves an ascii PEM encoded verion of key into the file named by outfilename.  

bool openssl_pkey_export_to_file(mixed $key,string $outfilename[,string $passphrase[,array $configargs]])

This function is a quick way to kill Apache stone dead! To prevent this ensure you use NULL for  $passphrase.

|-

|

//== Create key file. Note no passphrase

|}

Function  openssl_x509_export_to_file() exports a certificate to file

bool openssl_x509_export_to_file(mixed $x509, string $outfilename [,bool $notext ])

The optional parameter notext if it is FALSE, additional human-readable information is included in the output.

|-

|

//== Create server certificate  

|}

'''''[[#top | Top]]'''''

==== Function openssl_csr_export_to_file ====

Function openssl_csr_export_to_file()exports a CSR to a file

bool openssl_csr_export_to_file(resource $csr, string $outfilename[, bool $notext = true ])

Code:

|-

|

//== Create a signing request file  

|}

'''''[[#top | Top]]'''''

|-

|

//== Determine path

//== Create a configuration array containing path to openssl.cnf  

$config = array(

);

//=== Create data array for certificate information

$dn = array(

);

//== Create key file. Note no passphrase

//== Create server certificate  

//== Create a signing request file  

|}

Run the script, you can manually copy key and certificate to the server.

For example this extract from Nano_5_6_7 httpd.conf

# Example:

# LoadModule foo_module modules/mod_foo.so

#

LoadModule actions_module modules/mod_actions.so

LoadModule alias_module modules/mod_alias.so

It gives a saving of 1.51 MB