phpseclib/phpseclib — pull request #24 by monnerat (2012-10-12 11:42:06+00:00)
Title: Certificate Revocation Lists

Lots of changes this time: the biggest target of them is the support of CRLs,
See commit titles for more info.
Please find an example program below.
Comments are welcome.

Regards,
Patrick
-----------------------------------
crl.php
-----------------------------------
load from file/false --> start from an empty crl.

require_once 'Crypt/RSA.php';
require_once 'File/X509.php';

// Load the CA and its private key.
$pemcakey = file_get_contents('caprivkey.pem');
$cakey = new Crypt_RSA();
$cakey->loadKey($pemcakey);
$pemca = file_get_contents('cacert.pem');
$ca = new File_X509();
$ca->loadX509($pemca);
$ca->setPrivateKey($cakey);

// Build the CRL...
$crl = new File_X509();
$crl->loadCA($pemca); // For later signature check.

if (LOAD_CRL) {
// ... by loading an existing CRL.
$pemcrl = file_get_contents('crl.pem');
$crl->loadCRL($pemcrl);
}
else {
// .. by creating a new empty CRL.
$crl->loadCRL($crl->saveCRL($crl->signCRL($ca, $crl)));
}

// Update the CRL.

$crl->unrevoke('9999');
$crl->revoke('4567');
$crl->setRevokedCertificateExtension('1234', 'id-ce-cRLReasons', 'privilegeWithdrawn');

// Sign the new CRL.
$crl->setSerialNumber(12345, 10);
$crl->setEndDate('+3 months');
$newcrl = $crl->signCRL($ca, $crl);
$pemnewcrl = $crl->saveCRL($newcrl);

// Validate the new CRL.
$crl->loadCRL($pemnewcrl);
echo 'new CRL is ' . ($crl->validateSignature() == 1 ? 'valid' : 'invalid') . "\n";

// Check certificate revocation status.
// One might get the effective serial number of a certificate with:
// $csn = $cert['tbsCertificate']['serialNumber']->toString();
foreach (array('9999', '4567', '1234') as $csn) {
$revoked = $crl->getRevoked($csn);
echo "Certificate with serial number $csn ";

if (empty($revoked))
echo 'is not revoked';
else {
echo 'has been revoked on ' . implode('', $revoked['revocationDate']);
$reason = $crl->getRevokedCertificateExtension($csn, 'id-ce-cRLReasons');
if (!empty($reason))
echo "; reason is $reason";
}

echo ".\n";
}

// Save the new CRL.
$pemnewcrl = $crl->saveCRL($newcrl);
echo "$pemnewcrl\n";
file_put_contents('newcrl.pem', "$pemnewcrl\n");
?>