Phpseclib key 使用

Question

PhpSecLib 创建的默认证书文件将 keyUsage 设置为:All rules of applications。我如何将 keyUsage 设置为 Windows Crypto Shell 将显示的 digitalSignature:Ensures the Identity of a remote computer

编辑

这是我的代码:

<?php
include('File/X509.php');
include('Crypt/RSA.php');
$c = $_POST['csr'];

$CAPrivKey = new Crypt_RSA();
$CAPrivKey->setPassword('[...]');
$CAPrivKey->loadKey("-----BEGIN RSA PRIVATE KEY-----
[...]
-----END RSA PRIVATE KEY-----
");

$issuer = new File_X509();
$issuer->setPrivateKey($CAPrivKey);
$issuer->loadX509("-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
");


$subject = new File_X509();

$subject->loadCSR($c); 


$x509 = new File_X509();
$x509->setStartDate('-1 month');
$x509->setEndDate('+1 year');
$x509->setSerialNumber('125');
$result = $x509->sign($issuer, $subject);


$x509->loadX509($result);
$x509->setExtension('id-ce-keyUsage', array_merge($x509->getExtension('id-ce-   keyUsage'), array('digitalSignature')));
$result = $x509->sign($issuer, $x509);
//echo $x509->saveX509($result);

header('Content-Type: application/x-x509-ca-cert');
header("Content-Disposition: attachment; filename='ssl.cer'");
echo $x509->saveX509($result);

?>

Answer 1

除非您要放弃证书，否则您需要先执行 $x509->sign() 来创建您的证书。然后您需要重新加载该证书，设置扩展名，退出并保存。例如。

<?php
include('File/X509.php');
include('Crypt/RSA.php');

$privKey = new Crypt_RSA();
$privKey->loadKey('...');

$pubKey = new Crypt_RSA();
$pubKey->loadKey($privKey->getPublicKey());
$pubKey->setPublicKey();

$subject = new File_X509();
$subject->setDNProp('id-at-organizationName', 'demo cert');
$subject->setPublicKey($pubKey);

$issuer = new File_X509();
$issuer->setPrivateKey($privKey);
$issuer->setDN($subject->getDN());

$x509 = new File_X509();
//$x509->makeCA();
$x509->setSerialNumber('1');

$result = $x509->sign($issuer, $subject);
$x509->loadX509($result);
$x509->setExtension('id-ce-keyUsage', array('digitalSignature'));
//$x509->setExtension('id-ce-keyUsage', array_merge($x509->getExtension('id-ce-keyUsage'), array('digitalSignature')));
$result = $x509->sign($issuer, $x509);
echo $x509->saveX509($result);
?>

如果整个辞职的事情是不必要的但无论如何，那就太好了。我会看看能否让 phpseclib 作者在某个时候对其进行一些修改。