A PHP library for X.501 ASN.1 types, X.520 attributes and DN parsing.
- PHP >=7.2
- intl
- mbstring
- sop/asn1
This library is available on Packagist.
composer require sop/x501
This project is licensed under the MIT License.
A PHP library for X.501 ASN.1 modules, X.520 attributes and DN parsing.
License: MIT License
This is probably not a bug of this library itself, but rather of everyone else :) Still, I think it's worth documenting.
I've ran several days ago in the wild into a couple of "valid" certificates[1] that had the serialNumber component of the subject field encoded as UTF8String . We're using sop/x509 to parse certificates (which in turn uses sop/x501) which failed to parse them (pretty justified, since both RFC3280 and X.520 define the X520serialNumber field as PrintableString). As far as I can tell these standards have at most been updated (by RFC4630 at least) to permit UTF8String values in fields defined as DirectoryString, and I have yet to find an updated standard that redefines serialNumber as such.
The sad part is that those certificates have been happily used so far with no issues and the holders are none the wiser (I ran into them as qualified signatures of a legal document). I've dug into how OpenSSL parses the certificate and it seems it happily accepts any string value when parsing RDNs. I presume lots of other libraries are doing the same.
Again, this is not a bug of sop/x501 in itself, more of a warning that enough parsers out there are operating in "quirks mode" that strictly enforcing the standard could cause several lost days chasing the issue. I'll personally try to weasel my way out of parsing the entire certificate or at worst consider a local and shameful fork that allows all components of a DN to be any kind of string :(
[1] I'm not including the certificates since I can't obtain permissions from their owners, but they have been issued by Eurocert, with issuer "organizationIdentifier = VATPL-9512352379, C = PL, O = EuroCert Sp. z o.o., CN = Centrum Kwalifikowane EuroCert", authority key identifier 74:62:70:99:FF:1B:60:3B:C4:64:B5:84:1F:A3:15:0C:5C:CB:5F:BD . It's a legit CA, added to the European Trusted List and everything . I will also try to contact them to consider being more strict in the future, but I don't expect much and it's possible that other CAs are doing the same thing.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.