function signNewCert() { if (!$GLOBALS['isCA']) { return false; } else { $CAPrivKey = new Crypt_RSA(); $CAPrivKey->loadKey($GLOBALS['CAPrivKeyStr']); $CAx509 = new File_X509(); $CAx509->loadX509($GLOBALS['CAPubX509']); //认证证书 $privKey = new Crypt_RSA(); $keyArray = $CAPrivKey->createKey($GLOBALS['RSALength']); $privKey->loadKey($keyArray['privatekey']); $pubKey = new Crypt_RSA(); $pubKey->loadKey($keyArray['publickey']); $pubKey->setPublicKey(); $subject = new File_X509(); $subject->setDNProp('id-at-organizationName', $GLOBALS['CAname'] . ' cert'); $subject->setPublicKey($pubKey); $issuer = new File_X509(); $issuer->setPrivateKey($CAPrivKey); $issuer->setDN($CAx509->getDN()); $x509 = new File_X509(); $result = $x509->sign($issuer, $subject); return array('privateKey' => $privKey->getPrivateKey(), 'publicX509' => $x509->saveX509($result)); } }
public function generateKeyPair($keyPath, $keySize = 1024) { $privKey = new \Crypt_RSA(); extract($privKey->createKey($keySize)); $privKey->loadKey($privatekey); $pubKey = new \Crypt_RSA(); $pubKey->loadKey($publickey); $pubKey->setPublicKey(); $subject = new \File_X509(); $subject->setDNProp('id-of-organization', 'phpseclib demo cert'); $subject->setPublicKey($pubKey); $issuer = new \File_X509(); $issuer->setPrivateKey($privKey); $issuer->setDN($subject->getDN()); $x509 = new \File_X509(); $result = $x509->sign($issuer, $subject); file_put_contents($keyPath . '/private.key', $privKey->getPrivateKey()); file_put_contents($keyPath . '/public.crt', $x509->saveX509($result)); }
$subject->setDNProp('id-at-organizationName', 'phpseclib demo CA'); $subject->setPublicKey($pubKey); $issuer = new File_X509(); $issuer->setPrivateKey($CAPrivKey); $issuer->setDN($CASubject = $subject->getDN()); $x509 = new File_X509(); $x509->makeCA(); $result = $x509->sign($issuer, $subject); echo "the CA cert to be imported into the browser is as follows:\r\n\r\n"; echo $x509->saveX509($result); echo "\r\n\r\n"; // create private key / x.509 cert for stunnel / website $privKey = new Crypt_RSA(); extract($privKey->createKey()); $privKey->loadKey($privatekey); $pubKey = new Crypt_RSA(); $pubKey->loadKey($publickey); $pubKey->setPublicKey(); $subject = new File_X509(); $subject->setDNProp('id-at-organizationName', 'phpseclib demo cert'); $subject->setPublicKey($pubKey); $issuer = new File_X509(); $issuer->setPrivateKey($CAPrivKey); $issuer->setDN($CASubject); $x509 = new File_X509(); $result = $x509->sign($issuer, $subject); echo "the stunnel.pem contents are as follows:\r\n\r\n"; echo $privKey->getPrivateKey(); echo "\r\n"; echo $x509->saveX509($result); echo "\r\n";
protected function execute(InputInterface $input, OutputInterface $output) { $helper = $this->getHelper('question'); // ask fields $options = ['countryName' => 'CN', 'stateOrProvinceName' => 'Shanghai', 'localityName' => 'Shanghai']; if (!$input->getOption('default')) { foreach ($options as $ask => $default) { $q = new Question($ask . '[' . $default . ']: ', $default); $options[$ask] = $helper->ask($input, $output, $q); } } $output->writeln('Generating CA private key...'); $CAPrivKey = new \Crypt_RSA(); $key = $CAPrivKey->createKey(2048); file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-ca.key', $key['privatekey']); $output->writeln('Generating self-signed CA certificate...'); $CAPrivKey->loadKey($key['privatekey']); $pubKey = new \Crypt_RSA(); $pubKey->loadKey($key['publickey']); $pubKey->setPublicKey(); $subject = new \File_X509(); $subject->setDNProp('id-at-organizationName', 'OpenVJ Certificate Authority'); foreach ($options as $prop => $val) { $subject->setDNProp('id-at-' . $prop, $val); } $subject->setPublicKey($pubKey); $issuer = new \File_X509(); $issuer->setPrivateKey($CAPrivKey); $issuer->setDN($CASubject = $subject->getDN()); $x509 = new \File_X509(); $x509->setStartDate('-1 month'); $x509->setEndDate('+3 year'); $x509->setSerialNumber(chr(1)); $x509->makeCA(); $result = $x509->sign($issuer, $subject, 'sha256WithRSAEncryption'); file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-ca.crt', $x509->saveX509($result)); $output->writeln('Generating background service SSL private key...'); $privKey = new \Crypt_RSA(); $key = $privKey->createKey(2048); file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-bg-server.key', $key['privatekey']); $privKey->loadKey($key['privatekey']); $output->writeln('Generating background service SSL certificate...'); $pubKey = new \Crypt_RSA(); $pubKey->loadKey($key['publickey']); $pubKey->setPublicKey(); $subject = new \File_X509(); $subject->setPublicKey($pubKey); $subject->setDNProp('id-at-organizationName', 'OpenVJ Background Service Certificate'); foreach ($options as $prop => $val) { $subject->setDNProp('id-at-' . $prop, $val); } $subject->setDomain('127.0.0.1'); $issuer = new \File_X509(); $issuer->setPrivateKey($CAPrivKey); $issuer->setDN($CASubject); $x509 = new \File_X509(); $x509->setStartDate('-1 month'); $x509->setEndDate('+3 year'); $x509->setSerialNumber(chr(1)); $result = $x509->sign($issuer, $subject, 'sha256WithRSAEncryption'); file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-bg-server.crt', $x509->saveX509($result)); $output->writeln('Generating background service client private key...'); $privKey = new \Crypt_RSA(); $key = $privKey->createKey(2048); file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-bg-client.key', $key['privatekey']); $privKey->loadKey($key['privatekey']); $output->writeln('Generating background service client certificate...'); $pubKey = new \Crypt_RSA(); $pubKey->loadKey($key['publickey']); $pubKey->setPublicKey(); $subject = new \File_X509(); $subject->setPublicKey($pubKey); $subject->setDNProp('id-at-organizationName', 'OpenVJ Background Service Client Certificate'); foreach ($options as $prop => $val) { $subject->setDNProp('id-at-' . $prop, $val); } $issuer = new \File_X509(); $issuer->setPrivateKey($CAPrivKey); $issuer->setDN($CASubject); $x509 = new \File_X509(); $x509->setStartDate('-1 month'); $x509->setEndDate('+3 year'); $x509->setSerialNumber(chr(1)); $x509->loadX509($x509->saveX509($x509->sign($issuer, $subject, 'sha256WithRSAEncryption'))); $x509->setExtension('id-ce-keyUsage', array('digitalSignature', 'keyEncipherment', 'dataEncipherment')); $x509->setExtension('id-ce-extKeyUsage', array('id-kp-serverAuth', 'id-kp-clientAuth')); $result = $x509->sign($issuer, $x509, 'sha256WithRSAEncryption'); file_put_contents(Application::$CONFIG_DIRECTORY . '/cert-bg-client.crt', $x509->saveX509($result)); }