Skip to content

Extend x.509 parsing to include machine-readable info about subjectAlternativeNames#20931

Open
StephenWall wants to merge 7 commits into
php:masterfrom
StephenWall:san
Open

Extend x.509 parsing to include machine-readable info about subjectAlternativeNames#20931
StephenWall wants to merge 7 commits into
php:masterfrom
StephenWall:san

Conversation

@StephenWall

Copy link
Copy Markdown
Contributor

This adds an additional array element to the output of openssl_x509_parse() that includes detailed info about the subjectAlternativeName extension in an easily machine parsable format.

Example:
If the contents of the extension appear as this in the current openssl_x509_parse() output (wrapped for readability):

Array
(
    [name] => ...
    ...
    [extensions] => Array
        (
            [subjectAltName] =>
                DNS:www.good.org,
                email:good@good.org,
                IP Address:192.168.0.1,
                othername:<unsupported>,
                othername:SmtpUTF8Mailbox:test@test.example.com,
                URI:sip:6000@192.168.0.1,
                DirName:/C=US/ST=CA/L=San Francisco/O=Example Company/OU=Example Company Unit/CN=Bob,
                Registered ID:1.2.3.4.5
        )
)

you would see a new top-level array element like this:

Array
(
    ...
    [subjectAlternativeName] => Array
        (
            [0] => Array
                (
                    [type] => DNS
                    [value] => www.good.org
                )

            [1] => Array
                (
                    [type] => email
                    [value] => good@good.org
                )

            [2] => Array
                (
                    [type] => IP Address
                    [value] => 192.168.0.1
                )

            [3] => Array
                (
                    [type] => othername
                    [value] => Array
                        (
                            [1.3.6.1.5.5.7.8.7] => foo@example.org
                        )
                )

            [4] => Array
                (
                    [type] => othername
                    [value] => Array
                        (
                            [1.3.6.1.5.5.7.8.9] => test@test.example.com
                        )
                )

            [5] => Array
                (
                    [type] => URI
                    [value] => sip:6000@192.168.0.1
                )

            [6] => Array
                (
                    [type] => DirName
                    [value] => Array
                        (
                            [2.5.4.6] => US
                            [2.5.4.8] => CA
                            [2.5.4.7] => San Francisco
                            [2.5.4.10] => Example Company
                            [2.5.4.11] => Example Company Unit
                            [2.5.4.3] => Bob
                        )

                )

            [7] => Array
                (
                    [type] => Registered ID
                    [value] => 1.2.3.4.5
                )

        )
)

…ternativeNames

This adds an additional array element to the output of `openssl_x509_parse()` that includes detailed info about the subjectAlternativeName extension in an easily machine parsable format.

Example:
If the contents of the extension appear as this in the current openssl_x509_parse() output (wrapped for readability):
```
Array
(
    [name] => ...
    ...
    [extensions] => Array
        (
            [subjectAltName] =>
                DNS:www.good.org,
                email:good@good.org,
                IP Address:192.168.0.1,
                othername:<unsupported>,
                othername:SmtpUTF8Mailbox:test@test.example.com,
                URI:sip:6000@192.168.0.1,
                DirName/C=US/ST=CA/L=San Francisco/O=Example Company/OU=Example Company Unit/CN=Bob,
                Registered ID:1.2.3.4.5
        )
)
```
you would see a new top-level array element like this:
```
Array
(
    ...
    [subjectAlternativeName] => Array
        (
            [0] => Array
                (
                    [type] => DNS
                    [value] => www.good.org
                )

            [1] => Array
                (
                    [type] => email
                    [value] => good@good.org
                )

            [2] => Array
                (
                    [type] => IP Address
                    [value] => 192.168.0.1
                )

            [3] => Array
                (
                    [type] => othername
                    [value] => Array
                        (
                            [1.3.6.1.5.5.7.8.7] => foo@example.org
                        )
                )

            [4] => Array
                (
                    [type] => othername
                    [value] => Array
                        (
                            [1.3.6.1.5.5.7.8.9] => test@test.example.com
                        )
                )

            [5] => Array
                (
                    [type] => URI
                    [value] => sip:6000@192.168.0.1
                )

            [6] => Array
                (
                    [type] => DirName
                    [value] => Array
                        (
                            [2.5.4.6] => US
                            [2.5.4.8] => CA
                            [2.5.4.7] => San Francisco
                            [2.5.4.10] => Example Company
                            [2.5.4.11] => Example Company Unit
                            [2.5.4.3] => Bob
                        )

                )

            [7] => Array
                (
                    [type] => Registered ID
                    [value] => 1.2.3.4.5
                )

        )
)
```
@StephenWall

Copy link
Copy Markdown
Contributor Author

This does not handle Multi-RDNs in the dirName field. I.e, things that appear as DirName:/CN=John Doe/OU=Testing+O=Example Org, Inc./C=US (note the +). It's my understanding they are not commonly used. I'd like to support them, but it's not straightforward, as you don't know you have a multi-RDN until you hit the second element in the multi-RDN. 🙄

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants