Mar 22, 2013

PHP OCSP script

I have here an OCSP script in PHP. It is not needed if you use the 
apache modified distribution from FedICT:ocsp is included in apache. But
 if you use a standard distribution that is automatically updated 
against new security treats (like me!), you need this. (Probably OCSP 
will be included in apache 2.4?): 
 
// User variables:
$dir = '/path/to/temp/'; // Directory where apache has access to (chmod 777).
$BelgiumCA = '/path/to/BelgiumRoot.cer'; // Points to the Belgian Root CA in PEM format.
// Script:
$a = rand(1000,99999); // Needed if you expect more page clicks in one second!
file_put_contents($dir.$a.'cert_i.pem', $_SERVER['SSL_CLIENT_CERT_CHAIN_0']); // Issuer certificate.
file_put_contents($dir.$a.'cert_c.pem', $_SERVER['SSL_CLIENT_CERT']); // Client (authentication) certificate.
$output = shell_exec('openssl ocsp -CAfile '.$BelgiumCA.' -issuer '.$dir.$a.'cert_i.pem -cert '.$dir.$a.'cert_c.pem -url http://ocsp.eid.belgium.be');
$output2 = preg_split('/[\r\n]/', $output);
$output3 = preg_split('/: /', $output2[0]);
$ocsp = $output3[1];
echo "OCSP status: ".$ocsp; // will be "good", "revoked", or "unknown"
unlink($dir.$a.'cert_i.pem');
unlink($dir.$a.'cert_c.pem');

No comments:

Post a Comment