Hello everyone!

I'm new to PHP (and to this forum, too). My final goal is to make a script that recognises which websites have an Extended Validation certificate type and which ones do not. Except I don't know how to do it. For starters, I should download the X.509 certificate and analyse it (I use both the OpenSSL and cURL PHP extensions), but how?

DAYS of googling have brought me absolutely nothing. Any tips are appreciated. I can provide more detail if need be. I'd provide source code if I had any but I really don't know where to start... Thanks!

    If using recent enough versions of PHP and cURL, you could try this curl_setopt() option:

    CURLOPT_CERTINFO | TRUE to output SSL certification information to STDERR on secure transfers. | Added in cURL 7.19.1. Available since PHP 5.3.2. Requires CURLOPT_VERBOSE to be on to have an effect.

      Hello again, and thanks to both of you for taking the time to reply. I have tried both alternatives though I also have problems with both.

      Starting from Derokorian's suggestion, here's what I did:

      $result = shell_exec("echo -n | openssl s_client -connect localhost:80 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > Documents/php/test.cert");
echo $result;

      This doesn't do anything, however. It's a problem I previously had because I tried something very similar (here) but the main issue is that it seems my configuration (I'm running LAMP on Ubuntu 12.04) lacks the necessary permissions to execute shell commands from PHP. If I do shell_exec("whoami") it works (and returns www-data), if I try just about any other command it doesn't work. I checked my php.ini file and my Safe Mode (which is usually responsible for exec and its variants not working) is off. I don't know what else there could be that prevents me from using most executable commands on the command line from PHP. Any ideas?

      Now for NogDog's suggestion, here's what I did:

      [CODE// general page info
      curl_setopt($myurl, CURLOPT_VERBOSE, 1); // required for CURLOPT_CERTINFO
      curl_setopt($myurl, CURLOPT_CERTINFO, 1); // extracts certification info from the website at $myurl
      curl_setopt($ch, CURLOPT_URL,"https://www.digicert.com/");
      curl_setopt($myurl, CURLOPT_HEADER, 1); // includes header in report
      curl_setopt($myurl, CURLOPT_NOBODY, 1); // excludes body from report
      curl_setopt($myurl, CURLOPT_STDERR, $fileshort); // redirects output to file
      curl_setopt($myurl, CURLOPT_SSL_VERIFYPEER, true); // required for CURLOPT_CAPATH
      curl_setopt($myurl, CURLOPT_SSL_VERIFYHOST, 2); // verifies host certificate + that it matches hostname provided
      curl_setopt($myurl, CURLOPT_SSLVERSION, 3); // sets SSL version to 3
      curl_setopt($myurl, CURLOPT_CAINFO, "/etc/ssl/certs/cacert.pem"); // check certificate against list of certified authorities
      // execute
      $findlinks = curl_exec($myurl);
      echo curl_getinfo($myurl, CURLINFO_HTTP_CODE);[/CODE]

      Where $fileshort is the destination path of the file I want to write to.
      However, it does not write to said file (path is /Documents/php/getres.txt and I tried without the first slash too, but it still doesn't work). The other problem is that the information I get here does not contain the EV certificate information, which I need.

      I hope I have sufficiently explained my problems. Any other ideas?

        Sorry, I misformatted the second part of the code and committed a mistake on line 3. Here's the correct version:

        // general page info
curl_setopt($myurl, CURLOPT_VERBOSE, 1); // required for CURLOPT_CERTINFO
curl_setopt($myurl, CURLOPT_CERTINFO, 1); // extracts certification info from the website at $myurl
curl_setopt($myurl, CURLOPT_URL,"https://www.digicert.com/");
curl_setopt($myurl, CURLOPT_HEADER, 1); // includes header in report
curl_setopt($myurl, CURLOPT_NOBODY, 1); // excludes body from report
curl_setopt($myurl, CURLOPT_STDERR, $fileshort); // redirects output to file
curl_setopt($myurl, CURLOPT_SSL_VERIFYPEER, true); // required for CURLOPT_CAPATH
curl_setopt($myurl, CURLOPT_SSL_VERIFYHOST, 2); // verifies host certificate + that it matches hostname provided
curl_setopt($myurl, CURLOPT_SSLVERSION, 3); // sets SSL version to 3
curl_setopt($myurl, CURLOPT_CAINFO, "/etc/ssl/certs/cacert.pem"); // check certificate against list of certified authorities
// execute
$findlinks = curl_exec($myurl);
echo curl_getinfo($myurl, CURLINFO_HTTP_CODE);
          $result = shell_exec("echo -n | openssl s_client -connect localhost:80 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > Documents/php/test.cert");

          Because of the syntax of this command, I would expect $result to be empty because we are redirecting output to Documents/php/test.cert. Have you tried file_get_contents('Documents/php/test.cert') after the shell_exec to check for the cert? This command is working for me if I do that.

            Or just remove the redirection?

              You're right Derokorian - $result is NULL with the current setting (I tried using var_dump($result) and it gave me NULL).
              I tried this:

              shell_exec("echo -n | openssl s_client -connect localhost:80 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > Documents/php/test.cert");
$result = file_get_contents("/home/silver/Documents/php/test.cert");
echo $result;

              And it still doesn't print anything on screen. (Yes, the filepath is right and test.cert already exists, I checked)
              If I try opening test.cert with the text editor, it says "Unrecognised or unsupported data".

              I've also tried removing the redirection as per NogDog's suggestion, like so:

              $result = shell_exec("echo -n | openssl s_client -connect localhost:80 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'");
echo $result;

              But it still does nothing. There are no changes whatsoever.

              Derokorian, what configuration are you using to test this? Did you make any specific tweaks to make it work? I'm running LAMP out-of-the-box.

                Write a Reply...