Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to get apache to expose various pieces of customers' personal certificates to php including (most importantly) the "alt subject name" field. When I inspect a cert in the browser, I can see this value but it's not exposed by default from Apache (mainly just CN/DN).

Running LAMPP 1.7.1

Any ideas?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

The PEM-encoded certificate is available to your PHP app in the environment variable

$SSL_CLIENT_CERT

You can use the PHP openssl functions to parse this, which gives you back an associative array of certificate keys and values. I assume that one of those will be your alt name.

http://uk3.php.net/manual/en/function.openssl-x509-parse.php

It will require modifications to your PHP app, but it's not terrible:

  • check for the existence of the environment variable
  • decode the cert
  • check for the existence of the key representing alt name
  • assign the value associated with that key to some other variable that the rest of your app can use

Could easily be packaged up into a function that you could include in multiple apps I'd think.

share|improve this answer
    
+1; This is the only method I'm aware of. But be aware that you'll need SSLOptions +ExportCertData and that it will always be slower than having Apache give you the variables. I'd recommend using DN contents if at all possible. –  Dan Carley Jul 29 '09 at 15:51
    
Just what I needed. –  user7944 Jul 29 '09 at 16:00

It took me a while to work this out and the information is fairly scattered so here's how I did it...

First make sure that your Apache has the following set:

SSLOptions +ExportCertData

otherwise $_SERVER["SSL_CLIENT_CERT"] will be blank.

Once you've verified $_SERVER["SSL_CLIENT_CERT"] has content, then use:

$clicertarray = openssl_x509_parse($_SERVER["SSL_CLIENT_CERT"]);

to parse the certificate into an array, then you'll be able to pull the subject alternative name with:

$clicertarray["extensions"]["subjectAltName"];

share|improve this answer

Use *var_dump($ENV) and look for the variables starting with SSL_

Also, check SSLOptions from apache's manual. StdEnvVars and ExportCertData look good. If the first doesn't help, maybe you'll need to parse the cert data passed by ExportCertData

share|improve this answer
    
Wonderful, thank you. –  user7944 Jul 29 '09 at 15:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.