SSL：使用 PHP 将私钥与证书匹配（没有 phpseclib）

Question

我尝试使用这个 PHP 代码脚本来检查 SSL 私钥是否与 SSL 证书匹配，或者结果是否每次都匹配。

error_reporting(E_ALL & ~E_NOTICE);

if (!extension_loaded('OpenSSL')) {
        $this->markTestSkipped("Need OpenSSL extension");
}

$pkey = "-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDvwT54v2kQTRP3
ZnJepfuBgEUfrEqBZ7zLm87s1NHwwJNNbwqGCYTIoCv4xDgRCK7X7NVmMyV2OWIn
...
-----END PRIVATE KEY-----";

$cert = "-----BEGIN CERTIFICATE-----
MIIGRTCCBS2gAwIBAgIQVWcnF+whEw+mvnBlp/JMCzANBgkqhkiG9w0BAQsFADCB
kDELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
...
-----END CERTIFICATE-----";

$check_result = check_pkey_cert_match($pkey, $cert);

if($check_result == true) {
  echo "Match";
} else {
  echo "Not Match";
}

这个函数通过shell_exec使用openssl它可以导出文件server.crt, server.key, server.csr

function check_pkey_cert_match($Private_Key, $Certificate) {
  //checks if Private Key match Certificate

  $random_blurp = rand(10,99999);
  $tmp_dir = "/tmp/";

  if(openssl_x509_export_to_file($Certificate, $tmp_dir.$random_blurp.'.server.crt')) {
     echo "Export Cert OK = ".$tmp_dir.$random_blurp.".server.crt";
  } else {
    echo "Export Crt Error";
  }

  if(openssl_pkey_export_to_file($Private_Key, $tmp_dir.$random_blurp.'.server.key')) {
     echo "Export Pkey OK = ".$tmp_dir.$random_blurp.".server.key";
  } else {
     echo "Export Pkey Error";
  }

但是当我使用这个 shell_exec 来检查 $pkey_check 和 $cert_check 是否匹配时，它仍然每次都匹配。因为 $pkey_check & $cert_check = null

  $pkey_check = shell_exec('openssl pkey  -in 
'.$tmp_dir.$random_blurp.'.server.key -pubout -outform pem | sha256sum');

  $cert_check = shell_exec('openssl x509  -in 
'.$tmp_dir.$random_blurp.'.server.crt  -pubout -outform pem | sha256sum');

 // $csr_check = shell_exec('openssl req -in '.$tmp_dir.$random_blurp.'.server.csr -pubout -outform pem | sha256sum');


  //remove those temp files.

  unlink($tmp_dir.'server.crt');

  unlink($tmp_dir.'server_key');

  //unlink($tmp_dir.'server.csr');

  //Check for match

  if ( $cert_check == $pkey_check ) {
    return true;
  } else {
    return false;
  }

以上脚本的结果

导出证书正常 = /tmp/41893.server.crt

导出 Pkey OK = /tmp/41893.server.key

cert_check =

pkey_check =

匹配

我尝试了另一个 shell_exec，但结果相同

  /*
  $pkey_check = shell_exec('openssl rsa -noout -modulus -in  server.key | openssl md5');
  $cert_check = shell_exec('openssl x509 -noout -modulus -in server.crt | openssl md5');
  $csr_check = shell_exec('openssl req -noout -modulus -in  server.csr | openssl md5');
  */

  /*  
  $pkey_check = shell_exec('openssl rsa  -modulus -in '.$tmp_dir.$random_blurp.'.server.key | openssl md5 2>&1');
  $cert_check = shell_exec('openssl x509  -modulus -in '.$tmp_dir.$random_blurp.'.server.crt | openssl md5 2>&1');
  $csr_check = shell_exec('openssl req -noout -modulus -in '.$tmp_dir.$random_blurp.'.server.csr | openssl md5 2>&1');
  */

  $pkey_check = shell_exec('openssl pkey  -in '.$tmp_dir.$random_blurp.'.server.key -pubout -outform pem | sha256sum');
  $cert_check = shell_exec('openssl x509  -in '.$tmp_dir.$random_blurp.'.server.crt  -pubout -outform pem | sha256sum');
 // $csr_check = shell_exec('openssl req -in '.$tmp_dir.$random_blurp.'.server.csr -pubout -outform pem | sha256sum');

Answer 1

（代表问题作者发布）.

这个简单的脚本用于检查私钥和证书是否匹配。

error_reporting(E_ALL & ~E_NOTICE);

if (!extension_loaded('OpenSSL')) {
        $this->markTestSkipped("Need OpenSSL extension");
}

定义 $cert 和 $pkey（或使用 $_POST[$cert] 和 $_POST[$pkey] 代替）

$pkey = "-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDvwT54v2kQTRP3
ZnJepfuBgEUfrEqBZ7zLm87s1NHwwJNNbwqGCYTIoCv4xDgRCK7X7NVmMyV2OWIn
...
-----END PRIVATE KEY-----";

$cert = "-----BEGIN CERTIFICATE-----
MIIGRTCCBS2gAwIBAgIQVWcnF+whEw+mvnBlp/JMCzANBgkqhkiG9w0BAQsFADCB
kDELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
...
-----END CERTIFICATE-----";

调用函数 check_pkey_cert_match() 和结果。

$check_result = check_pkey_cert_match($pkey, $cert);

if($check_result == true) {
  echo "Match";
} else {
  echo "Not Match";
}

只需使用函数 openssl_x509_check_private_key()

function check_pkey_cert_match($Private_Key, $Certificate) {

  //Check for match
  if(openssl_x509_check_private_key ( $Certificate , $Private_Key )) {
      return true;
  } else {
     return false;
  }

}