如何在PHP中定义X509证书的特定用途

Question

How can I set the purpose of an X.509 certificate to X509_PURPOSE_ANY in PHP 5.x?

The following code outputs this warning:

Warning: openssl_csr_new() [function.openssl-csr-new.php]: dn: X509_PURPOSE is not a recognized name in /home/www/index.php on line 45

PHP Script:

$Configs = array(       
        'config' => 'test.cnf',
        'digest_alg' => 'sha1',
        'x509_extensions' => 'v3_ca',
        'req_extensions' => 'v3_req',
        'private_key_bits' => 2048,
        'private_key_type' => OPENSSL_KEYTYPE_RSA,
        'encrypt_key' => true,
        'encrypt_key_cipher' => OPENSSL_CIPHER_3DES);

$ExtraAttribs = array('X509_PURPOSE' => 'X509_PURPOSE_ANY');

//create cert
$dn      = array('commonName' => 'Chief');
$privkey = openssl_pkey_new($Configs);
$csr     = openssl_csr_new($dn, $privkey, $Configs, $ExtraAttribs);

The last line is line 45.

Answer 1

I cannot find any indication that X509 certificates have a "purpose". I can find only "Basic Constraints", "Key Usage" and "Enhanced Key Usage".

The closest thing I could find is http://www.openssl.org/docs/apps/verify.html which says

For compatibility with previous versions of SSLeay and OpenSSL a certificate with no trust settings is considered to be valid for all purposes.

Answer 2

The purpose is set at signing - not in the CSR. A quick look at the php docs suggest that this is not supported by the API - but you could call openssl x509 from the shell