SSL：使用 PHP 將私鑰與證書匹配（沒有 phpseclib）

Question

我曾嘗試使用此 PHP 代碼腳本來檢查 SSL 私鑰與 SSL 證書是否匹配，結果是否每次都匹配。

error_reporting(E_ALL & ~E_NOTICE);

if (!extension_loaded('OpenSSL')) {
        $this->markTestSkipped("Need OpenSSL extension");
}

$pkey = "-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDvwT54v2kQTRP3
ZnJepfuBgEUfrEqBZ7zLm87s1NHwwJNNbwqGCYTIoCv4xDgRCK7X7NVmMyV2OWIn
...
-----END PRIVATE KEY-----";

$cert = "-----BEGIN CERTIFICATE-----
MIIGRTCCBS2gAwIBAgIQVWcnF+whEw+mvnBlp/JMCzANBgkqhkiG9w0BAQsFADCB
kDELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
...
-----END CERTIFICATE-----";

$check_result = check_pkey_cert_match($pkey, $cert);

if($check_result == true) {
  echo "Match";
} else {
  echo "Not Match";
}

這個函數通過 shell_exec 使用 openssl 它可以導出文件 server.crt, server.key, server.csr

function check_pkey_cert_match($Private_Key, $Certificate) {
  //checks if Private Key match Certificate

  $random_blurp = rand(10,99999);
  $tmp_dir = "/tmp/";

  if(openssl_x509_export_to_file($Certificate, $tmp_dir.$random_blurp.'.server.crt')) {
     echo "Export Cert OK = ".$tmp_dir.$random_blurp.".server.crt";
  } else {
    echo "Export Crt Error";
  }

  if(openssl_pkey_export_to_file($Private_Key, $tmp_dir.$random_blurp.'.server.key')) {
     echo "Export Pkey OK = ".$tmp_dir.$random_blurp.".server.key";
  } else {
     echo "Export Pkey Error";
  }

但是當我使用這個 shell_exec 來檢查 $pkey_check 和 $cert_check 是否匹配時，它每次仍然結果匹配。 因為 $pkey_check & $cert_check = null

  $pkey_check = shell_exec('openssl pkey  -in 
'.$tmp_dir.$random_blurp.'.server.key -pubout -outform pem | sha256sum');

  $cert_check = shell_exec('openssl x509  -in 
'.$tmp_dir.$random_blurp.'.server.crt  -pubout -outform pem | sha256sum');

 // $csr_check = shell_exec('openssl req -in '.$tmp_dir.$random_blurp.'.server.csr -pubout -outform pem | sha256sum');


  //remove those temp files.

  unlink($tmp_dir.'server.crt');

  unlink($tmp_dir.'server_key');

  //unlink($tmp_dir.'server.csr');

  //Check for match

  if ( $cert_check == $pkey_check ) {
    return true;
  } else {
    return false;
  }

上述腳本的結果

導出證書 OK = /tmp/41893.server.crt

導出 Pkey OK = /tmp/41893.server.key

cert_check =

pkey_check =

匹配

我嘗試了另一個 shell_exec 但結果相同

  /*
  $pkey_check = shell_exec('openssl rsa -noout -modulus -in  server.key | openssl md5');
  $cert_check = shell_exec('openssl x509 -noout -modulus -in server.crt | openssl md5');
  $csr_check = shell_exec('openssl req -noout -modulus -in  server.csr | openssl md5');
  */

  /*  
  $pkey_check = shell_exec('openssl rsa  -modulus -in '.$tmp_dir.$random_blurp.'.server.key | openssl md5 2>&1');
  $cert_check = shell_exec('openssl x509  -modulus -in '.$tmp_dir.$random_blurp.'.server.crt | openssl md5 2>&1');
  $csr_check = shell_exec('openssl req -noout -modulus -in '.$tmp_dir.$random_blurp.'.server.csr | openssl md5 2>&1');
  */

  $pkey_check = shell_exec('openssl pkey  -in '.$tmp_dir.$random_blurp.'.server.key -pubout -outform pem | sha256sum');
  $cert_check = shell_exec('openssl x509  -in '.$tmp_dir.$random_blurp.'.server.crt  -pubout -outform pem | sha256sum');
 // $csr_check = shell_exec('openssl req -in '.$tmp_dir.$random_blurp.'.server.csr -pubout -outform pem | sha256sum');

Answer 1

（代表問題作者發表） 。

這個簡單的腳本用於檢查私鑰和證書是否匹配。

error_reporting(E_ALL & ~E_NOTICE);

if (!extension_loaded('OpenSSL')) {
        $this->markTestSkipped("Need OpenSSL extension");
}

定義 $cert 和 $pkey（或使用 $_POST[$cert] 和 $_POST[$pkey] 代替）

$pkey = "-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDvwT54v2kQTRP3
ZnJepfuBgEUfrEqBZ7zLm87s1NHwwJNNbwqGCYTIoCv4xDgRCK7X7NVmMyV2OWIn
...
-----END PRIVATE KEY-----";

$cert = "-----BEGIN CERTIFICATE-----
MIIGRTCCBS2gAwIBAgIQVWcnF+whEw+mvnBlp/JMCzANBgkqhkiG9w0BAQsFADCB
kDELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
...
-----END CERTIFICATE-----";

調用函數 check_pkey_cert_match() 和結果。

$check_result = check_pkey_cert_match($pkey, $cert);

if($check_result == true) {
  echo "Match";
} else {
  echo "Not Match";
}

只需使用函數 openssl_x509_check_private_key()

function check_pkey_cert_match($Private_Key, $Certificate) {

  //Check for match
  if(openssl_x509_check_private_key ( $Certificate , $Private_Key )) {
      return true;
  } else {
     return false;
  }

}