PHP download

Download the PHP package dskripchenko/php-pdf-cloud-kms without Composer

On this page you can find all versions of the php package dskripchenko/php-pdf-cloud-kms. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

Table of contents
Download dskripchenko/php-pdf-cloud-kms
More information about dskripchenko/php-pdf-cloud-kms
Files in dskripchenko/php-pdf-cloud-kms

Vendor dskripchenko
Package php-pdf-cloud-kms
Short Description Cloud KMS signers for dskripchenko/php-pdf: sign PDFs (PAdES, RSA and ECDSA) with keys held by AWS KMS, Google Cloud KMS or Azure Key Vault — the key never leaves the cloud.
License MIT
Homepage https://github.com/dskripchenko/php-pdf-cloud-kms

Keywords pdf signature kms PHP-PDF hsm pades aws-kms azure-key-vault google-cloud-kms

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:

If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.

Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
To use Composer is sometimes complicated. Especially for beginners.
Composer needs much resources. Sometimes they are not available on a simple webspace.
If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.

Please rate this library. Is it a good library?

Example code of dskripchenko/php-pdf-cloud-kms

Informations about the package php-pdf-cloud-kms

dskripchenko/php-pdf-cloud-kms

Sign PDFs with dskripchenko/php-pdf using a key held by a cloud KMS: AWS KMS, Google Cloud KMS (and Cloud HSM), Azure Key Vault (and Managed HSM). php-pdf computes the digest, the service signs it; the key never leaves the cloud and the document never leaves your process. The result is a PAdES signature with RSA or ECDSA.

🌐 English · 中文

The certificate

A KMS holds a key pair, not a certificate. Get one issued for the key's public key — by your CA, or a qualified provider — and pass it as certificatePem. Azure Key Vault can hold the certificate itself; then AzureKeyVaultSigner::fromCertificate() reads both.

Every signer verifies the returned signature against the certificate before handing it to php-pdf, so a key that does not belong to the certificate, or a key whose algorithm uses another digest, fails with a clear error instead of producing a PDF no reader accepts.

AWS KMS

Needs aws/aws-sdk-php. Credentials come from the SDK's default chain — environment, profile, ECS/EC2 role, IRSA — or pass clientOptions:, or build the KmsClient yourself and use new AwsKmsSigner($client, …).
The key: KeyUsage: SIGN_VERIFY, RSA_2048/3072/4096 or ECC_NIST_P256/P384/P521. The caller needs kms:Sign.
The algorithm follows the key and the digest: RSASSA_PKCS1_V1_5_SHA_256, ECDSA_SHA_384…
sendDigest: false sends the signed attributes themselves (MessageType: RAW, up to 4 KB) instead of their digest — for emulators without DIGEST, such as moto.

Google Cloud KMS

REST API, no Google SDK needed. Tokens: GoogleToken::fromMetadataServer(), GoogleToken::fromServiceAccountJson($json), or any source through new CallbackToken(fn () => …) (google/auth, for one).
The key version: purpose ASYMMETRIC_SIGN, an EC_SIGN_* or RSA_SIGN_PKCS1_* algorithm. The algorithm fixes the digest: for …_SHA512 keys pass digest: DigestAlgorithm::Sha512. RSA-PSS keys are not supported. The caller needs roles/cloudkms.signer.
The digest is sent with its CRC32C, and the service's integrity flag is checked.

Azure Key Vault

REST API, no Azure SDK needed. Tokens: AzureToken::managedIdentity() (VMs, AKS, App Service, Container Apps; a user-assigned identity by its client id) or AzureToken::clientCredentials($tenant, $clientId, $secret), or new CallbackToken(fn () => …).
Keys: RSA, RSA-HSM, EC, EC-HSM (P-256, P-384, P-521), Managed HSM too. The identity needs the sign key permission or the Key Vault Crypto User role, and get on certificates for fromCertificate().

Common options

Argument	Default	Meaning
`certificatePem`	—	The certificate for the key: PEM or a `Certificate`
`chainPem`	`[]`	Intermediate certificates to embed — a PEM bundle or a list
`digest`	by the key	SHA-256 for RSA and P-256, SHA-384 for P-384, SHA-512 for P-521
`transport`	PHP streams	Google and Azure: your HTTP client, proxy or retries through php-pdf's `HttpTransport`

Failures are KmsException with the HTTP $status and the service's $errorCode (AccessDeniedException, PERMISSION_DENIED, Forbidden…); the message explains the common ones — the missing permission or role, an unknown or disabled key, an expired token, a digest that does not match the key.

Requirements

PHP 8.2+ with ext-openssl and ext-json, and dskripchenko/php-pdf 1.19 or later (Composer installs it).
aws/aws-sdk-php for AwsKmsSigner only. Google Cloud KMS and Azure Key Vault need no SDK: their REST APIs are called through php-pdf's HTTP transport.
Outbound HTTPS to the service (and to the token endpoint).

How it was checked

AWS KMS — live against moto (an AWS emulator) in Docker: RSA-2048, RSA-3072, P-256 and P-384 keys created in the emulator, certificates issued for their public keys, PDFs signed and validated by php-pdf and poppler's pdfsig. CI runs it on every change; see docker/README.md. moto lacks MessageType: DIGEST, so the live run uses sendDigest: false; the DIGEST call is covered by unit tests against the SDK's mock handler.
Google Cloud KMS and Azure Key Vault have no emulators. The signers are tested against fakes of their REST APIs that sign with real keys — the request format, the response decoding (DER for Google, r ‖ s for Azure), the errors and the tokens — not against the live services.

The php-pdf family

Package	What it adds
php-pdf	The core: HTML with CSS or a builder to PDF, read, merge, fill forms, sign and validate.
laravel-php-pdf	Laravel bridge: a Blade view straight to PDF, `response()->pdf()`, signing from config.
php-pdf-fonts-liberation	Liberation Sans, Serif and Mono, metric-compatible with Arial, Times New Roman and Courier New (OFL, kept out of the MIT core).
php-pdf-cryptopro	Signs with a key in CryptoPro CSP on the server: GOST R 34.10-2012, Russian qualified signatures.
php-pdf-pkcs11	Signs with a key on an HSM, a smart card or a USB token, through PKCS#11.
php-pdf-cloud-kms (this package)	Signs with a key in AWS KMS, Google Cloud KMS or Azure Key Vault.

License

MIT — see LICENSE.

All versions of php-pdf-cloud-kms with dependencies

PHP Build Version

Package Version

Version v1.0.0 Release 18. Oct 2026
create-project require 0 people chose require and
0 people chose create-project.

Download

Download latest version of php-pdf-cloud-kms from vendor dskripchenko

Requires php Version ^8.2
ext-json Version *
ext-openssl Version *
dskripchenko/php-pdf Version ^1.19

Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package dskripchenko/php-pdf-cloud-kms contains the following files

Loading the files please wait ...