Download the PHP package goletter/hyperf-mtls without Composer
On this page you can find all versions of the php package goletter/hyperf-mtls. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package hyperf-mtls
Goletter Hyperf mTLS
Hyperf command package for generating local mTLS certificates.
Commands
Generate a local root CA:
Generate a client certificate and PKCS#12 installer files:
Generate different client certificates for different users by changing --user:
When a client certificate is generated, its metadata is stored in the client_certificates table.
Output
By default, files are written under runtime/certs and grouped by certificate role.
Use the generated .p12 file on macOS Keychain Access and the generated .pfx file on Windows Certificate Manager. Install ca.crt as a trusted root certificate when the client machine needs to trust certificates signed by this local CA.
PKCS#12 files are exported with legacy 3DES + SHA-1 so macOS Keychain can import them. OpenSSL 3's default AES-256 + SHA-256 often fails on Mac with MAC verification failed (wrong password?) even when the password is correct.
If you already have a modern .p12 that Mac rejects, convert it:
Use a public CA certificate, such as Let's Encrypt or a cloud provider SSL certificate, for the server side of HTTPS. This package only generates the private CA and client certificates used for mTLS client authentication.
Middleware
Register Goletter\Mtls\Middleware\ClientCertificateMiddleware::class in the Hyperf HTTP middleware stack, then enable verification:
The middleware expects Nginx to verify the client certificate first and pass the result to Hyperf:
Optional allow lists:
When MTLS_CHECK_DATABASE=true, the middleware also checks client_certificates:
Set status=revoked to revoke a client certificate. The next request with that certificate will return 403.
When the certificate passes, the middleware adds these request attributes:
Admin Download API
The project can expose an admin API that generates a client certificate and returns the installer file as a download:
Supported request fields:
The generated files are stored under runtime/certs/clients/{user} and the selected p12 or pfx file is returned as an attachment.
The generated certificate metadata is also stored in client_certificates, including:
Run the migration before using the command or admin API:
Configuration
Publish or copy publish/mtls.php to config/autoload/mtls.php.
Supported environment variables:
Private keys are written with 0600 permissions. Keep generated private keys and PKCS#12 files out of version control.
All versions of hyperf-mtls with dependencies
ext-openssl Version *
hyperf/command Version ~3.1.0
hyperf/config Version ~3.1.0
hyperf/contract Version ~3.1.0
hyperf/di Version ~3.1.0
hyperf/http-server Version ~3.1.0