Download the PHP package ptrstovka/letsencrypt-php without Composer
On this page you can find all versions of the php package ptrstovka/letsencrypt-php. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download ptrstovka/letsencrypt-php
More information about ptrstovka/letsencrypt-php
Files in ptrstovka/letsencrypt-php
Package letsencrypt-php
Short Description ACME v2 client for Let's Encrypt
License MIT
Homepage https://github.com/ptrstovka/letsencrypt-php
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package letsencrypt-php
PHP Certificate Toolbox
This is a LetsEncrypt client library for ACME v2, which allows for the automated creation of free SSL/TLS certificates using PHP. This includes support for wildcard certificates supported by LetsEncrypt since Feb 2018.
While this includes a command line tool, the real intent of this library is to make it easy to integrate into existing PHP applications which need to issue certificates.
See the LetsEncrypt documentation for more information and documentation on LetsEncrypt and ACME.
Prerequisites
The minimum required PHP version is 7.1.0 due to the implementation of ECDSA.
This client also depends on OpenSSL.
Install
Via Composer
Usage
The basic functions and its necessary arguments are shown here. An extended description is included in each class.
It is advisable to cut the script some slack regarding execution time by setting a higher maximum time. There are several ways to do so. One it to add the following to the top of the page:
Initiating the client:
The client will automatically create a new account if there isn't one found. It will forward the e-mail address(es) supplied during initiation, as shown above.
Using the account functions:
Creating a certificate order instance. If there is an order found, stored locally, it will use this order. Otherwise, it will create a new order. If the supplied domain names don't match the order, a new order is created as well. The construction of the LetsEncrypt Order instance:
Using the order functions:
Supportive functions:
Authorization challenges
LetsEncrypt (ACME) performs authorizations on the domains you want to include on your
certificate, to verify you actually have access to the specific domain. Therefore, when
creating an order, an authorization is added for each domain. If a domain has recently
(in the last 30 days) been verified by your account, for example in another order, you
don't have to verify again. At this time, a domain can be verified by a HTTP request to
a file (http-01) or a DNS TXT record (dns-01). The client supplies the necessary data
for the chosen verification by the call to getPendingAuthorizations(). Since creating a
file or DNS record differs for every server, this is not implemented in the client.
After the user has fulfilled the challenge requirements, a call has to be made to
verifyPendingOrderAuthorization(). This client will first verify the challenge with
checkHTTPChallenge() or checkDNSChallenge() by itself, before it is starting the
verification by LetsEncrypt. Keep in mind, a wildcard domain can only be verified with
a DNS challenge. An example for both challenges is shown below.
HTTP challenge
For this example, we assume there is one domain left to verify.
This returns an array:
For a successful verification, a request will be made to the following URL:
The content of this file should be set to the content in the array above. The user should create this file before it can verify the authorization.
DNS challenge
For this example, we assume there are two domains left to verify. One is a wildcard domain. The second domain in this example is added for demonstration purposes. Adding a subdomain to the certificate which is also already covered by the wildcard domain is does not offer much added value.
This returns an array:
For a successful verification, DNS records should be created as follows:
| Name | TTL | Type | Value |
|---|---|---|---|
| _acme-challenge.example.org | 60 | TXT | FV5HgbpjIYe1x9MkPI81Nffo2oA-Jo2S88gCL7-Ky5P |
| _acme-challenge.test.example.org | 60 | TXT | WM5YIsgaZQv1b9DbRZ81EwCf2fi-Af2JlgxTC7-Up5D |
The TTL value can be set higher if wanted or necessary, I prefer to keep it as low as possible for this purpose. To make sure the verification is successful, it would be advised to run a script using DNS challenges in two parts, with a certain amount of time in between to allow for the DNS record to update. The user himself should make sure to set this DNS record before the record can be verified.
The DNS record name also depends on your provider, therefore getPendingAuthorizations() does
not give you a ready-to-use record name. Some providers only accept a name like _acme-challenge,
without the top domain name, for _acme-challenge.example.org. Some providers accept (require?)
a full name like shown above.
A wildcard domain, like `.example.org, will be verified asexample.org, as shown above. This means the DNS record name should be_acme-challenge.example.org`*
Full example
For both HTTP and DNS authorizations, a full example is available in the project's main code directory. The HTTP authorization example is contained in one file. As described above, the DNS authorization example is split into two parts, to allow for the DNS record to update in the meantime. While the TTL of the record might be low, it can sometimes take some time for your provider to update your DNS records after an amendment.
If you can't get these examples, or the client library to work, try and have a look at the LetsEncrypt documentation mentioned above as well.
Change log
Please see CHANGELOG for more information on what has changed recently.
Testing
Unit tests are executed as follows:
The test suite includes some integration tests with external dependencies, e.g. verifying that each supported DNS-over-HTTP service works as expected. The full test suite can be run with
Contributing
Please see CODE_OF_CONDUCT for details.
Security
Security is an important subject regarding SSL/TLS certificates, of course. Since this client is a PHP script, it is likely this code is running on a web server. It is obvious that your private key, stored on your web server, should never be accessible from the web.
When the client created the keys directory for the first time, it will store a .htaccess file in this directory, denying all visitors. Always make sure yourself your keys aren't accessible from the web! I am in no way responsible if your private keys go public. If this does happen, the easiest solution is to change your account keys (described above) or deactivate your account and create a new one. Next, create a new certificate.
If you discover any security related issues, please email [email protected] instead of using the issue tracker.
Credits
- [Paul Dixon][link-author] Refactoring inc unit tests and storage interface
- [Youri van Weegberg][link-author2] Original PHP ACME2 client on which this is based
-
[wutno][link-author3] DNS-over-HTTPS support
- All Contributors
License
The MIT License (MIT). Please see License File for more information.
Dvelopers
This is bare clone of fork developed by Paul Dixon.
