Download the PHP package socylist/acmecert without Composer
On this page you can find all versions of the php package socylist/acmecert. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download socylist/acmecert
More information about socylist/acmecert
Files in socylist/acmecert
Package acmecert
Short Description PHP client library for Let's Encrypt (ACME v2 - RFC 8555)
License MIT
Informations about the package acmecert
ACMECert
PHP client library for Let's Encrypt (ACME v2 - RFC 8555)
Version: 2.8
Description
ACMECert is designed to help you to setup an automated SSL/TLS-certificate/renewal process with a few lines of PHP.
It is self contained and contains a set of functions allowing you to:
- generate EC (Elliptic Curve) keys
- manage account: account key roll-over
- revoke certificates (to renew a certificate just get a new one)
- remaining days a certificate is still valid
see Function Reference for a full list
It abstacts away the complexity of the ACME protocol to get a certificate (create order, fetch authorizations, compute challenge tokens, polling for status, generate CSR, finalize order, request certificate) into a single function getCertificateChain, where you specify a set of domains you want to get a certificate for and which challenge type to use (all challenge types are supported). This function takes as third argument a user-defined callback function which gets invoked every time a challenge needs to be fulfilled. It is up to you to set/remove the challenge tokens:
see description of getCertificateChain for details about the callback function.
also see the Get Certificate examples below.
Instead of returning FALSE
on error, every function in ACMECert throws an Exception
if it fails or an ACME_Exception if the ACME-Server reponded with an error message.
Requirements
- [x] PHP 5.3 or higher (for EC keys PHP 7.1 or higher is required)
- [x] OpenSSL extension
- [x] enabled fopen wrappers (allow_url_fopen=1) or cURL extension
Usage Examples
Require ACMECert
Choose Live or Staging Environment
Live
Staging
Generate RSA Private Key
Equivalent to:
openssl genrsa -out account_key.pem 2048
Generate EC Private Key
Equivalent to:
openssl ecparam -name secp384r1 -genkey -noout -out account_key.pem
Register Account Key with Let's Encrypt
WARNING: By passing TRUE as first parameter of the register function you agree to the terms of service of Let's Encrypt. See Let’s Encrypt Subscriber Agreement for more information.
Get Account Information
Account Key Roll-over
Deactivate Account
Revoke Certificate
Get Remaining Days
This allows you to run your renewal script without the need to time it exactly, just run it often enough. (cronjob)
Get Certificate using http-01
challenge
Get Certificate using all (http-01
,dns-01
and tls-alpn-01
) challenge types together
Logging
ACMECert logs its actions using error_log
, which logs messages to stderr per default in PHP CLI so it is easy to log to a file instead:
ACME_Exception
If the ACME-Server responded with an error message an ACME_Exception
is thrown. (ACME_Exception extends Exception)
ACME_Exception
has two additional functions:
-
getType()
to get the ACME error code: getSubproblems()
to get an array ofACME_Exception
s if there is more than one error returned from the ACME-Server:
Function Reference
ACMECert::__construct
Creates a new ACMECert instance.
Parameters
live
When FALSE, the ACME v2 staging environment is used otherwise the live environment.
Return Values
Returns a new ACMECert instance.
ACMECert::generateRSAKey
Generate RSA private key (used as account key or private key for a certificate).
Parameters
bits
RSA key size in bits.
Return Values
Returns the generated RSA private key as PEM encoded string.
Errors/Exceptions
Throws an
Exception
if the RSA key could not be generated.
ACMECert::generateECKey
Generate Elliptic Curve (EC) private key (used as account key or private key for a certificate).
Parameters
curve_name
Supported Curves by Let’s Encrypt:
P-256
(prime256v1)P-384
(secp384r1)P-521
(secp521r1)
Return Values
Returns the generated EC private key as PEM encoded string.
Errors/Exceptions
Throws an
Exception
if the EC key could not be generated.
ACMECert::loadAccountKey
Load account key.
Parameters
account_key_pem
can be one of the following:
- a string containing a PEM formatted private key.
- a string beginning with
file://
containing the filename to read a PEM formatted private key from.Return Values
No value is returned.
Errors/Exceptions
Throws an
Exception
if the account key could not be loaded.
ACMECert::register
Associate the loaded account key with a Let's Encrypt account and optionally specify contacts.
Parameters
termsOfServiceAgreed
WARNING: By passing
TRUE
, you agree to the terms of service of Let's Encrypt. See Let’s Encrypt Subscriber Agreement for more information.Must be set to TRUE in order to successully register an account.
contacts
can be one of the following:
- A string containing an e-mail address
- Array of e-mail adresses
Return Values
Returns an array containing the account information.
Errors/Exceptions
Throws an
ACME_Exception
if the server responded with an error message or anException
if an other registration error occured.
ACMECert::update
Update account contacts.
Parameters
contacts
can be one of the following:
- A string containing an e-mail address
- Array of e-mail adresses
Return Values
Returns an array containing the account information.
Errors/Exceptions
Throws an
ACME_Exception
if the server responded with an error message or anException
if an other error occured updating the account.
ACMECert::getAccount
Get Account Information.
Return Values
Returns an array containing the account information.
Errors/Exceptions
Throws an
ACME_Exception
if the server responded with an error message or anException
if an other error occured getting the account information.
ACMECert::getAccountID
Get Account ID.
Return Values
Returns the Account ID
Errors/Exceptions
Throws an
ACME_Exception
if the server responded with an error message or anException
if an other error occured getting the account id.
ACMECert::keyChange
Account Key Roll-over (exchange the current account key with another one).
If the Account Key Roll-over succeeded, the new account key is automatically loaded via
loadAccountKey
Parameters
new_account_key_pem
can be one of the following:
- a string containing a PEM formatted private key.
- a string beginning with
file://
containing the filename to read a PEM formatted private key from.Return Values
Returns an array containing the account information.
Errors/Exceptions
Throws an
ACME_Exception
if the server responded with an error message or anException
if an other error occured during key change.
ACMECert::deactivateAccount
Deactivate account.
Return Values
Returns an array containing the account information.
Errors/Exceptions
Throws an
ACME_Exception
if the server responded with an error message or anException
if an other error occured during account deactivation.
ACMECert::getCertificateChain
Get certificate-chain (certificate + the intermediate certificate).
This is what Apache >= 2.4.8 needs for SSLCertificateFile
, and what Nginx needs for ssl_certificate
.
Parameters
pem
A Private Key used for the certificate (the needed CSR is generated automatically using the given key in this case) or an already existing CSR in one of the following formats:
- a string containing a PEM formatted private key.
- a string beginning with
file://
containing the filename to read a PEM encoded private key from.
or- a string beginning with
file://
containing the filename to read a PEM encoded CSR from.- a string containing the content of a CSR, PEM encoded, may start with
-----BEGIN CERTIFICATE REQUEST-----
domain_config
An Array defining the domains and the corresponding challenge types to get a certificate for (up to 100 domains per certificate).
The first one is used as
Common Name
for the certificate.Here is an example structure:
Hint: Wildcard certificates (
*.example.com
) are only supported with thedns-01
challenge type.
challenge
is mandatory and has to be one ofhttp-01
,dns-01
ortls-alpn-01
. All other keys are optional and up to you to be used and are later available in the callback function as$opts['config']
(see the http-01 example wheredocroot
is used this way)
callback
Callback function which gets invoked every time a challenge needs to be fulfilled.
Inside a callback function you can return another callback function, which gets invoked after the verification completed and the challenge tokens can be removed again.
Hint: To get access to variables of the parent scope inside the callback function use the
use
languange construct:Parameters
opts
$opts['domain']
Domain name to be validated.
$opts['config']
Corresponding element of the
domain_config
array.
$opts['key']
and$opts['value']
Contain the following, depending on the chosen challenge type:
Challenge Type $opts['key']
$opts['value']
http-01 path + filename file contents dns-01 TXT Resource Record Name TXT Resource Record Value tls-alpn-01 unused token used in the acmeIdentifier extension of the verification certificate; use tls-alpn-01 example)
authz_reuse
(default:TRUE
)If
FALSE
the callback function is always called for each domain and does not get skipped due to possibly already valid authorizations (authz) that are reused. This is achieved by deactivating already valid authorizations before getting new ones.Hint: Under normal circumstances this is only needed when testing the callback function, not in production!
Return Values
Returns a PEM encoded certificate chain.
Errors/Exceptions
Throws an
ACME_Exception
if the server responded with an error message or anException
if an other error occured obtaining the certificate.
ACMECert::revoke
Revoke certificate.
Parameters
pem
can be one of the following:
- a string beginning with
file://
containing the filename to read a PEM encoded certificate or certificate-chain from.- a string containing the content of a certificate or certificate-chain, PEM encoded, may start with
-----BEGIN CERTIFICATE-----
Return Values
No value is returned.
If the function completes without Exception, the certificate was successully revoked.
Errors/Exceptions
Throws an
ACME_Exception
if the server responded with an error message or anException
if an other error occured revoking the certificate.
ACMECert::generateCSR
Generate CSR for a set of domains.
Parameters
private_key
can be one of the following:
- a string containing a PEM formatted private key.
- a string beginning with
file://
containing the filename to read a PEM formatted private key from.
domains
Array of domains
Return Values
Returns the generated CSR as string.
Errors/Exceptions
Throws an
Exception
if the CSR could not be generated.
ACMECert::generateALPNCertificate
Generate a self signed verification certificate containing the acmeIdentifier extension used in tls-alpn-01
challenge.
Parameters
private_key
private key used for the certificate.
can be one of the following:
- a string containing a PEM formatted private key.
- a string beginning with
file://
containing the filename to read a PEM formatted private key from.
domain
domain name to be validated.
token
verification token.
Return Values
Returns a PEM encoded verification certificate.
Errors/Exceptions
Throws an
Exception
if the certificate could not be generated.
ACMECert::parseCertificate
Get information about a certificate.
Parameters
pem
can be one of the following:
- a string beginning with
file://
containing the filename to read a PEM encoded certificate or certificate-chain from.- a string containing the content of a certificate or certificate-chain, PEM encoded, may start with
-----BEGIN CERTIFICATE-----
Return Values
Returns an array containing information about the certificate.
Errors/Exceptions
Throws an
Exception
if the certificate could not be parsed.
ACMECert::getRemainingDays
Get the number of days the certificate is still valid.
Parameters
pem
can be one of the following:
- a string beginning with
file://
containing the filename to read a PEM encoded certificate or certificate-chain from.- a string containing the content of a certificate or certificate-chain, PEM encoded, may start with
-----BEGIN CERTIFICATE-----
Return Values
Returns how many days the certificate is still valid.
Errors/Exceptions
Throws an
Exception
if the certificate could not be parsed.
MIT License
Copyright (c) 2018 Stefan Körfgen
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
All versions of acmecert with dependencies
ext-openssl Version *