GEANT /
CAT
| Total Complexity | 74 |
| Total Lines | 759 |
| Duplicated Lines | 0 % |
| Changes | 0 | ||
Complex classes like SilverbulletCertificate often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use SilverbulletCertificate, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 36 | class SilverbulletCertificate extends EntityWithDBProperties { |
||
| 37 | |||
| 38 | public $username; |
||
| 39 | public $expiry; |
||
| 40 | public $serial; |
||
| 41 | public $dbId; |
||
| 42 | public $invitationId; |
||
| 43 | public $userId; |
||
| 44 | public $profileId; |
||
| 45 | public $issued; |
||
| 46 | public $device; |
||
| 47 | public $revocationStatus; |
||
| 48 | public $revocationTime; |
||
| 49 | public $ocsp; |
||
| 50 | public $ocspTimestamp; |
||
| 51 | public $status; |
||
| 52 | public $ca_type; |
||
| 53 | |||
| 54 | const CERTSTATUS_VALID = 1; |
||
| 55 | const CERTSTATUS_EXPIRED = 2; |
||
| 56 | const CERTSTATUS_REVOKED = 3; |
||
| 57 | const CERTSTATUS_INVALID = 4; |
||
| 58 | |||
| 59 | /** |
||
| 60 | * instantiates an existing certificate, identified either by its serial |
||
| 61 | * number or the username. |
||
| 62 | * |
||
| 63 | * Use static issueCertificate() to generate a whole new cert. |
||
| 64 | * |
||
| 65 | * @param int|string $identifier identify certificate either by CN or by serial |
||
| 66 | * @param string $certtype RSA or ECDSA? |
||
| 67 | */ |
||
| 68 | public function __construct($identifier, $certtype) { |
||
| 117 | } |
||
| 118 | } |
||
| 119 | } |
||
| 120 | |||
| 121 | /** |
||
| 122 | * retrieve basic information about the certificate |
||
| 123 | * |
||
| 124 | * @return array of basic certificate details |
||
| 125 | */ |
||
| 126 | public function getBasicInfo() { |
||
| 127 | $returnArray = []; // unnecessary because the iterator below is never empty, but Scrutinizer gets excited nontheless |
||
| 128 | foreach (['status', 'serial', 'username', 'issued', 'expiry', 'ca_type'] as $key) { |
||
| 129 | $returnArray[$key] = $this->$key; |
||
| 130 | } |
||
| 131 | $returnArray['device'] = \devices\Devices::listDevices()[$this->device]['display'] ?? $this->device; |
||
| 132 | return $returnArray; |
||
| 133 | } |
||
| 134 | |||
| 135 | /** |
||
| 136 | * we don't use caching in SB, so this function does nothing |
||
| 137 | * |
||
| 138 | * @return void |
||
| 139 | */ |
||
| 140 | public function updateFreshness() { |
||
| 141 | // nothing to be done here. |
||
| 142 | } |
||
| 143 | |||
| 144 | /** |
||
| 145 | * issue a certificate based on a token |
||
| 146 | * |
||
| 147 | * @param string $token the token string |
||
| 148 | * @param string $importPassword the PIN |
||
| 149 | * @param string $certtype is this for the RSA or ECDSA CA? |
||
| 150 | * @return array |
||
| 151 | */ |
||
| 152 | public static function issueCertificate($token, $importPassword, $certtype) { |
||
| 153 | $loggerInstance = new common\Logging(); |
||
| 154 | $databaseHandle = DBConnection::handle("INST"); |
||
| 155 | $loggerInstance->debug(5, "generateCertificate() - starting.\n"); |
||
| 156 | $invitationObject = new SilverbulletInvitation($token); |
||
| 157 | $profile = new ProfileSilverbullet($invitationObject->profile); |
||
| 158 | $inst = new IdP($profile->institution); |
||
| 159 | $loggerInstance->debug(5, "tokenStatus: done, got " . $invitationObject->invitationTokenStatus . ", " . $invitationObject->profile . ", " . $invitationObject->userId . ", " . $invitationObject->expiry . ", " . $invitationObject->invitationTokenString . "\n"); |
||
| 160 | if ($invitationObject->invitationTokenStatus != SilverbulletInvitation::SB_TOKENSTATUS_VALID && $invitationObject->invitationTokenStatus != SilverbulletInvitation::SB_TOKENSTATUS_PARTIALLY_REDEEMED) { |
||
| 161 | throw new Exception("Attempt to generate a SilverBullet installer with an invalid/redeemed/expired token. The user should never have gotten that far!"); |
||
| 162 | } |
||
| 163 | |||
| 164 | // SQL query to find the expiry date of the *user* to find the correct ValidUntil for the cert |
||
| 165 | $user = $invitationObject->userId; |
||
| 166 | $userrow = $databaseHandle->exec("SELECT expiry FROM silverbullet_user WHERE id = ?", "i", $user); |
||
| 167 | // SELECT -> resource, not boolean |
||
| 168 | if ($userrow->num_rows != 1) { |
||
| 169 | throw new Exception("Despite a valid token, the corresponding user was not found in database or database query error!"); |
||
| 170 | } |
||
| 171 | $expiryObject = mysqli_fetch_object(/** @scrutinizer ignore-type */ $userrow); |
||
| 172 | $loggerInstance->debug(5, "EXP: " . $expiryObject->expiry . "\n"); |
||
| 173 | $expiryDateObject = date_create_from_format("Y-m-d H:i:s", $expiryObject->expiry); |
||
| 174 | if ($expiryDateObject === FALSE) { |
||
| 175 | throw new Exception("The expiry date we got from the DB is bogus!"); |
||
| 176 | } |
||
| 177 | $loggerInstance->debug(5, $expiryDateObject->format("Y-m-d H:i:s") . "\n"); |
||
| 178 | // date_create with no parameters can't fail, i.e. is never FALSE |
||
| 179 | $validity = date_diff(/** @scrutinizer ignore-type */ date_create(), $expiryDateObject); |
||
| 180 | $expiryDays = $validity->days + 1; |
||
| 181 | if ($validity->invert == 1) { // negative! That should not be possible |
||
| 182 | throw new Exception("Attempt to generate a certificate for a user which is already expired!"); |
||
| 183 | } |
||
| 184 | switch ($certtype) { |
||
| 185 | case \devices\Devices::SUPPORT_RSA: |
||
| 186 | $privateKey = openssl_pkey_new(['private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA, 'encrypt_key' => FALSE]); |
||
| 187 | break; |
||
| 188 | case \devices\Devices::SUPPORT_ECDSA: |
||
| 189 | $privateKey = openssl_pkey_new(['curve_name' => 'secp384r1', 'private_key_type' => OPENSSL_KEYTYPE_EC, 'encrypt_key' => FALSE]); |
||
| 190 | break; |
||
| 191 | default: |
||
| 192 | throw new Exception("Unknown certificate type!"); |
||
| 193 | } |
||
| 194 | |||
| 195 | $csr = SilverbulletCertificate::generateCsr($privateKey, strtoupper($inst->federation), $profile->getAttributes("internal:realm")[0]['value'], $certtype); |
||
| 196 | |||
| 197 | $loggerInstance->debug(5, "generateCertificate: proceeding to sign cert.\n"); |
||
| 198 | |||
| 199 | $certMeta = SilverbulletCertificate::signCsr($csr["CSR"], $expiryDays, $certtype); |
||
| 200 | $cert = $certMeta["CERT"]; |
||
| 201 | $issuingCaPem = $certMeta["ISSUER"]; |
||
| 202 | $rootCaPem = $certMeta["ROOT"]; |
||
| 203 | $serial = $certMeta["SERIAL"]; |
||
| 204 | |||
| 205 | if ($cert === FALSE) { |
||
| 206 | throw new Exception("The CA did not generate a certificate."); |
||
| 207 | } |
||
| 208 | $loggerInstance->debug(5, "generateCertificate: post-processing certificate.\n"); |
||
| 209 | |||
| 210 | // with the cert, our private key and import password, make a PKCS#12 container out of it |
||
| 211 | $exportedCertProt = ""; |
||
| 212 | openssl_pkcs12_export($cert, $exportedCertProt, $privateKey, $importPassword, ['extracerts' => [$issuingCaPem /* , $rootCaPem */]]); |
||
| 213 | // and without intermediate, to keep EAP conversation short where possible |
||
| 214 | $exportedNoInterm = ""; |
||
| 215 | openssl_pkcs12_export($cert, $exportedNoInterm, $privateKey, $importPassword, []); |
||
| 216 | $exportedCertClear = ""; |
||
| 217 | openssl_pkcs12_export($cert, $exportedCertClear, $privateKey, "", ['extracerts' => [$issuingCaPem, $rootCaPem]]); |
||
| 218 | // store resulting cert CN and expiry date in separate columns into DB - do not store the cert data itself as it contains the private key! |
||
| 219 | // we need the *real* expiry date, not just the day-approximation |
||
| 220 | $x509 = new \core\common\X509(); |
||
| 221 | $certString = ""; |
||
| 222 | openssl_x509_export($cert, $certString); |
||
| 223 | $parsedCert = $x509->processCertificate($certString); |
||
| 224 | $loggerInstance->debug(5, "CERTINFO: " . print_r($parsedCert['full_details'], true)); |
||
| 225 | $realExpiryDate = date_create_from_format("U", $parsedCert['full_details']['validTo_time_t'])->format("Y-m-d H:i:s"); |
||
| 226 | |||
| 227 | // store new cert info in DB |
||
| 228 | $databaseHandle->exec("INSERT INTO `silverbullet_certificate` (`profile_id`, `silverbullet_user_id`, `silverbullet_invitation_id`, `serial_number`, `cn` ,`expiry`, `ca_type`) VALUES (?, ?, ?, ?, ?, ?, ?)", "iiissss", $invitationObject->profile, $invitationObject->userId, $invitationObject->identifier, $serial, $csr["USERNAME"], $realExpiryDate, $certtype); |
||
| 229 | // newborn cert immediately gets its "valid" OCSP response |
||
| 230 | $certObject = new SilverbulletCertificate($serial, $certtype); |
||
| 231 | $certObject->triggerNewOCSPStatement(); |
||
| 232 | // return PKCS#12 data stream |
||
| 233 | return [ |
||
| 234 | "certObject" => $certObject, |
||
| 235 | "certdata" => $exportedCertProt, |
||
| 236 | "certdata_nointermediate" => $exportedNoInterm, |
||
| 237 | "certdataclear" => $exportedCertClear, |
||
| 238 | // Scrutinizer thinks this needs to be a string, but a resource is just fine |
||
| 239 | "sha1" => openssl_x509_fingerprint(/** @scrutinizer ignore-type */$cert, "sha1"), |
||
| 240 | "sha256" => openssl_x509_fingerprint(/** @scrutinizer ignore-type */$cert, "sha256"), |
||
| 241 | 'importPassword' => $importPassword, |
||
| 242 | 'GUID' => common\Entity::uuid("", $exportedCertProt), |
||
| 243 | ]; |
||
| 244 | } |
||
| 245 | |||
| 246 | /** |
||
| 247 | * triggers a new OCSP statement for the given serial number |
||
| 248 | * |
||
| 249 | * @return string DER-encoded OCSP status info (binary data!) |
||
| 250 | */ |
||
| 251 | public function triggerNewOCSPStatement() { |
||
| 252 | $logHandle = new \core\common\Logging(); |
||
| 253 | $logHandle->debug(2, "Triggering new OCSP statement for serial $this->serial.\n"); |
||
| 254 | switch (CONFIG_CONFASSISTANT['SILVERBULLET']['CA']['type']) { |
||
| 255 | case "embedded": |
||
| 256 | $certstatus = ""; |
||
| 257 | // get all relevant info from object properties |
||
| 258 | if ($this->serial >= 0) { // let's start with the assumption that the cert is valid |
||
| 259 | if ($this->revocationStatus == "REVOKED") { |
||
| 260 | // already revoked, simply return canned OCSP response |
||
| 261 | $certstatus = "R"; |
||
| 262 | } else { |
||
| 263 | $certstatus = "V"; |
||
| 264 | } |
||
| 265 | } |
||
| 266 | |||
| 267 | $originalExpiry = date_create_from_format("Y-m-d H:i:s", $this->expiry); |
||
| 268 | if ($originalExpiry === FALSE) { |
||
| 269 | throw new Exception("Unable to calculate original expiry date, input data bogus!"); |
||
| 270 | } |
||
| 271 | $validity = date_diff(/** @scrutinizer ignore-type */ date_create(), $originalExpiry); |
||
| 272 | if ($validity->invert == 1) { |
||
| 273 | // negative! Cert is already expired, no need to revoke. |
||
| 274 | // No need to return anything really, but do return the last known OCSP statement to prevent special case |
||
| 275 | $certstatus = "E"; |
||
| 276 | } |
||
| 277 | $profile = new ProfileSilverbullet($this->profileId); |
||
| 278 | $inst = new IdP($profile->institution); |
||
| 279 | $federation = strtoupper($inst->federation); |
||
| 280 | // generate stub index.txt file |
||
| 281 | $tempdirArray = \core\common\Entity::createTemporaryDirectory("test"); |
||
| 282 | $tempdir = $tempdirArray['dir']; |
||
| 283 | $nowIndexTxt = (new \DateTime())->format("ymdHis") . "Z"; |
||
| 284 | $expiryIndexTxt = $originalExpiry->format("ymdHis") . "Z"; |
||
| 285 | $serialHex = strtoupper(dechex($this->serial)); |
||
| 286 | if (strlen($serialHex) % 2 == 1) { |
||
| 287 | $serialHex = "0" . $serialHex; |
||
| 288 | } |
||
| 289 | |||
| 290 | $indexStatement = "$certstatus\t$expiryIndexTxt\t" . ($certstatus == "R" ? "$nowIndexTxt,unspecified" : "") . "\t$serialHex\tunknown\t/O=" . CONFIG_CONFASSISTANT['CONSORTIUM']['name'] . "/OU=$federation/CN=$this->username\n"; |
||
| 291 | $logHandle->debug(4, "index.txt contents-to-be: $indexStatement"); |
||
| 292 | if (!file_put_contents($tempdir . "/index.txt", $indexStatement)) { |
||
| 293 | $logHandle->debug(1, "Unable to write openssl index.txt file for revocation handling!"); |
||
| 294 | } |
||
| 295 | // index.txt.attr is dull but needs to exist |
||
| 296 | file_put_contents($tempdir . "/index.txt.attr", "unique_subject = yes\n"); |
||
| 297 | // call "openssl ocsp" to manufacture our own OCSP statement |
||
| 298 | // adding "-rmd sha1" to the following command-line makes the |
||
| 299 | // choice of signature algorithm for the response explicit |
||
| 300 | // but it's only available from openssl-1.1.0 (which we do not |
||
| 301 | // want to require just for that one thing). |
||
| 302 | $execCmd = CONFIG['PATHS']['openssl'] . " ocsp -issuer " . ROOT . "/config/SilverbulletClientCerts/real-" . $this->ca_type . ".pem -sha1 -ndays 10 -no_nonce -serial 0x$serialHex -CA " . ROOT . "/config/SilverbulletClientCerts/real-" . $this->ca_type . ".pem -rsigner " . ROOT . "/config/SilverbulletClientCerts/real-" . $this->ca_type . ".pem -rkey " . ROOT . "/config/SilverbulletClientCerts/real-" . $this->ca_type . ".key -index $tempdir/index.txt -no_cert_verify -respout $tempdir/$serialHex.response.der"; |
||
| 303 | $logHandle->debug(2, "Calling openssl ocsp with following cmdline: $execCmd\n"); |
||
| 304 | $output = []; |
||
| 305 | $return = 999; |
||
| 306 | exec($execCmd, $output, $return); |
||
| 307 | if ($return !== 0) { |
||
| 308 | throw new Exception("Non-zero return value from openssl ocsp!"); |
||
| 309 | } |
||
| 310 | $ocsp = file_get_contents($tempdir . "/$serialHex.response.der"); |
||
| 311 | // remove the temp dir! |
||
| 312 | unlink($tempdir . "/$serialHex.response.der"); |
||
| 313 | unlink($tempdir . "/index.txt.attr"); |
||
| 314 | unlink($tempdir . "/index.txt"); |
||
| 315 | rmdir($tempdir); |
||
| 316 | break; |
||
| 317 | case "eduPKI": |
||
| 318 | // nothing to be done here - eduPKI have their own OCSP responder |
||
| 319 | // and the certs point to it. So we are not in the loop. |
||
| 320 | break; |
||
| 321 | default: |
||
| 322 | /* HTTP POST the serial to the CA. The CA knows about the state of |
||
| 323 | * the certificate. |
||
| 324 | * |
||
| 325 | * $httpResponse = httpRequest("https://clientca.hosted.eduroam.org/ocsp/", ["serial" => $serial ] ); |
||
| 326 | * |
||
| 327 | * The result of this if clause has to be a DER-encoded OCSP statement |
||
| 328 | * to be stored in the variable $ocsp |
||
| 329 | */ |
||
| 330 | throw new Exception("This type of silverbullet CA is not implemented yet!"); |
||
| 331 | } |
||
| 332 | // write the new statement into DB |
||
| 333 | $this->databaseHandle->exec("UPDATE silverbullet_certificate SET OCSP = ?, OCSP_timestamp = NOW() WHERE serial_number = ?", "si", $ocsp, $this->serial); |
||
| 334 | return $ocsp; |
||
| 335 | } |
||
| 336 | |||
| 337 | /** |
||
| 338 | * revokes a certificate |
||
| 339 | * |
||
| 340 | * @return void |
||
| 341 | * @throws Exception |
||
| 342 | */ |
||
| 343 | public function revokeCertificate() { |
||
| 344 | $nowSql = (new \DateTime())->format("Y-m-d H:i:s"); |
||
| 345 | // regardless if embedded or not, always keep local state in our own DB |
||
| 346 | $this->databaseHandle->exec("UPDATE silverbullet_certificate SET revocation_status = 'REVOKED', revocation_time = ? WHERE serial_number = ? AND ca_type = ?", "sis", $nowSql, $this->serial, $this->ca_type); |
||
| 347 | $this->loggerInstance->debug(2, "Certificate revocation status for $this->serial updated, about to call triggerNewOCSPStatement().\n"); |
||
| 348 | // newly instantiate us, DB content has changed... |
||
| 349 | $certObject = new SilverbulletCertificate((string) $this->serial, $this->ca_type); |
||
| 350 | // embedded CA does "nothing special" for revocation: the DB change was the entire thing to do |
||
| 351 | // but for external CAs, we need to notify explicitly that the cert is now revoked |
||
| 352 | switch (CONFIG_CONFASSISTANT['SILVERBULLET']['CA']['type']) { |
||
| 353 | case "embedded": |
||
| 354 | $certObject->triggerNewOCSPStatement(); |
||
| 355 | break; |
||
| 356 | case "eduPKI": |
||
| 357 | try { |
||
| 358 | $soap = SilverbulletCertificate::initEduPKISoapSession("RA"); |
||
| 359 | $soapRevocationSerial = $soap->newRevocationRequest(["Serial", $certObject->serial], ""); |
||
| 360 | if ($soapRevocationSerial == 0) { |
||
| 361 | throw new Exception("Unable to create revocation request, serial number was zero."); |
||
| 362 | } |
||
| 363 | // retrieve the raw request to prepare for signature and approval |
||
| 364 | $soapRawRevRequest = $soap->getRawRevocationRequest($soapRevocationSerial); |
||
| 365 | if (strlen($soapRawRevRequest) < 10) { // very basic error handling |
||
| 366 | throw new Exception("Suspiciously short data to sign!"); |
||
| 367 | } |
||
| 368 | // for obnoxious reasons, we have to dump the request into a file and let pkcs7_sign read from the file |
||
| 369 | // rather than just using the string. Grr. |
||
| 370 | $tempdir = \core\common\Entity::createTemporaryDirectory("test"); |
||
| 371 | file_put_contents($tempdir['dir'] . "/content.txt", $soapRawRevRequest); |
||
| 372 | // retrieve our RA cert from filesystem |
||
| 373 | // sign the data, using cmdline because openssl_pkcs7_sign produces strange results |
||
| 374 | // -binary didn't help, nor switch -md to sha1 sha256 or sha512 |
||
| 375 | $this->loggerInstance->debug(5, "Actual content to be signed is this:\n$soapRawRevRequest\n"); |
||
| 376 | $execCmd = CONFIG['PATHS']['openssl'] . " smime -sign -binary -in " . $tempdir['dir'] . "/content.txt -out " . $tempdir['dir'] . "/signature.txt -outform pem -inkey " . ROOT . "/config/SilverbulletClientCerts/edupki-test-ra.clearkey -signer " . ROOT . "/config/SilverbulletClientCerts/edupki-test-ra.pem"; |
||
| 377 | $this->loggerInstance->debug(2, "Calling openssl smime with following cmdline: $execCmd\n"); |
||
| 378 | $output = []; |
||
| 379 | $return = 999; |
||
| 380 | exec($execCmd, $output, $return); |
||
| 381 | if ($return !== 0) { |
||
| 382 | throw new Exception("Non-zero return value from openssl smime!"); |
||
| 383 | } |
||
| 384 | // and get the signature blob back from the filesystem |
||
| 385 | $detachedSig = trim(file_get_contents($tempdir['dir'] . "/signature.txt")); |
||
| 386 | $soapIssueRev = $soap->approveRevocationRequest($soapRevocationSerial, $soapRawRevRequest, $detachedSig); |
||
| 387 | if ($soapIssueRev === FALSE) { |
||
| 388 | throw new Exception("The locally approved revocation request was NOT processed by the CA."); |
||
| 389 | } |
||
| 390 | } catch (Exception $e) { |
||
| 391 | // PHP 7.1 can do this much better |
||
| 392 | if (is_soap_fault($e)) { |
||
| 393 | throw new Exception("Error when sending SOAP request: " . "{$e->faultcode}: {$e->faultstring}\n"); |
||
| 394 | } |
||
| 395 | throw new Exception("Something odd happened while doing the SOAP request:" . $e->getMessage()); |
||
| 396 | } |
||
| 397 | break; |
||
| 398 | default: |
||
| 399 | throw new Exception("Unknown type of CA requested!"); |
||
| 400 | } |
||
| 401 | } |
||
| 402 | |||
| 403 | /** |
||
| 404 | * create a CSR |
||
| 405 | * |
||
| 406 | * @param resource $privateKey the private key to create the CSR with |
||
| 407 | * @param string $fed the federation to which the certificate belongs |
||
| 408 | * @param string $realm the realm for the future username |
||
| 409 | * @param string $certtype which type of certificate to generate: RSA or ECDSA |
||
| 410 | * @return array with the CSR and some meta info |
||
| 411 | */ |
||
| 412 | private static function generateCsr($privateKey, $fed, $realm, $certtype) { |
||
| 484 | ]; |
||
| 485 | } |
||
| 486 | |||
| 487 | /** |
||
| 488 | * a function that converts integers beyond PHP_INT_MAX to strings for |
||
| 489 | * sending in XML messages |
||
| 490 | * |
||
| 491 | * taken and adapted from |
||
| 492 | * https://www.uni-muenster.de/WWUCA/de/howto-special-phpsoap.html |
||
| 493 | * |
||
| 494 | * @param string $x the integer as an XML fragment |
||
| 495 | * @return array the integer in array notation |
||
| 496 | */ |
||
| 497 | public static function soapFromXmlInteger($x) { |
||
| 498 | $y = simplexml_load_string($x); |
||
| 499 | return array( |
||
| 500 | $y->getName(), |
||
| 501 | $y->__toString() |
||
| 502 | ); |
||
| 503 | } |
||
| 504 | |||
| 505 | /** |
||
| 506 | * a function that converts integers beyond PHP_INT_MAX to strings for |
||
| 507 | * sending in XML messages |
||
| 508 | * |
||
| 509 | * @param array $x the integer in array notation |
||
| 510 | * @return string the integer as string in an XML fragment |
||
| 511 | */ |
||
| 512 | public static function soapToXmlInteger($x) { |
||
| 513 | return '<' . $x[0] . '>' |
||
| 514 | . htmlentities($x[1], ENT_NOQUOTES | ENT_XML1) |
||
| 515 | . '</' . $x[0] . '>'; |
||
| 516 | } |
||
| 517 | |||
| 518 | /** |
||
| 519 | * sets up a connection to the eduPKI SOAP interfaces |
||
| 520 | * There is a public interface and an RA-restricted interface; |
||
| 521 | * the latter needs an RA client certificate to identify the operator |
||
| 522 | * |
||
| 523 | * @param string $type to which interface should we connect to - "PUBLIC" or "RA" |
||
| 524 | * @return \SoapClient the connection object |
||
| 525 | * @throws Exception |
||
| 526 | */ |
||
| 527 | private static function initEduPKISoapSession($type) { |
||
| 583 | } |
||
| 584 | |||
| 585 | const EDUPKI_RA_ID = 700; |
||
| 586 | const EDUPKI_CERT_PROFILE = "User SOAP"; |
||
| 587 | const EDUPKI_RA_PKEY_PASSPHRASE = "..."; |
||
| 588 | |||
| 589 | /** |
||
| 590 | * take a CSR and sign it with our issuing CA's certificate |
||
| 591 | * |
||
| 592 | * @param mixed $csr the CSR |
||
| 593 | * @param int $expiryDays the number of days until the cert is going to expire |
||
| 594 | * @param string $certtype which type of certificate to use for signing |
||
| 595 | * @return array the cert and some meta info |
||
| 596 | */ |
||
| 597 | private static function signCsr($csr, $expiryDays, $certtype) { |
||
| 795 | } |
||
| 796 | } |
||
| 797 | |||
| 799 |
Loading history...