Rogierw\RwAcme\Support\OpenSsl::generateCsr()

Complexity

Conditions	3
Paths	4

Size

Total Lines	55
Code Lines	35

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

<?php
    public static function generateCsr(
        array $domains,
        OpenSSLAsymmetricKey $privateKey,
        bool $isAssociative = false
    ): string {
        if ($isAssociative) {
            $san = [];

            self::extractKey($domains, $san, 'dns', 'DNS');
            self::extractKey($domains, $san, 'ip', 'IP Address');

            $san = implode(',', $san);

            $dn = implode(',', array_map(function ($key, $value) {
                return $key . ':' . $value;
            }, $domains));
        } else {
            $dn = ['commonName' => $domains[0]];

            $san = implode(',', array_map(function ($dns) {
                return 'DNS:' . $dns;
            }, $domains));
        }

        $tempFile = tmpfile();

        fwrite(
            $tempFile,
            'HOME = .
			RANDFILE = $ENV::HOME/.rnd
			[ req ]
			default_bits = 4096
			default_keyfile = privkey.pem
			distinguished_name = req_distinguished_name
			req_extensions = v3_req
			[ req_distinguished_name ]
			countryName = Country Name (2 letter code)
			[ v3_req ]
			basicConstraints = CA:FALSE
			subjectAltName = ' . $san . '
			keyUsage = nonRepudiation, digitalSignature, keyEncipherment'
        );

        $csr = openssl_csr_new($dn, $privateKey, [

It seems like $dn can also be of type string; however, parameter $distinguished_names of openssl_csr_new() does only seem to accept array, maybe add an additional type check?

            'digest_alg' => 'sha256',
            'config' => stream_get_meta_data($tempFile)['uri'],
        ]);

        fclose($tempFile);

        if (!openssl_csr_export($csr, $out)) {
            throw new LetsEncryptClientException('Exporting CSR failed.');
        }

        return trim($out);
    }