How to Sign X.509 certificate with RS256 in PHP? Not able to get Valid fingerprint...x5t

Question

I have implemented JWT token generator library from Here, and i am able to get RS256 Token (Payload). But i am having issue with Header data: I need one header value "x5t", which is not generated from the given library. I need header data like:

{
    "typ": "JWT",
    "alg": "RS256",
    "x5t": "COm8ON2SD2MTc5jwcxZ0vE3-XJo"
}

I am getting first two parameter successfully, but not able to get valid third parameter.

My Sample code is :

$fingerprint = str_replace("SHA1 Fingerprint=", '', system('openssl x509 -noout -in my.pem -fingerprint'));
$fingerprint = sha1($fingerprint);
$fingerprint = base64_encode($fingerprint);
$fingerprint = rtrim(strtr($fingerprint, "+/", "-_"), '=');

To generate Valid "x5t" parameter there is already code available in .NET, need to convert in PHP.

Thanks for watching my question. Any suggestion welcomed.

nice. i face same issue since 2 days. – Nikunj Dhimar Nov 07 '14 at 11:32 — Nikunj Dhimar, Nov 07 '14 at 11:32

Spomky-Labs · Accepted Answer · 2015-04-24T14:30:14.027

2

If you have PHP 5.6, you can use the following function openssl_x509_fingerprint:

$cert = openssl_x509_read($certificate);
$sha1_hash = openssl_x509_fingerprint($cert); // sha1 hash (x5t parameter)
$sha256_hash = openssl_x509_fingerprint($cert, 'sha256'); // sha256 hash (x5t#256 parameter)

If you do not have PHP 5.6, you can generate this fingerprint by yourself using the content of your certificate file (begins with BEGIN CERTIFICATE and ends with END CERTIFICATE):

function sha1_thumbprint($file_content)
{
   $file_content = preg_replace('#-.*-|\r|\n#', '', $file_content);
   $bin = base64_decode($file_content);
   return hash('sha1', $bin);
}

Do not forget to encode in Base64 Url Safe the result.

$encoded_fingerprint = rtrim(strtr(base64_encode($fingerprint), "+/", "-_"), '=');

edited Apr 24 '15 at 14:30

answered Nov 07 '14 at 12:27

Spomky-Labs

15,473
5
40
64

Thank you very much... I am using PHP 5.4.30 version. So, need to update it to try your given solution... Let me try it. – Vimal Patel Nov 07 '14 at 12:56
You do not need to update! I gave you a function for older PHP versions. – Spomky-Labs Nov 07 '14 at 14:50

score 0 · Answer 2 · answered Nov 07 '14 at 11:47

0

system outputs its result directly, unless you use the optional second parameter, which puts the result into the variable.

So use

system('openssl x509 -noout -in my.pem -fingerprint', $sha1);
$fingerprint = str_replace("SHA1 Fingerprint=", '', $sha1);

http://php.net/manual/en/function.system.php

answered Nov 07 '14 at 11:47

rjdown

9,162
3
32
45

Thanks for answering : I am using that technique from http://stackoverflow.com/questions/6426927/php-ssl-certificate-fingerprint – Vimal Patel Nov 07 '14 at 11:56
My issue is How to generate x5t parameter? – Vimal Patel Nov 07 '14 at 11:57
I have also tried that but it was not create VALID x5t parameter.. It will generate like "MDg6RTk6Qjk6Mzg6REQ6OTI6MEY6NjM6MTM6NzM6OTg6RjA6NzM6MTY6NzQ6QkM6NEQ6RkU6NUM6OUE" and i want like "COm8ON2SD2MTc5jwcxZ0vE3-XJo" – Vimal Patel Nov 07 '14 at 12:06

score 0 · Answer 3 · answered Nov 07 '14 at 18:09

openssl_x509_fingerprint (which Florent Morselli mentioned) returns an sha1 hash of the DER encoding of the cert. eg.

<?php
$cert = '...';

echo openssl_x509_fingerprint($cert);
echo "\r\n<br />\r\n";
echo sha1(base64_decode(preg_replace('#-.*-|\r|\n#', '', $cert)));

They output the same thing. At least with this cert:

openssl_x509_fingerprint is only on PHP 5.6 so if you're PHP 5.5 or earlier you can use the alternative method instead.

How to Sign X.509 certificate with RS256 in PHP? Not able to get Valid fingerprint...x5t

3 Answers3

Linked