export chain with openssl_pkcs12_export in PHP

Question

Is it possible to export a certificate and private key to a .pfx along with the certificate chain (root cert and/or intermediate), using PHP's `openssl_pkcs12_export()`? UPDATE: I've taken a look at the source for the php openssl extension, and found that `openssl_pkcs12_export()` supports 2 args other than the ones in the documentation, `friendly_name` and `extracerts`. This is from `ext/openssl/openssl.c`, check out lines 1914-1920 (PHP-5.4.0): ``` 1878 /* {{{ proto bool openssl_pkcs12_export(mixed x509, string &out, mixed priv_key, string pass[, array args]) 1879 Creates and exports a PKCS12 to a var */ 1880 PHP_FUNCTION(openssl_pkcs12_export) 1881 { 1882 X509 * cert = NULL; 1883 BIO * bio_out; 1884 PKCS12 * p12 = NULL; 1885 zval * zcert = NULL, *zout = NULL, *zpkey, *args = NULL; 1886 EVP_PKEY *priv_key = NULL; 1887 long certresource, keyresource; 1888 char * pass; 1889 int pass_len; 1890 char * friendly_name = NULL; 1891 zval ** item; 1892 STACK_OF(X509) *ca = NULL; 1893 1894 if…

Accepted Answer

This is a bug that has been brought up nearly two months ago.

Thankfully he provides a sample patch for the docs:

```
$args = array(
               'extracerts' => $CAcert,
               'friendly_name' => 'My signed cert by CA certificate'
              );
openssl_pkcs12_export($signed_csr, $cerificate_out, $private_key_resource, $passphrase, $args);
```

What is `$CAcert`? Internally it gets passed to a function that takes an array and turns it into a x509 and that function also detects if it's an array of certs or a single cert. Each element should be an x509 Resource if you're passing an array, or $CAcert should be a single resource if you're not passing an array. `openssl_x509_read` is likely what you want to use here as it returns the x509 resource type that's expected in `$CAcert`.

Some people say that keeping docs updated is one of the hardest parts of PHP project. If you're not great with C and want to help PHP get better that's a good place to start.

export chain with openssl_pkcs12_export in PHP

Solution

Problem