From a9e2559d08efb59ca622745a821c66d3de1ad874 Mon Sep 17 00:00:00 2001 From: "vera.jungblut" Date: Sat, 24 Oct 2026 15:18:46 +0200 Subject: [PATCH 1/6] Add more details about the array returned from openssl_x509_parse (php#2666) --- .../openssl/functions/openssl-x509-parse.xml | 221 +++++++++++++++++- 1 file changed, 219 insertions(+), 2 deletions(-) diff --git a/reference/openssl/functions/openssl-x509-parse.xml b/reference/openssl/functions/openssl-x509-parse.xml index 1b303ccdfb72..546b75d8c2df 100644 --- a/reference/openssl/functions/openssl-x509-parse.xml +++ b/reference/openssl/functions/openssl-x509-parse.xml @@ -50,8 +50,225 @@ &reftitle.returnvalues; - The structure of the returned data is (deliberately) not - yet documented, as it is still subject to change. + Returns an &array; of certificate fields on success, or &false; on failure. + + + alias is present only when the certificate has an alias. + criticalExtensions is present only when the certificate + has at least one critical extension. Every other key listed below is always + present. + + + + Array returned by <function>openssl_x509_parse</function> + + + + Key + Type + &Description; + + + + + name + string + + Subject distinguished name as a single string, with components separated by slashes. + For example, /C=US/O=Example/CN=example.com. + + + + subject + array + + Subject distinguished name. Keys are short names such as + CN when short_names is + &true;, and long names such as commonName + otherwise. Each value is a UTF-8 &string;, or an &array; of UTF-8 + &string;s when that component occurs more than once. + + + + hash + string + + Lowercase hexadecimal hash of the subject name, as used to look up + a certificate in an OpenSSL CA directory. This is an 8-digit value. + It is not the certificate fingerprint; see + openssl_x509_fingerprint. + + + + issuer + array + + Issuer distinguished name, in the same form as + subject. + + + + version + int + + Raw version field stored in the certificate. This value is one less + than the certificate version usually displayed: a version 1 + certificate is 0, a version 2 certificate is + 1, and a version 3 certificate is + 2. + + + + serialNumber + string + + Decimal representation of the serial number. + + + + serialNumberHex + string + + Uppercase hexadecimal representation of the serial number. + + + + validFrom + string + + Not-before time in ASN.1 form, either UTCTime + (YYMMDDHHMMSSZ) or GeneralizedTime + (YYYYMMDDHHMMSSZ). + + + + validTo + string + + Not-after time, in the same form as validFrom. + + + + validFrom_time_t + int + + Not-before time as a Unix timestamp, or -1 if the + time could not be parsed. + + + + validTo_time_t + int + + Not-after time as a Unix timestamp, or -1 if the + time could not be parsed. + + + + alias + string + + Certificate alias (friendly name). Only present when one is set. + + + + signatureTypeSN + string + + Short name of the signature algorithm. + + + + signatureTypeLN + string + + Long name of the signature algorithm. + + + + signatureTypeNID + int + + Numeric signature-algorithm identifier (OpenSSL NID). + + + + purposes + array + + Purpose checks, indexed by purpose id. The ids are the + X509_PURPOSE_* + constants. Each value is an &array; described below. + + + + extensions + array + + Certificate extensions, indexed by short name (for example + subjectAltName) or by OID when the extension has + no short name. Each value is printable text describing that + extension. Which keys are present depends on the certificate. + This array does not follow short_names. + + + + criticalExtensions + array + + Numerically indexed list of extension names that are marked + critical, using the same names as the keys of + extensions. Only present when the certificate + has at least one critical extension. + + + + +
+ + + Each element of purposes has the following keys: + + + + Purpose entry + + + + Key + Type + &Description; + + + + + 0 + bool + + &true; if the certificate can be used for this purpose as an + end-entity certificate. + + + + 1 + bool + + &true; if the certificate can be used for this purpose as a CA + certificate. + + + + 2 + string + + Purpose name. A short name such as sslclient + when short_names is &true;, and a long name + such as SSL client otherwise. + + + + +
From 86e0be7ead96850768e9f87b7ec0519eb2473f63 Mon Sep 17 00:00:00 2001 From: "vera.jungblut" Date: Sat, 24 Oct 2026 15:33:46 +0200 Subject: [PATCH 2/6] Add more details about the array returned from openssl_x509_parse (php#2666) --- reference/openssl/functions/openssl-x509-parse.xml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/reference/openssl/functions/openssl-x509-parse.xml b/reference/openssl/functions/openssl-x509-parse.xml index 546b75d8c2df..f31081c798ab 100644 --- a/reference/openssl/functions/openssl-x509-parse.xml +++ b/reference/openssl/functions/openssl-x509-parse.xml @@ -49,15 +49,15 @@ &reftitle.returnvalues; - + Returns an &array; of certificate fields on success, or &false; on failure. - - + + alias is present only when the certificate has an alias. criticalExtensions is present only when the certificate has at least one critical extension. Every other key listed below is always present. - + Array returned by <function>openssl_x509_parse</function> @@ -226,9 +226,9 @@
- + Each element of purposes has the following keys: - + Purpose entry From fe227da24eb8feb1b82e02d7093c17a25067834d Mon Sep 17 00:00:00 2001 From: vera-ju <147752741+vera-ju@users.noreply.github.com> Date: Thu, 29 Oct 2026 09:34:17 +0100 Subject: [PATCH 3/6] Update reference/openssl/functions/openssl-x509-parse.xml Co-authored-by: Louis-Arnaud --- reference/openssl/functions/openssl-x509-parse.xml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/reference/openssl/functions/openssl-x509-parse.xml b/reference/openssl/functions/openssl-x509-parse.xml index f31081c798ab..13f6aae48331 100644 --- a/reference/openssl/functions/openssl-x509-parse.xml +++ b/reference/openssl/functions/openssl-x509-parse.xml @@ -54,9 +54,7 @@ alias is present only when the certificate has an alias. - criticalExtensions is present only when the certificate - has at least one critical extension. Every other key listed below is always - present. + Every other key listed below is always present.
From 2e8f486cbeaff4377a254c28770ac6c833105ccc Mon Sep 17 00:00:00 2001 From: vera-ju <147752741+vera-ju@users.noreply.github.com> Date: Thu, 29 Oct 2026 09:34:34 +0100 Subject: [PATCH 4/6] Update reference/openssl/functions/openssl-x509-parse.xml Co-authored-by: Louis-Arnaud --- reference/openssl/functions/openssl-x509-parse.xml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/reference/openssl/functions/openssl-x509-parse.xml b/reference/openssl/functions/openssl-x509-parse.xml index 13f6aae48331..9687d0dcb3fc 100644 --- a/reference/openssl/functions/openssl-x509-parse.xml +++ b/reference/openssl/functions/openssl-x509-parse.xml @@ -210,16 +210,6 @@ This array does not follow short_names. - - criticalExtensions - array - - Numerically indexed list of extension names that are marked - critical, using the same names as the keys of - extensions. Only present when the certificate - has at least one critical extension. - -
From fc8405b3a1c4545e2fffeeb1f5b0f9c34cd8b5d1 Mon Sep 17 00:00:00 2001 From: vera-ju <147752741+vera-ju@users.noreply.github.com> Date: Thu, 29 Oct 2026 09:34:43 +0100 Subject: [PATCH 5/6] Update reference/openssl/functions/openssl-x509-parse.xml Co-authored-by: Louis-Arnaud --- reference/openssl/functions/openssl-x509-parse.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/reference/openssl/functions/openssl-x509-parse.xml b/reference/openssl/functions/openssl-x509-parse.xml index 9687d0dcb3fc..6dc7fd5dc5fc 100644 --- a/reference/openssl/functions/openssl-x509-parse.xml +++ b/reference/openssl/functions/openssl-x509-parse.xml @@ -205,8 +205,8 @@ Certificate extensions, indexed by short name (for example subjectAltName) or by OID when the extension has - no short name. Each value is printable text describing that - extension. Which keys are present depends on the certificate. + no short name. Each value is text describing that extension, or the raw + extension data when it cannot be printed. Which keys are present depends on the certificate. This array does not follow short_names. From b57aae025974a70e15abb3574c40c3d6998e0493 Mon Sep 17 00:00:00 2001 From: vera-ju <147752741+vera-ju@users.noreply.github.com> Date: Thu, 29 Oct 2026 09:34:53 +0100 Subject: [PATCH 6/6] Update reference/openssl/functions/openssl-x509-parse.xml Co-authored-by: Louis-Arnaud --- reference/openssl/functions/openssl-x509-parse.xml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/reference/openssl/functions/openssl-x509-parse.xml b/reference/openssl/functions/openssl-x509-parse.xml index 6dc7fd5dc5fc..3a6d287f9ced 100644 --- a/reference/openssl/functions/openssl-x509-parse.xml +++ b/reference/openssl/functions/openssl-x509-parse.xml @@ -120,7 +120,8 @@ serialNumber string - Decimal representation of the serial number. + Decimal representation of the serial number. Large serial numbers are + returned as a hexadecimal string prefixed with 0x instead.