Skip to content

Add more details about the array returned from openssl_x509_parse (php#2666) #6013

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vera-ju wants to merge 2 commits into
base: master
Choose a base branch
from
+219 −2
Open

Add more details about the array returned from openssl_x509_parse (php#2666) #6013

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a9e2559
Add more details about the array returned from openssl_x509_parse (ph…
vera-ju Oct 24, 2026
86e0be7
Add more details about the array returned from openssl_x509_parse (ph…
vera-ju Oct 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
221 changes: 219 additions & 2 deletions reference/openssl/functions/openssl-x509-parse.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,9 +49,226 @@

<refsect1 role="returnvalues">
&reftitle.returnvalues;
<simpara>
Returns an &array; of certificate fields on success, or &false; on failure.
</simpara>
<simpara>
<literal>alias</literal> is present only when the certificate has an alias.
<literal>criticalExtensions</literal> is present only when the certificate
has at least one critical extension. Every other key listed below is always
present.
Comment on lines +57 to +59

@lacatoire lacatoire Oct 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<literal>criticalExtensions</literal> is present only when the certificate
has at least one critical extension. Every other key listed below is always
present.
Every other key listed below is always present.

</simpara>
<para>
<emphasis>The structure of the returned data is (deliberately) not
yet documented, as it is still subject to change.</emphasis>
<table>
<title>Array returned by <function>openssl_x509_parse</function></title>
<tgroup cols="3">
<thead>
<row>
<entry>Key</entry>
<entry>Type</entry>
<entry>&Description;</entry>
</row>
</thead>
<tbody>
<row>
<entry><literal>name</literal></entry>
<entry><type>string</type></entry>
<entry>
Subject distinguished name as a single string, with components separated by slashes.
For example, <literal>/C=US/O=Example/CN=example.com</literal>.
</entry>
</row>
<row>
<entry><literal>subject</literal></entry>
<entry><type>array</type></entry>
<entry>
Subject distinguished name. Keys are short names such as
<literal>CN</literal> when <parameter>short_names</parameter> is
&true;, and long names such as <literal>commonName</literal>
otherwise. Each value is a UTF-8 &string;, or an &array; of UTF-8
&string;s when that component occurs more than once.
</entry>
</row>
<row>
<entry><literal>hash</literal></entry>
<entry><type>string</type></entry>
<entry>
Lowercase hexadecimal hash of the subject name, as used to look up
a certificate in an OpenSSL CA directory. This is an 8-digit value.
It is not the certificate fingerprint; see
<function>openssl_x509_fingerprint</function>.
</entry>
</row>
<row>
<entry><literal>issuer</literal></entry>
<entry><type>array</type></entry>
<entry>
Issuer distinguished name, in the same form as
<literal>subject</literal>.
</entry>
</row>
<row>
<entry><literal>version</literal></entry>
<entry><type>int</type></entry>
<entry>
Raw version field stored in the certificate. This value is one less
than the certificate version usually displayed: a version 1
certificate is <literal>0</literal>, a version 2 certificate is
<literal>1</literal>, and a version 3 certificate is
<literal>2</literal>.
</entry>
</row>
<row>
<entry><literal>serialNumber</literal></entry>
<entry><type>string</type></entry>
<entry>
Decimal representation of the serial number.

@lacatoire lacatoire Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Decimal representation of the serial number.
Decimal representation of the serial number. Large serial numbers are
returned as a hexadecimal string prefixed with <literal>0x</literal> instead.

the conversion is done by OpenSSL, so very large serials come back as 0x… rather than decimal.

</entry>
</row>
<row>
<entry><literal>serialNumberHex</literal></entry>
<entry><type>string</type></entry>
<entry>
Uppercase hexadecimal representation of the serial number.
</entry>
</row>
<row>
<entry><literal>validFrom</literal></entry>
<entry><type>string</type></entry>
<entry>
Not-before time in ASN.1 form, either UTCTime
(<literal>YYMMDDHHMMSSZ</literal>) or GeneralizedTime
(<literal>YYYYMMDDHHMMSSZ</literal>).
</entry>
</row>
<row>
<entry><literal>validTo</literal></entry>
<entry><type>string</type></entry>
<entry>
Not-after time, in the same form as <literal>validFrom</literal>.
</entry>
</row>
<row>
<entry><literal>validFrom_time_t</literal></entry>
<entry><type>int</type></entry>
<entry>
Not-before time as a Unix timestamp, or <literal>-1</literal> if the
time could not be parsed.
</entry>
</row>
<row>
<entry><literal>validTo_time_t</literal></entry>
<entry><type>int</type></entry>
<entry>
Not-after time as a Unix timestamp, or <literal>-1</literal> if the
time could not be parsed.
</entry>
</row>
<row>
<entry><literal>alias</literal></entry>
<entry><type>string</type></entry>
<entry>
Certificate alias (friendly name). Only present when one is set.
</entry>
</row>
<row>
<entry><literal>signatureTypeSN</literal></entry>
<entry><type>string</type></entry>
<entry>
Short name of the signature algorithm.
</entry>
</row>
<row>
<entry><literal>signatureTypeLN</literal></entry>
<entry><type>string</type></entry>
<entry>
Long name of the signature algorithm.
</entry>
</row>
<row>
<entry><literal>signatureTypeNID</literal></entry>
<entry><type>int</type></entry>
<entry>
Numeric signature-algorithm identifier (OpenSSL NID).
</entry>
</row>
<row>
<entry><literal>purposes</literal></entry>
<entry><type>array</type></entry>
<entry>
Purpose checks, indexed by purpose id. The ids are the
<link linkend="openssl.purpose-check"><constant>X509_PURPOSE_<replaceable>*</replaceable></constant></link>
constants. Each value is an &array; described below.
</entry>
</row>
<row>
<entry><literal>extensions</literal></entry>
<entry><type>array</type></entry>
<entry>
Certificate extensions, indexed by short name (for example
<literal>subjectAltName</literal>) or by OID when the extension has
no short name. Each value is printable text describing that
extension. Which keys are present depends on the certificate.
Comment on lines +210 to +211

@lacatoire lacatoire Oct 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
no short name. Each value is printable text describing that
extension. Which keys are present depends on the certificate.
no short name. Each value is text describing that extension, or the raw
extension data when it cannot be printed. Which keys are present depends on the certificate.

extensions that OpenSSL cannot print, such as unknown OIDs, are returned as raw bytes, not text.

This array does not follow <parameter>short_names</parameter>.
</entry>
</row>
<row>
<entry><literal>criticalExtensions</literal></entry>
<entry><type>array</type></entry>
<entry>
Numerically indexed list of extension names that are marked
critical, using the same names as the keys of
<literal>extensions</literal>. Only present when the certificate
has at least one critical extension.
</entry>
</row>
Comment on lines +215 to +224

@lacatoire lacatoire Oct 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<row>
<entry><literal>criticalExtensions</literal></entry>
<entry><type>array</type></entry>
<entry>
Numerically indexed list of extension names that are marked
critical, using the same names as the keys of
<literal>extensions</literal>. Only present when the certificate
has at least one critical extension.
</entry>
</row>

criticalExtensions is not set by openssl_x509_parse() in any released version, so the key and its sentence should be dropped.

</tbody>
</tgroup>
</table>
</para>
<simpara>
Each element of <literal>purposes</literal> has the following keys:
</simpara>
<para>
<table>
<title>Purpose entry</title>
<tgroup cols="3">
<thead>
<row>
<entry>Key</entry>
<entry>Type</entry>
<entry>&Description;</entry>
</row>
</thead>
<tbody>
<row>
<entry><literal>0</literal></entry>
<entry><type>bool</type></entry>
<entry>
&true; if the certificate can be used for this purpose as an
end-entity certificate.
</entry>
</row>
<row>
<entry><literal>1</literal></entry>
<entry><type>bool</type></entry>
<entry>
&true; if the certificate can be used for this purpose as a CA
certificate.
</entry>
</row>
<row>
<entry><literal>2</literal></entry>
<entry><type>string</type></entry>
<entry>
Purpose name. A short name such as <literal>sslclient</literal>
when <parameter>short_names</parameter> is &true;, and a long name
such as <literal>SSL client</literal> otherwise.
</entry>
</row>
</tbody>
</tgroup>
</table>
</para>
</refsect1>

Expand Down
Loading