Skip to content

Add more details about the array returned from openssl_x509_parse (php#2666) - #6013

Open
vera-ju wants to merge 2 commits into
php:masterfrom
vera-ju:more_details_about_the_array_returned_from_openssl_x509_parse
Open

vera-ju wants to merge 2 commits into
php:masterfrom
vera-ju:more_details_about_the_array_returned_from_openssl_x509_parse

Conversation

@vera-ju

@vera-ju vera-ju commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

No description provided.

Comment on lines +57 to +59
<literal>criticalExtensions</literal> is present only when the certificate
has at least one critical extension. Every other key listed below is always
present.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<literal>criticalExtensions</literal> is present only when the certificate
has at least one critical extension. Every other key listed below is always
present.
Every other key listed below is always present.

Comment on lines +215 to +224
<row>
<entry><literal>criticalExtensions</literal></entry>
<entry><type>array</type></entry>
<entry>
Numerically indexed list of extension names that are marked
critical, using the same names as the keys of
<literal>extensions</literal>. Only present when the certificate
has at least one critical extension.
</entry>
</row>

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<row>
<entry><literal>criticalExtensions</literal></entry>
<entry><type>array</type></entry>
<entry>
Numerically indexed list of extension names that are marked
critical, using the same names as the keys of
<literal>extensions</literal>. Only present when the certificate
has at least one critical extension.
</entry>
</row>

criticalExtensions is not set by openssl_x509_parse() in any released version, so the key and its sentence should be dropped.

<entry><literal>serialNumber</literal></entry>
<entry><type>string</type></entry>
<entry>
Decimal representation of the serial number.

@lacatoire lacatoire Oct 26, 2026 •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Decimal representation of the serial number.
Decimal representation of the serial number. Large serial numbers are
returned as a hexadecimal string prefixed with <literal>0x</literal> instead.

the conversion is done by OpenSSL, so very large serials come back as 0x… rather than decimal.

Comment on lines +210 to +211
no short name. Each value is printable text describing that
extension. Which keys are present depends on the certificate.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
no short name. Each value is printable text describing that
extension. Which keys are present depends on the certificate.
no short name. Each value is text describing that extension, or the raw
extension data when it cannot be printed. Which keys are present depends on the certificate.

extensions that OpenSSL cannot print, such as unknown OIDs, are returned as raw bytes, not text.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants