PHP Extension

Renew a DigiCert Certificate from an EST-enabled profile

See more Certificates Examples

Demonstrates how to renew a certificate from an EST-enabled profile in DigiCert​​®​​ Trust Lifecycle Manager. (The certificate must be within the renewal window configured in the certificate profile. The CSR must have same Subject DN values as the original certificate.) PHP Extension

<?php

include("chilkat.php");

$success = false;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The example below duplicates the following OpenSSL commands:
// 
// # Name of certificate as argument 1
// 
// # Make new key
// openssl ecparam -name prime256v1 -genkey -noout -out ${1}.key.pem
// 
// # Make csr
// openssl req -new -sha256 -key ${1}.key.pem -out ${1}.p10.csr -subj "/CN=${1}"
// 
// # Request new cert
// curl -v --cacert data/ca.pem --cert data/${1}.pem --key data/${1}.key.pem 
//     --data-binary @${1}.p10.csr -o ${1}.p7.b64 -H "Content-Type: application/pkcs10" https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll
// 
// # Convert to PEM
// openssl base64 -d -in ${1}.p7.b64 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${1}.pem

// ------------------------------------------------------------------------------------------------------------------

// Create a Fortuna PRNG and seed it with system entropy.
// This will be our source of random data for generating the ECC private key.
$fortuna = new CkPrng();
$entropy = $fortuna->getEntropy(32,'base64');
$success = $fortuna->AddEntropy($entropy,'base64');

$ec = new CkEcc();

// Generate a random EC private key on the prime256v1 curve.
$privKey = new CkPrivateKey();
$success = $ec->GenKey('prime256v1',$fortuna,$privKey);
if ($success != true) {
    print $ec->lastErrorText() . "\n";
    exit;
}

// Create the CSR object and set properties.
$csr = new CkCsr();

// Specify your CN
$csr->put_CommonName('mysubdomain.mydomain.com');

// Create the CSR using the private key.
$bdCsr = new CkBinData();
$success = $csr->GenCsrBd($privKey,$bdCsr);
if ($success == false) {
    print $csr->lastErrorText() . "\n";
    exit;
}

// Save the private key and CSR to files.
$privKey->SavePkcs8EncryptedPemFile('password','c:/temp/qa_output/ec_privkey.pem');

$bdCsr->WriteFile('c:/temp/qa_output/csr.pem');

// ----------------------------------------------------------------------
// Now do the CURL request to POST the CSR and get the new certificate.

$http = new CkHttp();

$tlsClientCert = new CkCert();
$success = $tlsClientCert->LoadFromFile('data/myTlsClientCert.pem');
if ($success == false) {
    print $tlsClientCert->lastErrorText() . "\n";
    exit;
}

$bdTlsClientCertPrivKey = new CkBinData();
$success = $bdTlsClientCertPrivKey->LoadFile('data/myTlsClientCert.key.pem');
if ($success == false) {
    print 'Failed to load data/myTlsClientCert.key.pem' . "\n";
    exit;
}

$tlsClientCertPrivKey = new CkPrivateKey();
$success = $tlsClientCertPrivKey->LoadAnyFormat($bdTlsClientCertPrivKey,'');
if ($success == false) {
    print $tlsClientCertPrivKey->lastErrorText() . "\n";
    exit;
}

$success = $tlsClientCert->SetPrivateKey($tlsClientCertPrivKey);
if ($success == false) {
    print $tlsClientCert->lastErrorText() . "\n";
    exit;
}

$http->SetSslClientCert($tlsClientCert);

$http->put_RequireSslCertVerify(true);

// The body of the HTTP request contains the binary CSR.
$resp = new CkHttpResponse();
$url = 'https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll';
$success = $http->HttpBd('POST',$url,$bdCsr,'application/pkcs10',$resp);
if ($success == false) {
    print $http->lastErrorText() . "\n";
    exit;
}

if ($resp->get_StatusCode() != 200) {
    print 'response status code = ' . $resp->get_StatusCode() . "\n";
    print $resp->bodyStr() . "\n";
    print 'Failed' . "\n";
    exit;
}

// The response is the Base64 DER of the new certificate.
$myNewCert = new CkCert();
$success = $myNewCert->LoadFromBase64($resp->bodyStr());
if ($success == false) {
    print $myNewCert->lastErrorText() . "\n";
    print 'Cert data = ' . $resp->bodyStr() . "\n";
    print 'Failed.' . "\n";
    exit;
}

$success = $myNewCert->SaveToFile('c:/temp/qa_output/myNewCert.cer');
if ($success == false) {
    print $myNewCert->lastErrorText() . "\n";
    print 'Failed.' . "\n";
    exit;
}

print 'Success.' . "\n";

?>