(PHP ActiveX) Get Certificates from .p12 / .pfx

A PKCS12 (.p12 / .pfx) is a container for holding a certificate, its private key, and the certs in the chain of authentication up to and possibly including the root CA cert. A .p12 is not required to contain certain things. It will contain whatever the creator of the .p12 decided to include. It's possible to contain just a private key, just a cert, many certs without private keys, or many certs with many private keys. Usually, a .p12 contains one certificate, its associated private key, and certificates in the chain of authentication.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows Note: The php_com_dotnet.dll may need to be enabled inside of php.ini.

<?php

// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.Pfx')
$pfx = new COM("Chilkat.Pfx");

$success = $pfx->LoadPfxFile('qa_data/pfx/test.pfx','pfx_password');
if ($success == 0) {
    print $pfx->LastErrorText . "\n";
    exit;
}

// Iterate over the certs contained in the PFX
$numCerts = $pfx->NumCerts;
$i = 0;
while ($i < $numCerts) {
    // cert is a Chilkat.Cert
    $cert = $pfx->GetCert($i);

    print '--- ' . $i . ' ---' . "\n";
    print $cert->SubjectDN . "\n";
    // Is this a root cert, or self-signed?
    print 'Root: ' . $cert->IsRoot . "\n";
    print 'Self-Signed: ' . $cert->SelfSigned . "\n";

    // If this certificate is not the root (self-signed), then get the issuer.
    // If the issuing certificate is contained in the PFX, then it will be found here..
    if ($cert->SelfSigned != 1) {
        // issuer is a Chilkat.Cert
        $issuer = $cert->FindIssuer();
        if ($cert->LastMethodSuccess == 0) {
            print 'Issuer not found.' . "\n";
        }
        else {
            print 'Issuer: ' . $issuer->SubjectDN . "\n";

        }

    }

    $i = $i + 1;
}

// Usually, the user certificate is at index 0, its issuer is at index 1, etc. until we get to the root certificate.

?>