OneLogin_Saml2_Utils::calculateX509Fingerprint PHP Method

calculateX509Fingerprint() public static method

Calculates the fingerprint of a x509cert.
public static calculateX509Fingerprint ( string $x509cert, $alg = 'sha1' ) : null | string
$x509cert string x509 cert
return null | string Formatted fingerprint
    public static function calculateX509Fingerprint($x509cert, $alg = 'sha1')
    {
        assert('is_string($x509cert)');
        $lines = explode("\n", $x509cert);
        $data = '';
        foreach ($lines as $line) {
            /* Remove '\r' from end of line if present. */
            $line = rtrim($line);
            if ($line === '-----BEGIN CERTIFICATE-----') {
                /* Delete junk from before the certificate. */
                $data = '';
            } elseif ($line === '-----END CERTIFICATE-----') {
                /* Ignore data after the certificate. */
                break;
            } elseif ($line === '-----BEGIN PUBLIC KEY-----' || $line === '-----BEGIN RSA PRIVATE KEY-----') {
                /* This isn't an X509 certificate. */
                return null;
            } else {
                /* Append the current line to the certificate data. */
                $data .= $line;
            }
        }
        $decodedData = base64_decode($data);
        switch ($alg) {
            case 'sha512':
            case 'sha384':
            case 'sha256':
                $fingerprint = hash($alg, $decodedData, FALSE);
                break;
            case 'sha1':
            default:
                $fingerprint = strtolower(sha1($decodedData));
                break;
        }
        return $fingerprint;
    }

Usage Example

Example #1
0
 /**
  * Validates a signature (Message or Assertion).
  *
  * @param string|DomDocument $xml         The element we should validate
  * @param string|null        $cert        The pubic cert
  * @param string|null        $fingerprint The fingerprint of the public cert
  */
 public static function validateSign($xml, $cert = null, $fingerprint = null)
 {
     if ($xml instanceof DOMDocument) {
         $dom = clone $xml;
     } else {
         if ($xml instanceof DOMElement) {
             $dom = clone $xml->ownerDocument;
         } else {
             $dom = new DOMDocument();
             $dom = self::loadXML($dom, $xml);
         }
     }
     $objXMLSecDSig = new XMLSecurityDSig();
     $objXMLSecDSig->idKeys = array('ID');
     $objDSig = $objXMLSecDSig->locateSignature($dom);
     if (!$objDSig) {
         throw new Exception('Cannot locate Signature Node');
     }
     $objKey = $objXMLSecDSig->locateKey();
     if (!$objKey) {
         throw new Exception('We have no idea about the key');
     }
     $objXMLSecDSig->canonicalizeSignedInfo();
     try {
         $retVal = $objXMLSecDSig->validateReference();
     } catch (Exception $e) {
         throw $e;
     }
     XMLSecEnc::staticLocateKeyInfo($objKey, $objDSig);
     if (!empty($cert)) {
         $objKey->loadKey($cert, false, true);
         return $objXMLSecDSig->verify($objKey) === 1;
     } else {
         $domCert = $objKey->getX509Certificate();
         $domCertFingerprint = OneLogin_Saml2_Utils::calculateX509Fingerprint($domCert);
         if (OneLogin_Saml2_Utils::formatFingerPrint($fingerprint) !== $domCertFingerprint) {
             return false;
         } else {
             $objKey->loadKey($domCert, false, true);
             return $objXMLSecDSig->verify($objKey) === 1;
         }
     }
 }
All Usage Examples Of OneLogin_Saml2_Utils::calculateX509Fingerprint