Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112495
Date: Mon, 14 Dec 2020 17:36:11 +0100
To: PHP Internals List <internals@lists.php.net>
Message-ID: <20201214173611.202992d1@mcmic-probook.opensides.be>
Organization: FusionDirectory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: capture_peer_cert support from stream_socket_server
From: come.chilliet@fusiondirectory.org (=?UTF-8?B?Q8O0bWU=?= Chilliet)

Hello,

It seems that is does not work to pass option capture_peer_cert to
 stream_socket_server context in order to get the client certificate used i=
n the
 TLS handshake.

Is that how it is supposed to work, and is it broken?

I tried the following:
$context =3D stream_context_create(
    [
        'ssl' =3D> [
            'allow_self_signed' =3D> true,
            'SNI_enabled'       =3D> true,
            'SNI_server_certs'  =3D> ['example.com' =3D> '/path/to/cert.pem=
'],
            'capture_peer_cert' =3D> true,
        ]
    ]
);
$socket =3D stream_socket_server(
    'tcp://[::]:' . $port,
    $errno,
    $errstr,
    STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
    $context,
);

if ($socket =3D=3D=3D false) {
    throw new \Exception($errstr, $errno);
} else {
    while ($conn =3D stream_socket_accept($socket, -1, $peername)) {
        $tlsSuccess =3D stream_socket_enable_crypto(
            $conn,
            true,
            STREAM_CRYPTO_METHOD_TLS_SERVER
        );
        if ($tlsSuccess !=3D=3D true) {
            fclose($conn);
            continue;
        }
        var_dump(stream_context_get_options($conn));
    }
}

No peer_certificate option is created when a client connects with a certifi=
cate.
Despite what https://www.php.net/manual/en/context.ssl.php says.

This is a problem for implementing client certificate support into Gemini
 servers written in PHP, such as https://tildegit.org/sumpygump/orbit and
 https://framagit.org/MCMic/gemini-server

C=C3=B4me