# SPKAC support for openssl in PHP

- Thread: https://externals.io/message/48311
- Original archive: https://news-web.php.net/php.internals/48311
- Started by Nathan Rixham on 2010-05-18T09:05:57+00:00
- Messages: 4
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #48311 — Nathan Rixham — 2010-05-18T09:05:57+00:00

URL: https://externals.io/message/48311#48311

Hi All,

Wondering if there is any support for SPKAC [1] in the openssl extension 
for PHP?

If not is it planned, and if not can it be? KEYGEN/SPKAC support is 
growing in the UA vendors and KEYGEN is part of HTML5, being the 
preferred way to generate client side SSL certificates since the private 
key never leaves the browser. Further the need for client side 
certificate generation will be growing somewhat over the next couple of 
years thanks to FOAF+SSL - which I believe is about to start going 
through standardisation.

At the minute we have to take a rather hacky approach in PHP [2] and it 
get's much worse if you want to use x509 v3 extensions, you have to go 
through a nasty process of using a bash script to gen a custom 
openssl.conf on the fly to use in the SPKAC request.

Best,

Nathan

[1] http://en.wikipedia.org/wiki/Spkac
[2] 
http://lists.whatwg.org/pipermail/whatwg-whatwg.org/attachments/20080714/07ea5534/attachment.txt

---

## #48312 — Pierre Joye — 2010-05-18T09:18:31+00:00

URL: https://externals.io/message/48311#48312 · In reply to: #48311

hi,

Can you open a feature request please? At http://bugs.php.net


> Hi All,
>
> Wondering if there is any support for SPKAC [1] in the openssl extension for
> PHP?
>
> If not is it planned, and if not can it be? KEYGEN/SPKAC support is growing
> in the UA vendors and KEYGEN is part of HTML5, being the preferred way to
> generate client side SSL certificates since the private key never leaves the
> browser. Further the need for client side certificate generation will be
> growing somewhat over the next couple of years thanks to FOAF+SSL - which I
> believe is about to start going through standardisation.
>
> At the minute we have to take a rather hacky approach in PHP [2] and it
> get's much worse if you want to use x509 v3 extensions, you have to go
> through a nasty process of using a bash script to gen a custom openssl.conf
> on the fly to use in the SPKAC request.
>
> Best,
>
> Nathan
>
> [1] http://en.wikipedia.org/wiki/Spkac
> [2]
> http://lists.whatwg.org/pipermail/whatwg-whatwg.org/attachments/20080714/07ea5534/attachment.txt
>
> --
> 
> 
>
>



-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org

---

## #48335 — Sriram Natarajan — 2010-05-19T00:14:12+00:00

URL: https://externals.io/message/48311#48335 · In reply to: #48311

I am curious as to why you need this feature within PHP. I would
expect that web server administrators typically need such feature but
I am missing the context of it within PHP script engine.

- Sriram


> Hi All,
>
> Wondering if there is any support for SPKAC [1] in the openssl extension for
> PHP?
>
> If not is it planned, and if not can it be? KEYGEN/SPKAC support is growing
> in the UA vendors and KEYGEN is part of HTML5, being the preferred way to
> generate client side SSL certificates since the private key never leaves the
> browser. Further the need for client side certificate generation will be
> growing somewhat over the next couple of years thanks to FOAF+SSL - which I
> believe is about to start going through standardisation.
>
> At the minute we have to take a rather hacky approach in PHP [2] and it
> get's much worse if you want to use x509 v3 extensions, you have to go
> through a nasty process of using a bash script to gen a custom openssl.conf
> on the fly to use in the SPKAC request.
>
> Best,
>
> Nathan
>
> [1] http://en.wikipedia.org/wiki/Spkac
> [2]
> http://lists.whatwg.org/pipermail/whatwg-whatwg.org/attachments/20080714/07ea5534/attachment.txt

---

## #48336 — Nathan Rixham — 2010-05-19T00:22:31+00:00

URL: https://externals.io/message/48311#48336 · In reply to: #48335

Moving forwards a lot of authentication will be done in an HTTP friendly 
stateless manner, namely via HTTPS where the user is identified by 
client side ssl certificates.

In order to give the user a certificate, you need to generate one, which 
you can currently do with openssl in php, and provide the user with a 
pkcs12 certificate+private key to install.

However, pkcs12 has a security flaw in the the application giving the 
certificates also has the private key. SPKAC addresses this because the 
private key never leaves the users browser, thus it is the preferred 
option - and as mentioned there will be an ever increasing need for this 
in PHP once HTML5 takes off (due to the KEYGEN element which is widely 
supported already) and FOAF+SSL which as I mentioned will be going 
through standardisation in the near future.

Best,

Nathan

Sriram Natarajan wrote:
> I am curious as to why you need this feature within PHP. I would
> expect that web server administrators typically need such feature but
> I am missing the context of it within PHP script engine.
> 
> - Sriram
> 
> 
> > […]