Validate digital certificate with ICP-Brasil

Asked

Viewed 2,674 times

0

As we know, it is possible to generate digital certificates on any computer. These certificates are valid, however, they do not belong to the ICP-Brazil certification chain

How could this check be done using PHP?

I’m using the openssl_pkcs12_read and openssl_x509_parse functions to validate some data, such as the certificate name and the expiration date. Now I need to know if the certificate is valid in ICP-Brazil.

Has anyone ever been there? Do you know where I can find a light?

Thanks a lot!

1 answer

3


You can start by looking at 2 certificate information, Issuer and AKI (Authority Key Identifer):

The Issuer contains the name of the certifying authority which issued the certificate. To find out which are the certification authorities of ICP-Brazil, you can consult on this website, that has the list of all Acs and their respective websites.

On each CA’s website, search for "repository" or "certificates" (or something like that), and download the certificates from each one. So you will know the exact names of each.

Therefore, your certificate ("Issuer" or "Issuer Name" field, depending on the API used) must be equal to the name ("Subject" field) of the CA certificate.

However, the name alone is not enough, since nothing prevents there being 2 certificates with the same name, but different Acs. Therefore, you should check the extension Authority Key Identifier (also called the AKI).

In ICP-Brazil it was defined that this extension contains the hash of the public key of the CA that issued the certificate, and this value is also in the certificate of the CA, however in the extension Subject Key Identifier (or SKI).

That is, the AC certificate SKI must have the same AKI value as the certificate you are checking.


ICP-Brazil certificates have more than one "level" of hierarchy, so ideally you also check the whole chain.

For example, an eCPF is usually issued by one of the accredited Acs (Serasa, Certisign, etc). In turn, the certificates of these Acs were issued by AC Receita Federal, which in turn was issued by Raiz ICP-Brasil.

The ideal is to validate the full chain, but usually Apis already have methods ready to do so, all you have to do is provide the chain certificates via configuration or parameters (and these can be downloaded by following the Acs links as explained above). In this case it varies by API, but the general idea is this.

Browser other questions tagged

You are not signed in. Login or sign up in order to post.