Digital Certificate with PHP

Question

I am developing a system in which I need to implement the use of A3 digital certificate so that the documents attached to the system have legal value. How is this done? Is it possible to do it in PHP? Or is it better to do it in JAVA? What tools are used for this process? Help me, because I have no idea how to do it!

Answer 1

In order for the CA certificate to be displayed at the prompt first the card reader must be properly configured and exporting the token certificate to the client’s certificate directory.

To know if the certificate is being listed you can take the Rasa test: https://serasa.certificadodigital.com.br/wp-content/themes/serasaLoja/testeRequest1/testeRequest.php

If the reader is not exporting I suggest installing the program "Token administration" Certisign or similar according to card reader model.

Observing: Only if you have any valid certificate on the machine will it be possible to view this response.

Getting CA data from PHP.

To obtain the certificate from a client, it is necessary that the web server is configured to perform the SSL HAND SHAKE and export the obtained certificate data to environment variables. This negotiation will happen before PHP is compiled/executed.

To allow SSL Hand Shake to happen it is necessary to enable the "Verity client" option on your web server, but it can only be enabled for the entire domain (see. https://serverfault.com/questions/843259/is-possible-to-use-lighttpd-httpurl-conditional-to-enable-ssl-verifyclient). To do this you need the following settings:

• Your server must be properly installed to receive ssl requests (HTTPS).
• A configuration is activated on the WEB server that checks the client’s certificate, each web server has a way to accomplish this. Here’s how it’s set up in Lighttpd: https://redmine.lighttpd.net/boards/2/topics/5157?r=7273#message-7273. And here (in English) an article that shows how it is done in PHP using Apache https://cweiske.de/tagebuch/ssl-client-certificates.htm
• Properly configure the certificate chain within a file composed of these authority certificates or Cas: What is the correct order of the ICP-Brazil certificate chain for the certificate of an e-CPF and e-CNPJ to be requested in the authentication via TLS?
• The Navigator understands this and opens this dialog box for the client to allow access and select the certificate, according to the image:
• After the client selects the connection to the server follows normally, and the variables are exported as environment variables that can be easily read on $SERVER, keys starting with "SSL"

About obtaining the certificate’s CPF/CNPJ, it is attached to the CN after the name the character : separates the numerical sequence from the CPF or CNPJ and can be extracted in this way.

This method gives you access to the certificate, as it shows the image "---- BEGIN CERTIFICATE ----- ", is the certificate string it is accessible in $_SERVER['SSL_CLIENT_CERT'] which in turn guarantees you access to the public key through the function openssl_pkey_get_public then you can use the option of sign the PDF with libraries as TCPDF.

Follow the example of the code that generated the image above:

<?php
if ($_SERVER['HTTPS'] == 'on') { //Alterar a validação de https de acordo com seu servidor web
    echo "<table>";
    echo "<tr><th>Chave</th><th>valor</th></tr>";
    foreach ($_SERVER as $key => $value) {
        switch (true) {
            //case strpos($key,"HTTP") == 0:
            case preg_match("/^SSL_CLIENT(.*)$/", $key):
                echo "<tr><td>", $key, "</td><td><pre>", $value, "</pre></td></tr>", PHP_EOL;
                break;
            default:
                break;
        }
    }

    if ($_SERVER['SSL_CLIENT_CERT']) {
        $pub_key = openssl_pkey_get_public($_SERVER['SSL_CLIENT_CERT']);
        $keyData = openssl_pkey_get_details($pub_key);
        echo "<tr><td>Public Key Resource</td><td><pre>", $pub_key, "</pre></td></tr>", PHP_EOL;
        echo "<tr><td>Bits</td><td><pre>", $keyData["bits"], "</pre></td></tr>", PHP_EOL;
        echo "<tr><td>PUBLIC KEY</td><td><pre>", $keyData["key"], "</pre></td></tr>", PHP_EOL;
        echo "<tr><td>RSA N</td><td><pre>", $keyData["rsa"]['n'], "</pre></td></tr>", PHP_EOL;
        echo "<tr><td>RSA E</td><td><pre>", $keyData["rsa"]['e'], "</pre></td></tr>", PHP_EOL;
        echo "<tr><td>Type</td><td><pre>", $keyData['type'], "</pre></td></tr>", PHP_EOL;
        echo "<tr><td>Raw Key Data Key</td><td><pre>";
        var_dump($keyData);
        echo "</pre></td></tr>", PHP_EOL;

        openssl_pkey_free($pub_key);

        $cert = openssl_x509_read($_SERVER['SSL_CLIENT_CERT']);
        $certData = openssl_x509_parse($cert);
        foreach ($certData as $k => $d) {
            echo "<tr><td>", strtoupper($k), "</td><td><pre>";
            switch (gettype($d)) {
                case "string":
                    echo $d;
                    break;
                default:
                    var_dump($d);
                    break;
            }

            echo "</pre></td></tr>", PHP_EOL;
        }
        echo "<tr><td>Certificate Raw</td><td><pre>";
        var_dump($certData);
        echo "</pre></td></tr>", PHP_EOL;
        openssl_x509_free($cert);
    }


    echo "</table>";
}

Consideration on the browsers:

General:

• By denying a certificate you will need to close and open the browser, there is no way to re-request the certificate.
• The previous rule applies for multiple certificates, only 1 certificate per session is possible.
• After the certificate selected, it is valid for that session, that is, until the browser is closed. Just closing the tab will not renew the digital certificate session. The behavior is the same in all browsers.

Firefox:

• It uses a different way to manage certificates, does not use the OS certificate repository, it has its own "container" to store valid certificates. This way, the certificate is manually installed in firefox using an import option from the browser itself.
• For A3 type certificates, you need to set the device as a manually valid device : .http://loja.certificadodigital.com.br/Serasa/UPLOAD/Downloads/673.pdf(MAC) http://loja.certificadodigital.com.br/Serasa/UPLOAD/Downloads/490.pdf(Windows)
• ITI Brazil opened a ticket 9 years ago (and is active until hj) to address the issues related to the inclusion of ICP-Root in firefox https://bugzilla.mozilla.org/show_bug.cgi?id=438825
• You will always ask for the password of all A3 certificate tokens when the request is made.

Chrome:

• No additional configuration required, uses the directory’s own certificate directory.
• The usability of the interface is better, but the cancel button will prevent re-ordering the certificate in the same session.

Edge:

• No additional configuration required, uses the directory’s own certificate directory.
• It does not list all certificates it is necessary to use the "More options" option to list the other certificates.

IE:

• As it is no longer an officially supported browser I have no test data for it.

Answer 2

Some time ago I researched this too and after much reading I discovered that:

Either you have a certificate installed on the server that will sign (type A1 not in token/smartcard, but in file) or you use Java (in case you use certificate stored in token/smartcard).

You can even get the certificate data plugged into the client machine with PHP and settings in Apache, but you can’t sign the files with it without using Java.