openssl_cms_encrypt

(PHP 8)

openssl_cms_encrypt — Chiffre un message CMS

Description

openssl_cms_encrypt(
    string $input_filename,
    string $output_filename,
    OpenSSLCertificate|array|string $certificate,
    ?array $headers,
    int $flags = 0,
    int $encoding = OPENSSL_ENCODING_SMIME,
    int $cipher_algo = OPENSSL_CIPHER_AES_128_CBC
): bool

Cette fonction chiffre le contenu pour un ou plusieurs destinataires, basé sur les certificats qui lui sont passés.

Liste de paramètres

input_filename: Le fichier à chiffrer.
output_filename: Le fichier de sortie.
certificate: Les destinataires à chiffrer.
headers: Les en-têtes à inclure lors de l'utilisation de S/MIME.
flags: Les drapeaux à passer à CMS_sign.
encoding: Un encodage de sortie. Une des constantes OPENSSL_ENCODING_SMIME, OPENSSL_ENCODING_DER ou OPENSSL_ENCODING_PEM.
cipher_algo: Le chiffrement à utiliser.

Valeurs de retour

Cette fonction retourne true en cas de succès ou false si une erreur survient.

Historique

Version	Description
8.1.0	L'algorithme de chiffrement par défaut (`cipher_algo`) est maintenant AES-128-CBC (`OPENSSL_CIPHER_AES_128_CBC`). Précédemment, PKCS7/CMS était utilisé (`OPENSSL_CIPHER_RC2_40`).

Improve This Page

Learn How To Improve This Page • Submit a Pull Request • Report a Bug

＋add a note

User Contributed Notes 1 note

down

Sebastian ¶

3 years ago

It took me a while to find out the correct way how to sign and encrypt data with these functions.
I needed that to communicate with German Health Insurance Providers as part of a DiGA. Maybe someone finds that useful.

<?php
function signAndEncrypt(string $rawData): string
{
    $tempDir = __DIR__ . '/tmp';
    $tempfileOriginal = tempnam($tempDir, 'original');
    $tempfileSigned = tempnam($tempDir, 'signed');
    $tempfileEncrypted = tempnam($tempDir, 'signedEncrypted');

    file_put_contents($tempfileOriginal, $rawData);

    // pick the correct certificate for the recipient
    $recipientsCertificateFile = __DIR__ . '/recipientsCertificate.pem';
    // -----BEGIN CERTIFICATE----- ...-----END CERTIFICATE-----
    $recipientsCertificate = file_get_contents($recipientsCertificateFile);

    // Certificate:
    //    Data:
    //        Version: 3 (0x2)...
    $myCertificate = file_get_contents(__DIR__ . '/my.crt');
    $myPrivateKey = openssl_pkey_get_private(
        // -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY-----
        file_get_contents(__DIR__ . '/my.prv.key.pem')
    );

    openssl_cms_sign(
        input_filename: $tempfileOriginal,
        output_filename: $tempfileSigned,
        certificate: $myCertificate,
        private_key: $myPrivateKey,
        headers: [],
        encoding: OPENSSL_ENCODING_DER,
    );

    openssl_cms_encrypt(
        input_filename: $tempfileSigned,
        output_filename: $tempfileEncrypted,
        certificate: $recipientsCertificate,
        headers: [],
        flags: OPENSSL_CMS_BINARY | OPENSSL_CMS_NOSIGS | OPENSSL_CMS_NOVERIFY,
        encoding: OPENSSL_ENCODING_DER,
        cipher_algo: OPENSSL_CIPHER_AES_256_CBC
    );
    return file_get_contents($tempfileEncrypted);
}

＋add a note