SecureBlackbox 2020 PHP Edition

Questions / Feedback?

CertificateStorage Class

Properties   Methods   Events   Configuration Settings   Errors  

The CertificateStorage class works with collections of certificates.

Class Name

SecureBlackbox_CertificateStorage

Procedural Interface

 secureblackbox_certificatestorage_open();
 secureblackbox_certificatestorage_close($res);
 secureblackbox_certificatestorage_register_callback($res, $id, $function);
 secureblackbox_certificatestorage_get_last_error($res);
 secureblackbox_certificatestorage_get_last_error_code($res);
 secureblackbox_certificatestorage_set($res, $id, $index, $value);
 secureblackbox_certificatestorage_get($res, $id, $index);
 secureblackbox_certificatestorage_do_add($res, $data);
 secureblackbox_certificatestorage_do_addfromfile($res, $filename);
 secureblackbox_certificatestorage_do_addpinned($res);
 secureblackbox_certificatestorage_do_clear($res);
 secureblackbox_certificatestorage_do_close($res, $save);
 secureblackbox_certificatestorage_do_config($res, $configurationstring);
 secureblackbox_certificatestorage_do_createnew($res, $storagelocation, $storageid);
 secureblackbox_certificatestorage_do_open($res, $storageid);
 secureblackbox_certificatestorage_do_refresh($res);
 secureblackbox_certificatestorage_do_remove($res, $index);
 secureblackbox_certificatestorage_do_select($res, $filter, $privatekeyneeded, $maxcount);
 secureblackbox_certificatestorage_do_selectchain($res, $index);

Remarks

CertificateStorage can work with certificates residing on a variety of media. Among others, it can access certificates residing in files, Windows and macOS system stores, and PKCS#11 devices. All such kinds of media can be accessed via a simple, unified interface, which makes CertificateStorage a handy certificate access option. Most users of SecureBlackbox use this component to access certificates residing on hardware devices. CertificateStorage is also a good alternative to CertificateManager where the certificate file contains more than one certificate.

To access certificates stored on certain type of media, start with the Open method. Provide the location of your certificates via a uniform URI-like specifier. Once the storage has been opened, you can access the certificates contained in it via the Certificates property.

Iterate over certificates by using the Certificates property, or use filtering facilities such as Select and SelectChain. You can add certificates to the storage with the Add, AddFromFile, and AddPinned methods. In the latter case please assign the certificate object to be imported to the PinnedCert property.

Use CreateNew method to create a new storage. Note that not all storage kinds can be created.

When you have finished working with the certificate storage, close it with the Close method.

Certain types of stores must be kept open for the certificates to continue to be usable. This means that while you can copy a certificate to a different storage, or assign it to a different component, you still must keep the storage it originates from open for as long as you intend to use that certificate in your code. This is because the storage is often a bridge between a certificate and its private key, and by closing the storage early you are destroying this bridge prematurely. See the code example below:

  // This code, although syntactically correct, will fail because the storage is closed too early:
  storage.Open("pkcs11://user:12345@localhost/C:/Windows/System32/asepkcs.dll");
  pdfSigner.SigningCertificate = storage.Certificates[0];
  storage.Close(false); // the private key of the SigningCertificate gets lost after this call
  pdfSigner.Sign(); // returns an error

  // This code will work as expected
  storage.Open("pkcs11://user:12345@localhost/C:/Windows/System32/asepkcs.dll");
  pdfSigner.SigningCertificate = storage.Certificates[0];
  pdfSigner.Sign();
  storage.Close(false);

Property List


The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

CertCountThe number of records in the Cert arrays.
CertBytesReturns raw certificate data in DER format.
CertCAIndicates whether the certificate has a CA capability (a setting in BasicConstraints extension).
CertCAKeyIDA unique identifier (fingerprint) of the CA certificate's private key.
CertCRLDistributionPointsLocations of the CRL (Certificate Revocation List) distribution points used to check this certificate's validity.
CertCurveSpecifies the elliptic curve of the EC public key.
CertFingerprintContains the fingerprint (a hash imprint) of this certificate.
CertFriendlyNameContains an associated alias (friendly name) of the certificate.
CertHandleAllows to get or set a 'handle', a unique identifier of the underlying property object.
CertHashAlgorithmSpecifies the hash algorithm to be used in the operations on the certificate (such as key signing) SB_HASH_ALGORITHM_SHA1 SHA1 SB_HASH_ALGORITHM_SHA224 SHA224 SB_HASH_ALGORITHM_SHA256 SHA256 SB_HASH_ALGORITHM_SHA384 SHA384 SB_HASH_ALGORITHM_SHA512 SHA512 SB_HASH_ALGORITHM_MD2 MD2 SB_HASH_ALGORITHM_MD4 MD4 SB_HASH_ALGORITHM_MD5 MD5 SB_HASH_ALGORITHM_RIPEMD160 RIPEMD160 SB_HASH_ALGORITHM_CRC32 CRC32 SB_HASH_ALGORITHM_SSL3 SSL3 SB_HASH_ALGORITHM_GOST_R3411_1994 GOST1994 SB_HASH_ALGORITHM_WHIRLPOOL WHIRLPOOL SB_HASH_ALGORITHM_POLY1305 POLY1305 SB_HASH_ALGORITHM_SHA3_224 SHA3_224 SB_HASH_ALGORITHM_SHA3_256 SHA3_256 SB_HASH_ALGORITHM_SHA3_384 SHA3_384 SB_HASH_ALGORITHM_SHA3_512 SHA3_512 SB_HASH_ALGORITHM_BLAKE2S_128 BLAKE2S_128 SB_HASH_ALGORITHM_BLAKE2S_160 BLAKE2S_160 SB_HASH_ALGORITHM_BLAKE2S_224 BLAKE2S_224 SB_HASH_ALGORITHM_BLAKE2S_256 BLAKE2S_256 SB_HASH_ALGORITHM_BLAKE2B_160 BLAKE2B_160 SB_HASH_ALGORITHM_BLAKE2B_256 BLAKE2B_256 SB_HASH_ALGORITHM_BLAKE2B_384 BLAKE2B_384 SB_HASH_ALGORITHM_BLAKE2B_512 BLAKE2B_512 SB_HASH_ALGORITHM_SHAKE_128 SHAKE_128 SB_HASH_ALGORITHM_SHAKE_256 SHAKE_256 SB_HASH_ALGORITHM_SHAKE_128_LEN SHAKE_128_LEN SB_HASH_ALGORITHM_SHAKE_256_LEN SHAKE_256_LEN .
CertIssuerThe common name of the certificate issuer (CA), typically a company name.
CertIssuerRDNA collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate issuer.
CertKeyAlgorithmSpecifies the public key algorithm of this certificate.
CertKeyBitsReturns the length of the public key.
CertKeyFingerprintReturns a fingerprint of the public key contained in the certificate.
CertKeyUsageIndicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set.
CertKeyValidReturns True if the certificate's key is cryptographically valid, and False otherwise.
CertOCSPLocationsLocations of OCSP (Online Certificate Status Protocol) services that can be used to check this certificate's validity, as recorded by the CA.
CertOriginReturns the origin of this certificate.
CertPolicyIDsContains identifiers (OIDs) of the applicable certificate policies.
CertPrivateKeyBytesContains the certificate's private key.
CertPrivateKeyExistsIndicates whether the certificate has an associated private key.
CertPrivateKeyExtractableIndicates whether the private key is extractable.
CertPublicKeyBytesContains the certificate's public key in DER format.
CertSelfSignedIndicates whether the certificate is self-signed (root) or signed by an external CA.
CertSerialNumberReturns the certificate's serial number.
CertSigAlgorithmIndicates the algorithm that was used by the CA to sign this certificate.
CertSubjectThe common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name.
CertSubjectKeyIDContains a unique identifier (fingerprint) of the certificate's private key.
CertSubjectRDNA collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject).
CertValidFromThe time point at which the certificate becomes valid, in UTC.
CertValidToThe time point at which the certificate expires, in UTC.
OpenedIndicates whether the storage is in the open state.
PinnedCertBytesReturns raw certificate data in DER format.
PinnedCertHandleAllows to get or set a 'handle', a unique identifier of the underlying property object.
SelectedCertCountThe number of records in the SelectedCert arrays.
SelectedCertBytesReturns raw certificate data in DER format.
SelectedCertCAIndicates whether the certificate has a CA capability (a setting in BasicConstraints extension).
SelectedCertCAKeyIDA unique identifier (fingerprint) of the CA certificate's private key.
SelectedCertCRLDistributionPointsLocations of the CRL (Certificate Revocation List) distribution points used to check this certificate's validity.
SelectedCertCurveSpecifies the elliptic curve of the EC public key.
SelectedCertFingerprintContains the fingerprint (a hash imprint) of this certificate.
SelectedCertFriendlyNameContains an associated alias (friendly name) of the certificate.
SelectedCertHandleAllows to get or set a 'handle', a unique identifier of the underlying property object.
SelectedCertHashAlgorithmSpecifies the hash algorithm to be used in the operations on the certificate (such as key signing) SB_HASH_ALGORITHM_SHA1 SHA1 SB_HASH_ALGORITHM_SHA224 SHA224 SB_HASH_ALGORITHM_SHA256 SHA256 SB_HASH_ALGORITHM_SHA384 SHA384 SB_HASH_ALGORITHM_SHA512 SHA512 SB_HASH_ALGORITHM_MD2 MD2 SB_HASH_ALGORITHM_MD4 MD4 SB_HASH_ALGORITHM_MD5 MD5 SB_HASH_ALGORITHM_RIPEMD160 RIPEMD160 SB_HASH_ALGORITHM_CRC32 CRC32 SB_HASH_ALGORITHM_SSL3 SSL3 SB_HASH_ALGORITHM_GOST_R3411_1994 GOST1994 SB_HASH_ALGORITHM_WHIRLPOOL WHIRLPOOL SB_HASH_ALGORITHM_POLY1305 POLY1305 SB_HASH_ALGORITHM_SHA3_224 SHA3_224 SB_HASH_ALGORITHM_SHA3_256 SHA3_256 SB_HASH_ALGORITHM_SHA3_384 SHA3_384 SB_HASH_ALGORITHM_SHA3_512 SHA3_512 SB_HASH_ALGORITHM_BLAKE2S_128 BLAKE2S_128 SB_HASH_ALGORITHM_BLAKE2S_160 BLAKE2S_160 SB_HASH_ALGORITHM_BLAKE2S_224 BLAKE2S_224 SB_HASH_ALGORITHM_BLAKE2S_256 BLAKE2S_256 SB_HASH_ALGORITHM_BLAKE2B_160 BLAKE2B_160 SB_HASH_ALGORITHM_BLAKE2B_256 BLAKE2B_256 SB_HASH_ALGORITHM_BLAKE2B_384 BLAKE2B_384 SB_HASH_ALGORITHM_BLAKE2B_512 BLAKE2B_512 SB_HASH_ALGORITHM_SHAKE_128 SHAKE_128 SB_HASH_ALGORITHM_SHAKE_256 SHAKE_256 SB_HASH_ALGORITHM_SHAKE_128_LEN SHAKE_128_LEN SB_HASH_ALGORITHM_SHAKE_256_LEN SHAKE_256_LEN .
SelectedCertIssuerThe common name of the certificate issuer (CA), typically a company name.
SelectedCertIssuerRDNA collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate issuer.
SelectedCertKeyAlgorithmSpecifies the public key algorithm of this certificate.
SelectedCertKeyBitsReturns the length of the public key.
SelectedCertKeyFingerprintReturns a fingerprint of the public key contained in the certificate.
SelectedCertKeyUsageIndicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set.
SelectedCertKeyValidReturns True if the certificate's key is cryptographically valid, and False otherwise.
SelectedCertOCSPLocationsLocations of OCSP (Online Certificate Status Protocol) services that can be used to check this certificate's validity, as recorded by the CA.
SelectedCertOriginReturns the origin of this certificate.
SelectedCertPolicyIDsContains identifiers (OIDs) of the applicable certificate policies.
SelectedCertPrivateKeyBytesContains the certificate's private key.
SelectedCertPrivateKeyExistsIndicates whether the certificate has an associated private key.
SelectedCertPrivateKeyExtractableIndicates whether the private key is extractable.
SelectedCertPublicKeyBytesContains the certificate's public key in DER format.
SelectedCertSelfSignedIndicates whether the certificate is self-signed (root) or signed by an external CA.
SelectedCertSerialNumberReturns the certificate's serial number.
SelectedCertSigAlgorithmIndicates the algorithm that was used by the CA to sign this certificate.
SelectedCertSubjectThe common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name.
SelectedCertSubjectKeyIDContains a unique identifier (fingerprint) of the certificate's private key.
SelectedCertSubjectRDNA collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject).
SelectedCertValidFromThe time point at which the certificate becomes valid, in UTC.
SelectedCertValidToThe time point at which the certificate expires, in UTC.
StorageIDA unique identifier of this storage.
StorageLocationSpecifies the location of the currently opened storage.

Method List


The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

AddAdds a certificate to the storage.
AddFromFileAdds a certificate to the storage.
AddPinnedAdds the pinned certificate to the storage.
ClearRemoves all certificates from the storage.
CloseCloses the certificate storage.
ConfigSets or retrieves a configuration setting.
CreateNewCreates a new storage.
OpenOpens existing storage or creates one in memory.
RefreshRefreshes all storage keychains.
RemoveRemoves a certificate from the storage.
SelectAllows the selection of certificates from the system store.
SelectChainSelects a chain of certificates given its index.

Event List


The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

ErrorInformation about errors during certificate loading or saving.
NotificationThis event notifies the application about an underlying control flow event.
PasswordNeededThis event is fired when a decryption password is needed.

Configuration Settings


The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.

AuthAttemptsThe number of auth/login attempts to try.
PKCS11ActiveSlotThe index of the slot that the class is working with.
PKCS11NewPINChanges the current user's PIN.
PKCS11NewUserPINRegisters a new user PIN.
PKCS11PINSets the operation PIN.
PKCS11SlotCountThe number of slots exposed in the storage.
PKCS11SlotDescription[i]A human-readable description of the slot.
PKCS11SlotLoggedIn[i]Whether slot i has an active session associated with it.
PKCS11SlotPinNeeded[i]Whether slot i requires you to provide a PIN to log in or sign.
PKCS11SlotReadOnly[i]Whether slot i only supports read-only access.
PKCS11SlotTokenLabel[i]The label assigned to the token.
PKCS11SlotTokenModel[i]The token model.
PKCS11SlotTokenPresent[i]Indicates whether there is a token in the slot.
PKCS11SlotTokenSerial[i]The serial number of the token.
PKCS11SlotTokenVendorID[i]The manufacturer ID of the inserted token.
PKCS11SlotVendorID[i]Returns the manufacturer ID of the slot.
TempPathPath for storing temporary files.
CheckKeyIntegrityBeforeUseEnables or disable private key integrity check before use.
CookieCachingSpecifies whether a cookie cache should be used for HTTP(S) transports.
CookiesGets or sets local cookies for the class (supported for HTTPClient, RESTClient and SOAPClient only).
DefDeriveKeyIterationsSpecifies the default key derivation algorithm iteration count.
EnableClientSideSSLFFDHEEnables or disables finite field DHE key exchange support in TLS clients.
GlobalCookiesGets or sets global cookies for all the HTTP transports.
HttpUserAgentSpecifies the user agent name to be used by all HTTP clients.
LogDestinationSpecifies the debug log destination.
LogDetailsSpecifies the debug log details to dump.
LogFileSpecifies the debug log filename.
LogFiltersSpecifies the debug log filters.
LogFlushModeSpecifies the log flush mode.
LogLevelSpecifies the debug log level.
LogMaxEventCountSpecifies the maximum number of events to cache before further action is taken.
LogRotationModeSpecifies the log rotation mode.
MaxASN1BufferLengthSpecifies the maximal allowed length for ASN.1 primitive tag data.
MaxASN1TreeDepthSpecifies the maximal depth for processed ASN.1 trees.
OCSPHashAlgorithmSpecifies the hash algorithm to be used to identify certificates in OCSP requests.
UseOwnDNSResolverSpecifies whether the client classes should use own DNS resolver.
UseSharedSystemStoragesSpecifies whether the validation engine should use a global per-process copy of the system certificate stores.
UseSystemOAEPAndPSSEnforces or disables the use of system-driven RSA OAEP and PSS computations.
UseSystemRandomEnables or disables the use of the OS PRNG.

Copyright (c) 2022 /n software inc. - All rights reserved.
SecureBlackbox 2020 PHP Edition - Version 20.0 [Build 8154]