rollerworks / x509-validator-symfony
X509Validator Constraints for Symfony
Requires
- php: ^8.2
- rollerworks/x509-validator: ^0.2.1 || ^0.3
- symfony/config: ^6.4 || ^7.0
- symfony/translation: ^6.4 || ^7.0
- symfony/validator: ^6.4 || ^7.0
Requires (Dev)
- nyholm/symfony-bundle-test: ^2.0
- paragonie/hidden-string: ^2.0
- phpspec/prophecy-phpunit: ^2.1
- phpunit/phpunit: ^10.4.2
- rollerscapes/standards: ^1.0
- symfony/framework-bundle: ^7.0
- symfony/http-client: ^6.4 || ^7.0
- symfony/phpunit-bridge: ^6.4 || ^7.0
Conflicts
- paragonie/hidden-string: <2.0
This package is auto-updated.
Last update: 2024-11-04 12:13:23 UTC
README
This package provides the Symfony validator/bundle integration for the X509 TLS certificate/private-key validators.
The X509 TLS certificate/private-key validators validate the following:
- CA chain completeness
- PrivateKey bits length
- Signature algorithm
- OCSP Revocation status (requires internet access)
- Certificate purpose
- Certificate general validity (private-key compatibility, not expired, readable)
- Certificate hostname pattern supported, and protection against global wildcards of public-suffix length violations
Installation
To install this package, add rollerworks/x509-validator-symfony
to your composer.json:
php composer.phar require rollerworks/x509-validator-symfony
Now, Composer will automatically download all required files, and install them for you.
Symfony Flex (with contrib) is assumed to enable the Bundle and add required configuration. https://symfony.com/doc/current/bundles.html
Otherwise enable the following bundles:
Rollerworks\Component\PdbSfBridge\Bundle\RollerworksPdbBundle
Rollerworks\Component\X509Validator\Symfony\Bundle\RollerworksX509ValidatorBundle
And add the following configuration:
# config/packages/rollerworks_pdb.yaml rollerworks_pdb: cache_pool: 'rollerworks.cache.public_prefix_db' #manager: http # either: 'http' (default), 'static' (requires manual updates) or 'mock' framework: cache: pools: # This name can be changed by setting `rollerworks_pdb.cache_pool` (**Don't reuse an existing cache pool!**) rollerworks.cache.public_prefix_db: adapter: cache.adapter.array # use a persistent adapter that can be easily invalidated like cache.adapter.memcached or cache.adapter.pdo default_lifetime: 604800 # one week, the cache should be automatically refreshed, unless manager=static is used
Requirements
You need at least PHP 8.2, internet access is required if you want to validate a certificate's OCSP status or automatically update the PublicSuffixList.
The public-suffix and top-level domain needs to manually updated from time
to time. When internet access is available the PdbManager (provided by rollerworks/pdb-symfony-bridge
)
will automatically download the list and store it in the cache.
If no internet access is available, the local cache needs to refreshed manually. See https://github.com/rollerworks/PdbSfBridge#offline-usage for instructions.
Basic Usage
Versioning
For transparency and insight into the release cycle, and for striving to maintain backward compatibility, this package is maintained under the Semantic Versioning guidelines as much as possible.
Releases will be numbered with the following format:
<major>.<minor>.<patch>
And constructed with the following guidelines:
- Breaking backward compatibility bumps the major (and resets the minor and patch)
- New additions without breaking backward compatibility bumps the minor (and resets the patch)
- Bug fixes and misc changes bumps the patch
For more information on SemVer, please visit http://semver.org/.
License
This library is released under the MIT license.
Contributing
This is an open source project. If you'd like to contribute, please read the Contributing Guidelines. If you're submitting a pull request, please follow the guidelines in the Submitting a Patch section.