SigningRequest

Validated, immutable record of everything the CMS signed attributes are derived from. It is what crosses the boundary of a two-phase signature: Builder::signaturePayload() turns it into the bytes a signer has to sign, and Builder::buildFromSignature() rebuilds the same attributes from it once the signature comes back.

Table of contents

Namespace: Com\Tecnick\Pdf\Sign\Cms

Final: Yes

File: SigningRequest.php line 47

Validated, immutable record of everything the CMS signed attributes are derived from. It is what crosses the boundary of a two-phase signature: Builder::signaturePayload() turns it into the bytes a signer has to sign, and Builder::buildFromSignature() rebuilds the same attributes from it once the signature comes back.

Every invariant is enforced by the constructor, and toArray()/fromArray() round-trip through it, so a request rehydrated from a session, a queue, or a second HTTP request is validated again. Validation is not authentication: pass a key to that pair, or protect the channel, to catch a request edited into a different valid one.

Tags

Constants

MAX_SIGNING_TIME

File: SigningRequest.php line 52

public mixed MAX_SIGNING_TIME = 253402300799

Properties

$digestAlgorithm read-only

File: SigningRequest.php line 57

public string $digestAlgorithm

$extraSignedAttributes read-only

File: SigningRequest.php line 64

public array<string, string> $extraSignedAttributes

$includeSigningTime read-only

File: SigningRequest.php line 88

public bool $includeSigningTime = true

$messageDigest read-only

File: SigningRequest.php line 84

public string $messageDigest

$signerCertDer read-only

File: SigningRequest.php line 85

public string $signerCertDer

$signingTime read-only

File: SigningRequest.php line 87

public int $signingTime = 0

Methods

__construct()

File: SigningRequest.php line 83

public __construct(string $messageDigest, string $signerCertDer[, string|DigestAlgorithm $digestAlgorithm = 'sha256' ][, int $signingTime = 0 ][, bool $includeSigningTime = true ][, array<string|int, string> $extraSignedAttributes = [] ]) : mixed

Parameters

  • $messageDigest : string: Digest of the detached content, raw bytes, computed with $digestAlgorithm. A caller that cannot hold the content in memory computes it with hash_update_stream().
  • $signerCertDer : string: DER of the signing certificate.
  • $digestAlgorithm : string|DigestAlgorithm = ‘sha256’: Digest algorithm name or enum case.
  • $signingTime : int = 0: Unix timestamp for the signing-time attribute.
  • $includeSigningTime : bool = true: Whether to add the CMS signing-time signed attribute. The legacy (ISO 32000-1) profile includes it; PAdES-BASELINE forbids it (ETSI EN 319 142-1).
  • $extraSignedAttributes : array<string|int, string> = []: Additional signed attributes as OID => DER-encoded attribute value, for a profile that requires one such as the CAdES signature-policy-identifier.

Tags

  • throws: Exception If the digest, the certificate, the signing time, or an extra attribute is invalid.

fromArray()

File: SigningRequest.php line 200

public static fromArray(array<string|int, mixed> $state[, string|null $key = null ]) : self

The full constructor runs again, so a payload that is not a valid request is rejected. Pass the $key given to toArray() and the MAC is verified first, which rejects a payload edited into a different valid request.

Parameters

  • $state : array<string|int, mixed>: Exported state.
  • $key : string|null = null: The secret passed to toArray(), or null when the state was exported unprotected.

Tags

  • throws: Exception If the MAC is missing or wrong, or a field is missing, malformed, or fails validation.

Return values

self

signerCertPem()

File: SigningRequest.php line 136

public signerCertPem() : string

Return values

string

toArray()

File: SigningRequest.php line 163

public toArray([string|null $key = null ]) : array{message_digest: string, signer_cert: string, digest_algorithm: string, signing_time: int, include_signing_time: bool, extra_signed_attributes: array, mac?: string}

Pass $key to add a keyed MAC over the exported fields. Without one the export carries no integrity protection: the constructor re-runs on the way back in, so a malformed payload is rejected, but a payload edited into another well-formed one is not.

Parameters

  • $key : string|null = null: Secret for the HMAC-SHA256, or null to export unprotected.

Tags

Return values

array{message_digest: string, signer_cert: string, digest_algorithm: string, signing_time: int, include_signing_time: bool, extra_signed_attributes: array, mac?: string}