Crl

RFC 5280 CertificateList reader. It checks what has to hold before a CRL is embedded in a Document Security Store as evidence: the bytes are one complete DER CertificateList, the issuer Name is the one that issued the certificate the distribution point came from, the two signature AlgorithmIdentifiers agree, the validity interval covers the moment of use, the list is a complete one rather than a delta or a scoped partition, and the signature verifies against the issuer's public key.

Table of contents

Namespace: Com\Tecnick\Pdf\Sign\Ltv

Final: Yes

File: Crl.php line 52

RFC 5280 CertificateList reader. It checks what has to hold before a CRL is embedded in a Document Security Store as evidence: the bytes are one complete DER CertificateList, the issuer Name is the one that issued the certificate the distribution point came from, the two signature AlgorithmIdentifiers agree, the validity interval covers the moment of use, the list is a complete one rather than a delta or a scoped partition, and the signature verifies against the issuer’s public key.

The issuer certificate is required, none of the above being establishable without it. Given the certificate the list is being fetched for, its serial is looked up among the revoked entries as well, and a match is reported as a RevokedException.

Tags

Constants

CLOCK_SKEW

File: Crl.php line 58

public mixed CLOCK_SKEW = \Com\Tecnick\Pdf\Sign\Ocsp\Client::CLOCK_SKEW

Ocsp\Client and Timestamp\Client read the same value.

DEFAULT_MAX_AGE

File: Crl.php line 63

public mixed DEFAULT_MAX_AGE = \Com\Tecnick\Pdf\Sign\Ocsp\Client::DEFAULT_MAX_AGE

Methods

__construct()

File: Crl.php line 118

public __construct([Asn1|null $asn1 = null ][, Certificate|null $certificate = null ][, SignatureVerifier|null $verifier = null ][, int $maxAge = self::DEFAULT_MAX_AGE ][, int $clockSkew = self::CLOCK_SKEW ]) : mixed

Parameters

  • $asn1 : Asn1|null = null
  • $certificate : Certificate|null = null
  • $verifier : SignatureVerifier|null = null
  • $maxAge : int = self::DEFAULT_MAX_AGE: Age limit applied to thisUpdate, in seconds. Zero disables the bound.
  • $clockSkew : int = self::CLOCK_SKEW: Skew tolerated between the validity interval and the moment of use, in seconds.

Tags

  • throws: Exception If the age limit or the skew is negative.

validate()

File: Crl.php line 156

public validate(string $crlDer, string $issuerDer, string|null $subjectDer[, int|null $now = null ]) : string

Parameters

  • $crlDer : string: DER-encoded CertificateList.
  • $issuerDer : string: DER of the issuing certificate.
  • $subjectDer : string|null: DER of the certificate the list is being fetched for, or null to run the structural checks alone and skip the revocation lookup.
  • $now : int|null = null: Unix time the validity interval is checked against; defaults to the current time.

Tags

  • throws: RevokedException If $subjectDer is listed as revoked.
  • throws: Exception If the CRL is malformed, issued by another authority or by a certificate that may not sign CRLs, outside its validity interval, incomplete in scope, or not correctly signed.

Return values

string —

The CRL bytes unchanged, once accepted.