ValidationMaterial

Collects the long-term validation (LTV) material embedded in a PDF Document Security Store (DSS): the certificate DERs, OCSP responses, and CRLs. URL discovery decodes the certificate AIA and CRL distribution point extensions from their DER rather than from OpenSSL's rendering of them. Network retrieval is delegated to injected transport callables, so this class chooses the URL and the host decides whether to fetch it and carries the SSRF question. The VRI key (SHA-1 of the signature Contents) is not computed here: it belongs to the DSS writer, which holds the final signature bytes.

Table of contents

Namespace: Com\Tecnick\Pdf\Sign\Ltv

Final: Yes

File: ValidationMaterial.php line 52

Collects the long-term validation (LTV) material embedded in a PDF Document Security Store (DSS): the certificate DERs, OCSP responses, and CRLs. URL discovery decodes the certificate AIA and CRL distribution point extensions from their DER rather than from OpenSSL’s rendering of them. Network retrieval is delegated to injected transport callables, so this class chooses the URL and the host decides whether to fetch it and carries the SSRF question. The VRI key (SHA-1 of the signature Contents) is not computed here: it belongs to the DSS writer, which holds the final signature bytes.

Collection is best-effort: a URL that cannot be reached, or that answers with something the codecs reject, is skipped so the next one can be tried. Every skip is reported to the optional $onSkip observer, with a SkipReason separating a revoked verdict from an unreachable responder.

Tags

Constants

MAX_URLS

File: ValidationMaterial.php line 80

public mixed MAX_URLS = 8

Every URL becomes a call to the host’s transport. The excess is reported through $onSkip rather than dropped.

Methods

__construct()

File: ValidationMaterial.php line 93

public __construct([Client|null $ocsp = null ][, Crl|null $crl = null ][, Certificate|null $certificate = null ][, Asn1|null $asn1 = null ]) : mixed

Parameters

Tags

  • throws: Exception If a default codec cannot be constructed.

certificateCrlUrls()

File: ValidationMaterial.php line 194

public certificateCrlUrls(string $certPem[, callable(string, string, string, SkipReason): void|null $onSkip = null ]) : array<int, string>

Returns an empty list when the certificate has no CRL distribution point or cannot be parsed (LTV collection is best-effort; see extensionMembers).

Parameters

  • $certPem : string
  • $onSkip : callable(string, string, string, SkipReason): void|null = null: Receives every URL the caller will not be given: the ones past MAX_URLS, and the ones whose scheme no HTTP transport can be handed.

Return values

array<int, string>

certificateOcspUrls()

File: ValidationMaterial.php line 148

public certificateOcspUrls(string $certPem[, callable(string, string, string, SkipReason): void|null $onSkip = null ]) : array<int, string>

Returns an empty list when the certificate has no AIA extension or cannot be parsed (LTV collection is best-effort; see extensionMembers).

Parameters

  • $certPem : string
  • $onSkip : callable(string, string, string, SkipReason): void|null = null: Receives every URL the caller will not be given: the ones past MAX_URLS, and the ones whose scheme no HTTP transport can be handed.

Return values

array<int, string>

certificates()

File: ValidationMaterial.php line 116

public certificates(array<int, string> $certsPem) : array<int, string>

Each entry is parsed as a certificate, not merely decoded.

Parameters

  • $certsPem : array<int, string>

Tags

  • throws: Exception If any entry is not a string, or is not one PEM certificate.

Return values

array<int, string>

fetchCrl()

File: ValidationMaterial.php line 306

public fetchCrl(array<int, string> $urls, callable $transport, string $issuerDer, string|null $subjectDer[, int|null $now = null ][, callable(string, string, string, SkipReason): void|null $onSkip = null ]) : array<int, string>

Every CRL is validated against the certificate that issued it before it is kept, so the issuer is required.

Parameters

  • $urls : array<int, string>
  • $transport : callable: Receives (url) and returns the CRL bytes.
  • $issuerDer : string: DER of the issuing certificate.
  • $subjectDer : string|null: DER of the certificate the lists are fetched for, so a list that revokes it is reported rather than embedded, or null to skip the revocation lookup.
  • $now : int|null = null: Unix time the CRLs are checked against.
  • $onSkip : callable(string, string, string, SkipReason): void|null = null: Receives (source, url, reason, code) for every URL whose answer was discarded.

Tags

Return values

array<int, string> —

Deduplicated, validated CRL bytes.

fetchOcsp()

File: ValidationMaterial.php line 256

public fetchOcsp(string $issuerDer, string $leafDer, array<int, string> $urls, callable $transport[, int|null $now = null ][, callable(string, string, string, SkipReason): void|null $onSkip = null ]) : array<int, string>

Every response is validated against the request before it is kept. A URL whose response fails validation is skipped, like an unreachable one.

Parameters

  • $issuerDer : string
  • $leafDer : string
  • $urls : array<int, string>
  • $transport : callable: Receives (url, DER request) and returns the DER response.
  • $now : int|null = null: Unix time the responses are checked against.
  • $onSkip : callable(string, string, string, SkipReason): void|null = null: Receives (source, url, reason, code) for every URL whose answer was discarded.

Tags

  • throws: Exception If the OCSP request cannot be built, or a URL is not a string.

Return values

array<int, string> —

Deduplicated, validated OCSP response bytes.

reportNotAttempted()

File: ValidationMaterial.php line 338

public reportNotAttempted(string $source, array<int, string> $urls, string $reason, callable(string, string, string, SkipReason): void|null $onSkip) : void

Parameters

  • $source : string
  • $urls : array<int, string>
  • $reason : string
  • $onSkip : callable(string, string, string, SkipReason): void|null

Tags