警告：openssl_x509_read()：提供的参数不能被强制转换为 X509 证书答案

【问题标题】：Warning: openssl_x509_read(): supplied parameter cannot be coerced into an X509 certificate警告：openssl_x509_read()：提供的参数不能被强制转换为 X509 证书
【发布时间】：2020-05-12 11:53:26
【问题描述】：

在生成私钥和 csr 密钥后，我得到了这样的交战：

Warning: openssl_x509_read(): supplied parameter cannot be coerced into an X509 certificate! in .../libs/ACMECert/ACMECert.php on line 313

生成的私钥：

已生成 CSR 密钥：

使用的库：

https://github.com/skoerfgen/ACMECert

用于生成密钥的代码：

<?php

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

require_once __DIR__ . '/config.php';
require_once __DIR__ . '/libs/ACMECert/ACMECert.php';


$domain_name = 'apple.highschoolhelper.org';

$ac = new ACMECert(false);
if (!file_exists($letsencrypt_certificate_dir . $domain_name)) {
    mkdir($letsencrypt_certificate_dir . $domain_name);
}


// Avoid any UTF-8 header
// https://github.com/skoerfgen/ACMECert/issues/8#issuecomment-557766088
$letsencrypt_account_key = $letsencrypt_certificate_dir . '/letsencrypt-account_key.pem';
if(file_exists($letsencrypt_account_key)) {
    $letsencrypt_account_key = preg_replace('/[\x00-\x09\x0b-\x1f\x7f-\xff]/', '', file_get_contents($letsencrypt_account_key));
    $ac->loadAccountKey($letsencrypt_account_key);
}
else {
    $letsencrypt_key = $ac->generateRSAKey(2048);
    file_put_contents($letsencrypt_certificate_dir . '/letsencrypt-account_key.pem', $letsencrypt_key);
    chmod($letsencrypt_certificate_dir . '/letsencrypt-account_key.pem', 777);
    $ret = $ac->register(true, $letsencrypt_account);
}

$ret = $ac->getAccount();

echo "<pre>";
print_r($ret);
echo "</pre>";


$domain_config=[
  'apple.highschoolhelper.org' => ['challenge' => 'http-01', 'docroot' => '/var/www/html/apple.highschoolhelper.org/public_html'],
];

$prepare_cert_handler = function($opts){
  $fn = $opts['config']['docroot'] . $opts['key'];
  @mkdir(dirname($fn),0777,true);
  file_put_contents($fn, $opts['value']);
  /*return function($opts){
    unlink($opts['config']['docroot'] . $opts['key']);
  };*/
};



$domain_private_key = $letsencrypt_certificate_dir . $domain_name . '/' . $domain_name . '_key.pem';
if(file_exists($domain_private_key)) {
    $domain_private_key = preg_replace('/[\x00-\x09\x0b-\x1f\x7f-\xff]/', '', file_get_contents($domain_private_key));
}
else {
    $domain_private_key = $ac->generateRSAKey(2048);
    file_put_contents($letsencrypt_certificate_dir . $domain_name . '/' . $domain_name . '_key.pem', $domain_private_key);
    chmod($letsencrypt_certificate_dir . $domain_name . '/' . $domain_name . '_key.pem', 777);
    chown($letsencrypt_certificate_dir . $domain_name . '/' . $domain_name . '_key.pem', 'apache');
}

//$fullchain = $ac->getCertificateChain($domain_private_key, $domain_config, $prepare_cert_handler);
//file_put_contents($letsencrypt_certificate_dir . $domain_name . '/' . $domain_name . '_fullchain.pem',$fullchain);



$domain_csr = $ac->generateCSR($domain_private_key, ['apple.highschoolhelper.org']);

file_put_contents($letsencrypt_certificate_dir . $domain_name . 'CSR_key.pem', $domain_csr);
print_r($domain_private_key);
//$ret = $ac->parseCertificate(file_get_contents('/etc/letsencrypt/live/self-signed-cert.pem'));
$ret = $ac->parseCertificate($domain_csr);


echo "<pre>";
print_r($domain_csr);
echo "</pre>";

【问题讨论】：

标签： php openssl

【解决方案1】：

喂，

我正在使用 key.pem 对 xml 文档进行签名，并收到此错误。如果您遇到相同的错误并且无法将密钥更改为 pfx 或 pcks7，请使用类似的内容：xmlspec

xmlsec --sign --output doc-signed.xml \
     --privkey-pem userkey.pem doc.xml

或xmlsec1 ;-) 不要浪费你的时间......

【讨论】：