OpenSSL Utilities: Convert SAT CER, KEY, and PEM Files

<?php

$openssl = new \CfdiUtils\OpenSSL\OpenSSL();

$cerFile     = 'EKU9003173C9.cer';
$cerContents = file_get_contents($cerFile);

// --- Pure PHP (no external binary required) ---
// Convert DER binary content string → PEM string
$pemCertificate = $openssl->derCerConvertPhp($cerContents);

// --- Using the external openssl binary ---
// Write the PEM certificate directly to a file
$openssl->derCerConvert($cerFile, __DIR__ . '/certificate.pem');

// Get the PEM certificate as a string (file in → string out)
$pemCertificate = $openssl->derCerConvertOut($cerFile);

// Get the PEM certificate as a string (binary content in → string out)
$pemCertificate = $openssl->derCerConvertInOut($cerContents);

<?php

$keyDerFile             = 'EKU9003173C9.key';
$keyPemFile             = $keyDerFile . '.pem';
$keyPemFileUnprotected  = $keyDerFile . '.unprotected.pem';
$keyDerPass             = '12345678a';
$keyPemPass             = 'This is my not so strong password';

$openssl = new \CfdiUtils\OpenSSL\OpenSSL();

// Convert DER to unprotected PEM, write to file
$openssl->derKeyConvert($keyDerFile, $keyDerPass, $keyPemFileUnprotected);

// Protect an existing unprotected PEM key with a new password
$openssl->pemKeyProtect($keyPemFileUnprotected, '', $keyPemFile, $keyPemPass);

// One-step: convert DER to password-protected PEM (combines the two steps above)
$openssl->derKeyProtect($keyDerFile, $keyDerPass, $keyPemFile, $keyPemPass);

// Get a PEM key re-encrypted with a new password (useful for services like Finkok)
$keyForFinkok = $openssl->pemKeyProtectOut($keyPemFile, $keyPemPass, 'abc/123-xyz');

// Remove the password from a PEM key and get the result as a string
$unprotected = $openssl->pemKeyUnprotectOut($keyPemFile, $keyPemPass);

<?php

$openssl = new \CfdiUtils\OpenSSL\OpenSSL();

// Read from a file
$cerPemFile = 'EKU9003173C9.cer.pem';
$certificate = $openssl->readPemFile($cerPemFile)->certificate();

// Read from a string
$keyContents = file_get_contents('EKU9003173C9.key.pem');
$privateKey  = $openssl->readPemContents($keyContents)->privateKey();

// Inspect what sections a PEM file contains
$pem = $openssl->readPemFile('bundle.pem');

if ($pem->hasCertificate()) {
    echo 'CERTIFICATE:', PHP_EOL, $pem->certificate(), PHP_EOL;
}
if ($pem->hasPublicKey()) {
    echo 'PUBLIC KEY:', PHP_EOL, $pem->publicKey(), PHP_EOL;
}
if ($pem->hasPrivateKey()) {
    echo 'PRIVATE KEY:', PHP_EOL, $pem->privateKey(), PHP_EOL;
}

<?php

use CfdiUtils\PemPrivateKey\PemPrivateKey;

// Load from a file path (prefix with file://)
$key = new PemPrivateKey('file:///path/to/EKU9003173C9.key.pem');

// Load from a PEM string
$pemContents = file_get_contents('EKU9003173C9.key.pem');
$key = new PemPrivateKey($pemContents);

// Open (decrypt) the key with its passphrase
if (! $key->open('12345678a')) {
    throw new RuntimeException('Wrong passphrase');
}

// Check whether the key is currently open
if ($key->isOpen()) {
    // Sign data with SHA-256 (default)
    $signature = $key->sign($dataToSign);

    // Sign with a different algorithm
    $signature = $key->sign($dataToSign, OPENSSL_ALGO_SHA512);
}

// Verify the key belongs to a given certificate (PEM string)
// The key must be open before calling belongsTo()
$pemCert = file_get_contents('EKU9003173C9.cer.pem');
if ($key->belongsTo($pemCert)) {
    echo 'Key and certificate match';
}

// Release the private key resource
$key->close();

<?php

// Use the system openssl (found via PATH)
$openssl = new \CfdiUtils\OpenSSL\OpenSSL();

// Use a specific openssl binary
$openssl = new \CfdiUtils\OpenSSL\OpenSSL('/usr/local/opt/openssl@3/bin/openssl');

echo $openssl->getOpenSSLCommand(); // '/usr/local/opt/openssl@3/bin/openssl'