PHP Requires Chilkat v11.0.0+

Renew a DigiCert Certificate from an EST-enabled profile

See more Certificates Examples

Demonstrates how to renew a certificate from an EST-enabled profile in DigiCert​​®​​ Trust Lifecycle Manager. (The certificate must be within the renewal window configured in the certificate profile. The CSR must have same Subject DN values as the original certificate.) Chilkat2 PHP

<?php

use Chilkat2\BinData;
use Chilkat2\Cert;
use Chilkat2\Csr;
use Chilkat2\Ecc;
use Chilkat2\Http;
use Chilkat2\HttpResponse;
use Chilkat2\PrivateKey;
use Chilkat2\Prng;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The example below duplicates the following OpenSSL commands:
//
// # Name of certificate as argument 1
//
// # Make new key
// openssl ecparam -name prime256v1 -genkey -noout -out ${1}.key.pem
//
// # Make csr
// openssl req -new -sha256 -key ${1}.key.pem -out ${1}.p10.csr -subj "/CN=${1}"
//
// # Request new cert
// curl -v --cacert data/ca.pem --cert data/${1}.pem --key data/${1}.key.pem
//     --data-binary @${1}.p10.csr -o ${1}.p7.b64 -H "Content-Type: application/pkcs10" https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll
//
// # Convert to PEM
// openssl base64 -d -in ${1}.p7.b64 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${1}.pem

// ------------------------------------------------------------------------------------------------------------------

// Create a Fortuna PRNG and seed it with system entropy.
// This will be our source of random data for generating the ECC private key.
$fortuna = new Prng();
$entropy = $fortuna->GetEntropy(32, 'base64');
$fortuna->AddEntropy($entropy, 'base64');

$ec = new Ecc();

// Generate a random EC private key on the prime256v1 curve.
$privKey = new PrivateKey();
try {
    $ec->GenKey('prime256v1', $fortuna, $privKey);

    // Create the CSR object and set properties.
    $csr = new Csr();

    // Specify your CN
    $csr->CommonName = 'mysubdomain.mydomain.com';

    // Create the CSR using the private key.
    $bdCsr = new BinData();
    $csr->GenCsrBd($privKey, $bdCsr);

    // Save the private key and CSR to files.
    $privKey->SavePkcs8EncryptedPemFile('password', 'c:/temp/qa_output/ec_privkey.pem');

    $bdCsr->WriteFile('c:/temp/qa_output/csr.pem');

    // ----------------------------------------------------------------------
    // Now do the CURL request to POST the CSR and get the new certificate.

    $http = new Http();

    $tlsClientCert = new Cert();
    $tlsClientCert->LoadFromFile('data/myTlsClientCert.pem');
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

$bdTlsClientCertPrivKey = new BinData();
try {
    $bdTlsClientCertPrivKey->LoadFile('data/myTlsClientCert.key.pem');
} catch (\Chilkat2\Exception $e) {
    echo "Failed to load data/myTlsClientCert.key.pem\n";
    exit;
}

$tlsClientCertPrivKey = new PrivateKey();
try {
    $tlsClientCertPrivKey->LoadAnyFormat($bdTlsClientCertPrivKey, '');

    $tlsClientCert->SetPrivateKey($tlsClientCertPrivKey);

    $http->SetSslClientCert($tlsClientCert);

    $http->RequireSslCertVerify = true;

    // The body of the HTTP request contains the binary CSR.
    $resp = new HttpResponse();
    $url = 'https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll';
    $http->HttpBd('POST', $url, $bdCsr, 'application/pkcs10', $resp);
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

if ($resp->StatusCode != 200) {
    echo 'response status code = ', $resp->StatusCode, "\n";
    echo $resp->BodyStr, "\n";
    echo "Failed\n";
    exit;
}

// The response is the Base64 DER of the new certificate.
$myNewCert = new Cert();
try {
    $myNewCert->LoadFromBase64($resp->BodyStr);
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    echo 'Cert data = ', $resp->BodyStr, "\n";
    echo "Failed.\n";
    exit;
}

try {
    $myNewCert->SaveToFile('c:/temp/qa_output/myNewCert.cer');
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    echo "Failed.\n";
    exit;
}

echo "Success.\n";