PHP Requires Chilkat v11.0.0+

Accept TLS Connection with Client Authentication

See more Socket/SSL/TLS Examples

Demonstrates how to accept a TLS connection requiring client authentication. This is the case where the TLS client sends a certificate. It is also known as "Two-Way SSL". Chilkat2 PHP

<?php

use Chilkat2\Cert;
use Chilkat2\Socket;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

$listenSslSocket = new Socket();

// An SSL/TLS server needs a digital certificate.  This example loads it from a PFX file.
// Note: This is the server's certificate.

$cert = new Cert();
// The 1st argument is the file path, the 2nd arg is the
// PFX file's password:
try {
    $cert->LoadPfxFile('chilkat.pfx', 'test');

    // To accept client client certificates in the TLS handshake,
    // we must indicate a list of acceptable client certificate root CA DN's
    // that are allowed.  (DN is an acronym for Distinguished Name.)
    // Call AddSslAcceptableClientCaDn once for each acceptable CA DN.
    // Here are a few examples so you can see the general format of a DN.
    $listenSslSocket->AddSslAcceptableClientCaDn('C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root');
    $listenSslSocket->AddSslAcceptableClientCaDn('O=Digital Signature Trust Co., CN=DST Root CA X3');

    // Use the certificate:
    $listenSslSocket->InitSslServer($cert);

    // Bind and listen on a port:
    $myPort = 8123;
    // Allow for a max of 5 queued connect requests.
    $backLog = 5;
    $listenSslSocket->BindAndListen($myPort, $backLog);

    // If accepting an SSL/TLS connection, the SSL handshake is part of the connection
    // establishment process. This involves a few back-and-forth messages between the
    // client and server to establish algorithms and a shared key to create the secure
    // channel. The sending and receiving of these messages are governed by the
    // MaxReadIdleMs and MaxSendIdleMs properties. If these properties are set to 0
    // (and this is the default unless changed by your application), then the
    // AcceptNext can hang indefinitely during the SSL handshake process.
    // Make sure these properties are set to appropriate values before calling AcceptNext.

    // Set a 10 second max for waiting to read/write.  This is for the SSL/TLS handshake establishment.
    $listenSslSocket->MaxReadIdleMs = 10000;
    $listenSslSocket->MaxSendIdleMs = 10000;

    // Accept a single client connection and establish the secure SSL/TLS channel:
    $maxWaitMillisec = 20000;
    $clientSock = new Socket();
    $listenSslSocket->AcceptNext($maxWaitMillisec, $clientSock);

    // The client (in this example) is going to send a "Hello Server! -EOM-"
    // message.  Read it:
    $receivedMsg = $clientSock->ReceiveUntilMatch('-EOM-');
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

echo $receivedMsg, "\n";

// Send a "Hello Client! -EOM-" message:
try {
    $clientSock->SendString('Hello Client! -EOM-');
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

// Close the connection with the client
// Wait a max of 20 seconds (20000 millsec)
$clientSock->Close(20000);