![]() ![]() |
Info | ![]() |
![]() |
![]() ![]() |
Reputation | Support forum | Blog | Links |
Last Updated | Ratings | Unique User Downloads | Download Rankings | |||||
2017-12-12 (1 month ago) ![]() | Not yet rated by the users | Total: Not yet counted | Not yet ranked |
Version | License | PHP version | Categories | |||
certainty 1.0 | Custom (specified... | 5 | HTTP, PHP 5, Files and Folders, Crypt..., V..., S..., C... |
Description | Author | |
This package can manage SSL certificate authority file used by PHP. |
Automate your PHP projects' cacert.pem management. Read the blog post introducing Certainty.
Requires PHP 5.6 or newer.
Certainty allows your software to "just work" (which is usually the motivation for disabling certificate validation) without being vulnerable to man-in-the-middle attacks.
Many HTTP libraries require you to specify a file path to a cacert.pem
file in order to use TLS correctly.
Omitting this file means either disabling certificate validation entirely (which enables trivial man-in-the-middle
exploits), connection failures, or hoping that your library falls back safely to the operating system's bundle.
In short, the possible outcomes (from best to worst) are as follows:
Obviously, the first outcome is optimal. So we built Certainty to make it easier to ensure open source projects do this.
From Composer:
composer require paragonie/certainty:^1
Certainty will keep certificates up to date via RemoteFetch
, so you don't need to update
Certainty library just to get fresh CA-Cert bundless. Update only for bugfixes (especially
security fixes) and new features.
If you are not using RemoteFetch
(which is strongly recommended
that you do, and we only provide support for systems that do use RemoteFetch
), then you want
to use dev-master
rather than a version constraint, due to the nature of CA Certificates.
If a major CA gets compromised and their certificates are revoked, you don't want to continue trusting these certificates.
Furthermore, in the event of avoiding RemoteFetch
, you should be running composer update
at least
once per week to prevent stale CA-Cert files from causing issues.
See the documentation.
Certainty maintains a repository of all the cacert.pem
files since 2017, along with a sha256sum and
Ed25519 signature of each file. When you request the latest bundle, Certainty will check both these
values (the latter can only be signed by a key held by Paragon Initiative Enterprises, LLC) for each
entry in the JSON value, and return the latest bundle that passes validation.
The cacert.pem files contained within are reproducible from Mozilla's bundle.
The key differences are:
composer update
.![]() |
File | Role | Description | ||
---|---|---|---|---|
![]() |
||||
![]() |
||||
![]() |
||||
![]() |
||||
![]() |
||||
![]() |
||||
![]() ![]() |
Data | Auxiliary data | ||
![]() ![]() |
Data | Auxiliary data | ||
![]() ![]() |
Lic. | License text | ||
![]() ![]() |
Data | Auxiliary data | ||
![]() ![]() |
Data | Auxiliary data | ||
![]() ![]() |
Doc. | Documentation |
Version Control | Unique User Downloads | |||||||
100% |
|
Applications that use this package |
If you know an application of this package, send a message to the author to add a link here.