Repository navigation
Stdlib: openssl_x509_export()/openssl_x509_export_to_file() missing (ext/openssl/openssl.c) #20273
Description
Category
stdlib · php-src-strict · ext/openssl X.509 PEM export (extends #6274)
Problem
Certificates can be created via openssl_csr_sign(), and fingerprint/verify exist, but Zend’s openssl_x509_export() / openssl_x509_export_to_file() are not registered — apps cannot round-trip a certificate object back to PEM/file.
| Repro | Zend 8.2+ | VM (2026-07-17) |
|---|---|---|
function_exists('openssl_x509_export') |
1 |
0 |
function_exists('openssl_x509_export_to_file') |
1 |
0 |
$out=''; openssl_x509_export($cert, $out); strlen($out)>0 |
true / PEM |
fatal undefined function |
Minimal setup that works on Zend: openssl_pkey_new → openssl_csr_new → openssl_csr_sign → openssl_x509_export.
php-src reference
- php/php-src
ext/openssl/openssl.stub.php—openssl_x509_export/openssl_x509_export_to_file - php/php-src
ext/openssl/openssl.c—PHP_FUNCTION(openssl_x509_export)/openssl_x509_export_to_file
PHP implementation target
ext/openssl/openssl_x509_export.php+openssl_x509_export_to_file.phpInternals- Reuse PEM helpers in
ext/openssl/VmOpensslX509Native.php/VmOpenssl.php(PHP-in-PHP; thin OpenSSL ABI only if already present for fingerprint) - Register in
ext/openssl/Module.php - Prefer PHP lowering; no new hand-written C logic beyond existing native helpers
Repro
./script/docker-exec.sh -- bash -lc 'php bin/vm.php -r "var_export(function_exists(\"openssl_x509_export\")); echo PHP_EOL; var_export(function_exists(\"openssl_x509_export_to_file\")); echo PHP_EOL;"'Expected: both true. Today: both false.
Done when (php-src-strict)
- Both functions registered; export fills by-ref PEM matching Zend structure (BEGIN CERTIFICATE)
-
export_to_filewrites readable PEM; false + warning on I/O failure like Zend - TypeError texts match openssl.stub.php argument names
- Compliance
.phptundertest/compliance/cases/; VM required, JIT/AOT as available - php-src-strict; no php-compiler-strict shortcut
Related
- Stdlib: openssl_x509_read()/openssl_x509_parse() — X.509 PEM/DER introspection missing (ext/openssl/xp.c) #6274 · Stdlib: openssl_x509_fingerprint() — certificate fingerprint API missing (ext/openssl/x509.c) #6524 (fingerprint) · sibling checkpurpose/check_private_key gaps
Activity
PurHur commentedon Jul 17, 2026
claim: PHP Compiler Ext — I/O & Crypto — starting this run
Implementing
openssl_x509_export()/openssl_x509_export_to_file()(PHP-in-PHP; reuse VmOpenssl X.509 helpers).PurHur commentedon Jul 17, 2026
Sibling gaps filed: #20285 (check_private_key), #20286 (checkpurpose), #20287 (pkey_export_to_file). Export (#20273) unblocks richer check_private_key compliance fixtures.
Stdlib: openssl_x509_export()/export_to_file() PEM round-trip (#20273) (
PurHur commentedon Jul 17, 2026
Merged via #20296
Verification (Docker):
function_exists(openssl_x509_export|export_to_file)→ truephp bin/vm.php test/repro/openssl_x509_export_20273.php→ ok--filter openssl_x509_export→ OK (2)php-src-strict PEM (+ optional text) via
VmOpensslX509Native::exportCertificatePem; no new C.Stdlib: openssl_x509_export JIT/AOT lowering (#32557) (#32561)
AOT: bake openssl_x509_export_to_file() from compile-time PEM+path (#…