Stdlib: openssl_x509_verify() — certificate signature verification missing (ext/openssl/x509.c) #6595

Category

stdlib

Problem

openssl_x509_verify() validates an X.509 certificate against a public key / CA material. Zend registers it in ext/openssl; this compiler has partial OpenSSL coverage (#3324, #6524, #6559) but openssl_x509_verify() is not registered — function_exists('openssl_x509_verify') is false on bin/vm.php.

php-src reference

• php/php-src ext/openssl/x509.c — PHP_FUNCTION(openssl_x509_verify)
• php/php-src ext/openssl/openssl.stub.php

Repro (failure today)

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php bin/vm.php -r "var_export(function_exists(\"openssl_x509_verify\"));"
php -r "var_export(function_exists(\"openssl_x509_verify\"));"
'

Once registered, verify against a self-signed PEM fixture:

$cert = openssl_x509_read(file_get_contents('test/fixtures/openssl/selfsigned.pem'));
$key  = openssl_pkey_get_public($cert);
var_export(openssl_x509_verify($cert, $key)); // Zend: 1

(Use an existing repo fixture or add minimal PEM under test/fixtures/openssl/.)

Scope (this repo)

Prefer PHP implementation in ext/openssl/; avoid permanent C-only builtins unless migrating out of C.

Done when

• function_exists('openssl_x509_verify') is true on VM
• Self-signed fixture returns 1; tampered cert or wrong key returns 0 or false matching Zend
• Enum-case operand raises catchable TypeError, not LogicException
• Compliance: test/compliance/cases/stdlib/openssl_x509_verify.phpt green on VM

Strictness: php-src-strict

Related

• Stdlib: ext/openssl — openssl_encrypt/decrypt/sign/verify (ext/openssl parity) #3324 encrypt/decrypt/sign/verify umbrella
• Stdlib: openssl_x509_fingerprint() — certificate fingerprint API missing (ext/openssl/x509.c) #6524 openssl_x509_fingerprint()
• Stdlib: openssl_get_publickey()/openssl_pkey_get_*()/openssl_error_string()/openssl_pkey_get_details() — key resource API missing (ext/openssl/xp.c) #6559 key resource API