openssl_pkcs7_encrypt - PHP code example

PHP Function OpenSSL

php function openssl_pkcs7_encrypt is used to encrypt your data before sending it via email. This will prevent others from reading your message and if you use the sign-encrypt-sign again method it can also make sure that only the intended recipient reads your message.

bool openssl_pkcs7_verify (mixed $x509, array $certs) - openssl_pkcs7_verify() checks the certificate stored in a PKCS#12 file for validity.

int openssl_x509_parse (mixed $x509certdata) - openssl_x509_parse() returns information about the supplied x509 certificate, including short names, issuer name, purposes, valid from and valid to dates etc.

bool openssl_csr_sign (mixed $csr, mixed $cacert, mixed $priv_key) - openssl_csr_sign() creates an x509 certificate resource from the given CSR.

openssl_free_key (resource $key_identifier) - openssl_free_key() frees the key associated with the specified key_identifier from memory.

OpenSSL ciphers are based on an Initialization Vector (IV) which is an arbitary random value used as a seed, along with the encryption key to encrypt your data. The addition of an IV prevents patterns from developing in your cipher data which could be used to break the cipher.

Currently the php_openssl extension only supports the RC2/40bit cipher. If you want to enable other ciphers it is possible by recompiling the extension source code and replacing the EVP_rc2_40_cbc() call with the appropriate cipher. For further details please refer to the recompiling documentation.

openssl_pkcs7_encrypt example

$this->cipher = $cipher ?? \OPENSSL_CIPHER_AES_256_CBC;
    }

    public function encrypt(Message $message): Message
    {
        $bufferFile = tmpfile();
        $outputFile = tmpfile();

        $this->iteratorToFile($message->toIterable(), $bufferFile);

        if (!@openssl_pkcs7_encrypt(stream_get_meta_data($bufferFile)['uri'], stream_get_meta_data($outputFile)['uri'], $this->certs, [], 0, $this->cipher)) {
            throw new RuntimeException(sprintf('Failed to encrypt S/Mime message. Error: "%s".', openssl_error_string()));
        }

        $mimePart = $this->convertMessageToSMimePart($outputFile, 'application', 'pkcs7-mime');
        $mimePart->getHeaders()
            ->addTextHeader('Content-Transfer-Encoding', 'base64')
            ->addParameterizedHeader('Content-Disposition', 'attachment', ['name' => 'smime.p7m'])
        ;

        return new Message($message->getHeaders(), $mimePart);
    }
}