Public Member Functions
	createCrt ($name, $destPath=null)
	delSslCertificate ()
	delSslCertificateHandler ($window, $id, $ctrl, $param1, $param2)
	ensureFirefoxTrustPrompt ()
	existsCrt ($name)
	genSslCertificate ()
	genSslCertificateHandler ($window, $id, $ctrl, $param1, $param2)
	getCrts ()
	isExpired ($name)
	makeRootCa ()
	rebuildAllCerts ()
	removeCrt ($name, $destPath=null)

Private Member Functions
	ensureMkcertExeExists ()
	ensureRootCaExists ($destPath)
	ensureSslDirExists ()
	getFirefoxProfileDirs ()
	isFirefoxEnterpriseRootsConfigured ()
	maybePromptTrustRootCa ($rootCaPath, $force)
	trustRootCaInFirefox ($rootCaPath)
	validateCertificateName ($name)

Private Attributes
	$firefoxTrustDeclinedFile = 'firefoxTrustDeclined'
	$rootCaName = 'BearsamppRootCA'
	$trustPromptShownThisRun = false
	$wbDelSslBtnCancel
	$wbDelSslBtnDelete
	$wbDelSslBtnDest
	$wbDelSslInputDest
	$wbDelSslListCerts
	$wbDelSslProgressBar
	$wbGenSslBtnCancel
	$wbGenSslBtnDest
	$wbGenSslBtnSave
	$wbGenSslInputDest
	$wbGenSslInputName
	$wbGenSslProgressBar

Detailed Description

Class OpenSsl

Provides SSL certificate management for the Bearsampp environment. Generates, removes, and rebuilds SSL certificates using mkcert and configures browser trust for the Bearsampp Root CA.

Definition at line 18 of file class.openssl.php.

Member Function Documentation

◆ createCrt()

createCrt	(		$name,
			$destPath = null )

Creates a certificate with the specified name and destination path.

Parameters

string	$name	The name of the certificate.
string \| null	$destPath	The destination path where the certificate files will be saved. If null, the default SSL path is used.

Returns: bool True if the certificate was created successfully, false otherwise.

Definition at line 218 of file class.openssl.php.

    {
        Log::trace('createCrt called for: ' . $name . ($destPath ? ' (dest: ' . $destPath . ')' : ''));
 
        if (!$this->validateCertificateName($name)) {
            Log::error('Invalid certificate name: ' . $name);
 
            return false;
        }
 
        if (!$this->ensureMkcertExeExists()) {
            return false;
        }
        if (empty($destPath)) {
            $destPath = $this->ensureSslDirExists();
        }
        $mkcertExe = Path::getMkcertExe();
 
        if (!$this->ensureRootCaExists($destPath)) {
            Log::error('Failed to ensure Root CA exists for: ' . $name);
 
            return false;
        }
 
        $crtPath    = '"' . Path::formatWindowsPath($destPath . '/' . $name . '.crt') . '"';
        $pubPath    = '"' . Path::formatWindowsPath($destPath . '/' . $name . '.pub') . '"';
        $keyPath    = '"' . Path::formatWindowsPath($destPath . '/' . $name . '.ppk') . '"'; // Using .ppk as requested in previous tasks
        $opensslExe = '"' . Path::formatWindowsPath(Path::getOpenSslExe()) . '"';
 
        $batch = 'SET "CAROOT=' . Path::formatWindowsPath($destPath) . '"' . PHP_EOL;
 
        $mkcertNames = '"' . $name . '"';
        if ($name === 'localhost') {
            $mkcertNames .= ' ' . APP_LOCALHOST . ' ::1';
        } else {
            $mkcertNames .= ' "*.' . $name . '" localhost ' . APP_LOCALHOST . ' ::1';
        }
 
        Log::trace('Executing mkcert for "' . $name . '"');
        // Use -- to terminate flag parsing before hostname arguments as defense-in-depth
        $batch .= '"' . $mkcertExe . '" -cert-file ' . $crtPath . ' -key-file ' . $keyPath . ' -- ' . $mkcertNames . PHP_EOL;
        $batch .= $opensslExe . " rsa -in " . $keyPath . " -out " . $keyPath . " -passin pass:" . PHP_EOL;
        $batch .= "COPY /Y " . $keyPath . " " . $pubPath . PHP_EOL;
        $batch .= 'IF EXIST ' . $crtPath . ' IF EXIST ' . $keyPath . ' ECHO OK' . PHP_EOL;
 
        Log::trace('Creating SSL Certificate for "' . $name . '" using mkcert. Batch content: ' . $batch);
        $result = Batch::exec('createCertificateMkcert', $batch);
 
        if ($result === false || !is_array($result)) {
            Log::error('Batch execution failed for mkcert generation of "' . $name . '". Check logs for createCertificateMkcert.');
 
            return false;
        }
 
        $success = false;
        foreach ($result as $line) {
            if (trim($line) === 'OK') {
                $success = true;
                break;
            }
        }
 
        if (!$success) {
            Log::error('mkcert generation for "' . $name . '" did not return OK. Output: ' . implode(' | ', $result));
        }
        Log::trace('mkcert generation for "' . $name . '": ' . ($success ? 'SUCCESS' : 'FAILURE'));
 
        return $success;
    }

References $result, APP_LOCALHOST, ensureMkcertExeExists(), ensureRootCaExists(), ensureSslDirExists(), Log\error(), Batch\exec(), Path\formatWindowsPath(), Path\getMkcertExe(), Path\getOpenSslExe(), Log\trace(), and validateCertificateName().

Referenced by makeRootCa(), and rebuildAllCerts().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ delSslCertificate()

delSslCertificate ( )

Displays a WinBinder GUI for deleting an SSL certificate.

Definition at line 533 of file class.openssl.php.

    {
        global $bearsamppLang, $bearsamppWinbinder;
 
        $initServerName   = 'test.local';
        $initDocumentRoot = Path::formatWindowsPath(Path::getSslPath());
 
        $bearsamppWinbinder->reset();
        $wbWindow = $bearsamppWinbinder->createAppWindow($bearsamppLang->getValue(Lang::DELSSL_TITLE), 490, 160, WBC_NOTIFY, WBC_KEYDOWN | WBC_KEYUP);
 
        $wbLabelName             = $bearsamppWinbinder->createLabel($wbWindow, $bearsamppLang->getValue(Lang::NAME) . ' :', 15, 15, 85, null, WBC_RIGHT);
        $this->wbDelSslListCerts = $bearsamppWinbinder->createInputText($wbWindow, $initServerName, 105, 13, 150, null);
 
        $wbLabelDest             = $bearsamppWinbinder->createLabel($wbWindow, $bearsamppLang->getValue(Lang::TARGET) . ' :', 15, 45, 85, null, WBC_RIGHT);
        $this->wbDelSslInputDest = $bearsamppWinbinder->createInputText($wbWindow, $initDocumentRoot, 105, 43, 190, null, null, WBC_READONLY);
        $this->wbDelSslBtnDest   = $bearsamppWinbinder->createButton($wbWindow, $bearsamppLang->getValue(Lang::BUTTON_BROWSE), 300, 43, 110);
 
        $this->wbDelSslProgressBar = $bearsamppWinbinder->createProgressBar($wbWindow, 3, 15, 97, 275);
        $this->wbDelSslBtnDelete   = $bearsamppWinbinder->createButton($wbWindow, $bearsamppLang->getValue(Lang::BUTTON_DELETE), 300, 92);
        $this->wbDelSslBtnCancel   = $bearsamppWinbinder->createButton($wbWindow, $bearsamppLang->getValue(Lang::BUTTON_CANCEL), 387, 92);
 
        $bearsamppWinbinder->setHandler($wbWindow, $this, 'delSslCertificateHandler');
 
        $bearsamppWinbinder->mainLoop();
        $bearsamppWinbinder->reset();
    }

References $bearsamppLang, Lang\BUTTON_BROWSE, Lang\BUTTON_CANCEL, Lang\BUTTON_DELETE, Lang\DELSSL_TITLE, Path\formatWindowsPath(), Path\getSslPath(), Lang\NAME, and Lang\TARGET.

Here is the call graph for this function:

◆ delSslCertificateHandler()

delSslCertificateHandler	(	$window,
		$id,
		$ctrl,
		$param1,
		$param2 )

Handler for the SSL certificate deletion WinBinder GUI.

Parameters

mixed	$window	The window object where the event occurred.
int	$id	The ID of the event.
mixed	$ctrl	The control that triggered the event.
mixed	$param1	The first parameter of the event.
mixed	$param2	The second parameter of the event.

Definition at line 569 of file class.openssl.php.

    {
        global $bearsamppLang, $bearsamppOpenSsl, $bearsamppWinbinder;
 
        switch ($id) {
            case $this->wbDelSslBtnDest[WinBinder::CTRL_ID]:
                $target = $bearsamppWinbinder->getText($this->wbDelSslInputDest[WinBinder::CTRL_OBJ]);
                $target = $bearsamppWinbinder->sysDlgPath($window, $bearsamppLang->getValue(Lang::GENSSL_PATH), $target);
                if ($target && is_dir($target)) {
                    $bearsamppWinbinder->setText($this->wbDelSslInputDest[WinBinder::CTRL_OBJ], $target . '\\');
                }
                break;
            case $this->wbDelSslBtnDelete[WinBinder::CTRL_ID]:
                $cert   = $bearsamppWinbinder->getText($this->wbDelSslListCerts[WinBinder::CTRL_OBJ]);
                $target = $bearsamppWinbinder->getText($this->wbDelSslInputDest[WinBinder::CTRL_OBJ]);
 
                if ($cert) {
                    $existingCerts = $this->getCrts();
                    if (!in_array($cert, $existingCerts)) {
                        $bearsamppWinbinder->messageBoxError(
                            sprintf($bearsamppLang->getValue(Lang::ERROR_FILE_NOT_FOUND), $cert, $target),
                            $bearsamppLang->getValue(Lang::DELSSL_TITLE)
                        );
 
                        return;
                    }
 
                    $bearsamppWinbinder->setProgressBarMax($this->wbDelSslProgressBar, 3);
                    $bearsamppWinbinder->incrProgressBar($this->wbDelSslProgressBar);
 
                    $target = Path::formatUnixPath($target);
                    if ($bearsamppOpenSsl->removeCrt($cert, $target)) {
                        $bearsamppWinbinder->incrProgressBar($this->wbDelSslProgressBar);
                        $bearsamppWinbinder->messageBoxInfo(
                            sprintf($bearsamppLang->getValue(Lang::DELSSL_DELETED), $cert),
                            $bearsamppLang->getValue(Lang::DELSSL_TITLE)
                        );
                        $bearsamppWinbinder->destroyWindow($window);
                    } else {
                        $bearsamppWinbinder->messageBoxError($bearsamppLang->getValue(Lang::DELSSL_DELETED_ERROR), $bearsamppLang->getValue(Lang::DELSSL_TITLE));
                        $bearsamppWinbinder->resetProgressBar($this->wbDelSslProgressBar);
                    }
                }
                break;
            case IDCLOSE:
            case $this->wbDelSslBtnCancel[WinBinder::CTRL_ID]:
                $bearsamppWinbinder->destroyWindow($window);
                break;
        }
    }

References $bearsamppLang, WinBinder\CTRL_ID, WinBinder\CTRL_OBJ, Lang\DELSSL_DELETED, Lang\DELSSL_DELETED_ERROR, Lang\DELSSL_TITLE, Lang\ERROR_FILE_NOT_FOUND, Path\formatUnixPath(), Lang\GENSSL_PATH, and getCrts().

Here is the call graph for this function:

◆ ensureFirefoxTrustPrompt()

ensureFirefoxTrustPrompt ( )

Checks whether the SSL Root CA should be trusted, asking the user if necessary. Called during startup so that an existing (previously untrusted) Root CA can be trusted without having to regenerate it.

Returns: bool True if the Root CA exists and the trust state was checked.

Definition at line 341 of file class.openssl.php.

    {
        $destPath   = Path::getSslPath();
        $rootCaPath = $destPath . '/' . Path::getMkcertRootCaName();
        if (!file_exists($rootCaPath)) {
            return false;
        }
 
        $this->maybePromptTrustRootCa($rootCaPath, false);
 
        return true;
    }

References Path\getMkcertRootCaName(), Path\getSslPath(), and maybePromptTrustRootCa().

Here is the call graph for this function:

◆ ensureMkcertExeExists()

ensureMkcertExeExists ( )

private

Ensures that the mkcert executable exists, attempting to download it if missing.

Returns: bool True if mkcert exists or was successfully downloaded.

Definition at line 58 of file class.openssl.php.

    {
        $mkcertExe = Path::getMkcertExe();
        if (file_exists($mkcertExe)) {
            return true;
        }
 
        Log::error('mkcert.exe missing at: ' . $mkcertExe . '. It must be fetched during build time (prepareBase/buildFull/buildLite).');
 
        return false;
    }

References Log\error(), and Path\getMkcertExe().

Referenced by createCrt(), ensureRootCaExists(), and makeRootCa().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ ensureRootCaExists()

ensureRootCaExists ( $destPath )

private

Ensures that the Root CA exists, creating it if necessary.

Parameters

string $destPath The destination path.

Returns: bool True if the Root CA exists or was created successfully.

Definition at line 295 of file class.openssl.php.

    {
        if (!$this->ensureMkcertExeExists()) {
            return false;
        }
        $mkcertExe = Path::getMkcertExe();
 
        $rootCaPath = $destPath . '/' . Path::getMkcertRootCaName(); // mkcert default root CA name
        if (!file_exists($rootCaPath)) {
            Log::info('Root CA missing at ' . $rootCaPath . '. Running mkcert -install');
            $batch  = 'SET "CAROOT=' . Path::formatWindowsPath($destPath) . '"' . PHP_EOL;
            $batch  .= '"' . $mkcertExe . '" -install' . PHP_EOL;
            $batch  .= 'IF EXIST "' . Path::formatWindowsPath($rootCaPath) . '" (ECHO OK)' . PHP_EOL;
            $result = Batch::exec('mkcertInstall', $batch);
 
            if ($result === false) {
                Log::error('Batch execution failed for mkcert -install');
 
                return false;
            }
 
            // Re-check after installation
            if (!file_exists($rootCaPath)) {
                Log::error('Root CA still missing after mkcert -install at: ' . $rootCaPath);
 
                return false;
            }
            Log::info('Root CA successfully created and verified.');
 
            // A brand new Root CA was created: ask the user whether to trust it
            $this->maybePromptTrustRootCa($rootCaPath, true);
        } else {
            // Root CA already exists: if Firefox does not trust it yet, offer to configure it
            $this->maybePromptTrustRootCa($rootCaPath, false);
        }
 
        return true;
    }

References $result, ensureMkcertExeExists(), Log\error(), Batch\exec(), Path\formatWindowsPath(), Path\getMkcertExe(), Path\getMkcertRootCaName(), Log\info(), and maybePromptTrustRootCa().

Referenced by createCrt().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ ensureSslDirExists()

ensureSslDirExists ( )

private

Ensures that the SSL directory exists, creating it if necessary.

Returns: string The SSL path.

Definition at line 75 of file class.openssl.php.

    {
        $sslPath = Path::getSslPath();
        if (!is_dir($sslPath)) {
            Log::info('SSL directory missing, creating: ' . $sslPath);
            if (mkdir($sslPath, 0700, true)) {
                @chmod($sslPath, 0700);
                // Create .gitignore if the directory was just created
                $gitignorePath = $sslPath . '/.gitignore';
                if (!file_exists($gitignorePath)) {
                    file_put_contents($gitignorePath, '# git holder' . PHP_EOL);
                }
            } else {
                Log::error('Failed to create SSL directory: ' . $sslPath);
            }
        } else {
            // Even if directory exists, ensure .gitignore is present
            $gitignorePath = $sslPath . '/.gitignore';
            if (!file_exists($gitignorePath)) {
                file_put_contents($gitignorePath, '# git holder' . PHP_EOL);
            }
        }
 
        if (!is_readable($sslPath) || !is_writable($sslPath)) {
            Log::warning('SSL directory is not fully accessible. Attempting to relax permissions: ' . $sslPath);
 
            // Set permissive permissions for local dev environment (0755 allows owner RWX, group/others RX)
            @chmod($sslPath, 0755);
            clearstatcache(true, $sslPath);
 
            if (!is_readable($sslPath) || !is_writable($sslPath)) {
                Log::error('SSL directory is still not readable/writable after permission adjustment: ' . $sslPath);
            }
        }
 
        return $sslPath;
    }

References Log\error(), Path\getSslPath(), Log\info(), and Log\warning().

Referenced by createCrt(), getCrts(), and removeCrt().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ existsCrt()

existsCrt ( $name )

Checks if a certificate with the specified name exists.

Parameters

string $name The name of the certificate.

Returns: bool True if the certificate exists, false otherwise.

Definition at line 627 of file class.openssl.php.

    {
        $ppkPath = Path::getSslPath() . '/' . $name . '.ppk';
        $crtPath = Path::getSslPath() . '/' . $name . '.crt';
 
        return is_file($ppkPath) && is_file($crtPath);
    }

References Path\getSslPath().

Here is the call graph for this function:

◆ genSslCertificate()

genSslCertificate ( )

Displays a WinBinder GUI for generating an SSL certificate.

Definition at line 638 of file class.openssl.php.

    {
        global $bearsamppLang, $bearsamppWinbinder;
 
        $initServerName   = 'test.local';
        $initDocumentRoot = Path::formatWindowsPath(Path::getSslPath());
 
        $bearsamppWinbinder->reset();
        $wbWindow = $bearsamppWinbinder->createAppWindow($bearsamppLang->getValue(Lang::GENSSL_TITLE), 490, 160, WBC_NOTIFY, WBC_KEYDOWN | WBC_KEYUP);
 
        $wbLabelName             = $bearsamppWinbinder->createLabel($wbWindow, $bearsamppLang->getValue(Lang::NAME) . ' :', 15, 15, 85, null, WBC_RIGHT);
        $this->wbGenSslInputName = $bearsamppWinbinder->createInputText($wbWindow, $initServerName, 105, 13, 150, null);
 
        $wbLabelDest             = $bearsamppWinbinder->createLabel($wbWindow, $bearsamppLang->getValue(Lang::TARGET) . ' :', 15, 45, 85, null, WBC_RIGHT);
        $this->wbGenSslInputDest = $bearsamppWinbinder->createInputText($wbWindow, $initDocumentRoot, 105, 43, 190, null, null, WBC_READONLY);
        $this->wbGenSslBtnDest   = $bearsamppWinbinder->createButton($wbWindow, $bearsamppLang->getValue(Lang::BUTTON_BROWSE), 300, 43, 110);
 
        $this->wbGenSslProgressBar = $bearsamppWinbinder->createProgressBar($wbWindow, 3, 15, 97, 275);
        $this->wbGenSslBtnSave     = $bearsamppWinbinder->createButton($wbWindow, $bearsamppLang->getValue(Lang::BUTTON_SAVE), 300, 92);
        $this->wbGenSslBtnCancel   = $bearsamppWinbinder->createButton($wbWindow, $bearsamppLang->getValue(Lang::BUTTON_CANCEL), 387, 92);
 
        $bearsamppWinbinder->setHandler($wbWindow, $this, 'genSslCertificateHandler');
 
        $bearsamppWinbinder->mainLoop();
        $bearsamppWinbinder->reset();
    }

References $bearsamppLang, Lang\BUTTON_BROWSE, Lang\BUTTON_CANCEL, Lang\BUTTON_SAVE, Path\formatWindowsPath(), Lang\GENSSL_TITLE, Path\getSslPath(), Lang\NAME, and Lang\TARGET.

Here is the call graph for this function:

◆ genSslCertificateHandler()

genSslCertificateHandler	(	$window,
		$id,
		$ctrl,
		$param1,
		$param2 )

Handler for the SSL certificate generation WinBinder GUI.

Parameters

mixed	$window	The window object where the event occurred.
int	$id	The ID of the event.
mixed	$ctrl	The control that triggered the event.
mixed	$param1	The first parameter of the event.
mixed	$param2	The second parameter of the event.

Definition at line 674 of file class.openssl.php.

    {
        global $bearsamppLang, $bearsamppOpenSsl, $bearsamppWinbinder;
 
        switch ($id) {
            case $this->wbGenSslBtnDest[WinBinder::CTRL_ID]:
                $target = $bearsamppWinbinder->getText($this->wbGenSslInputDest[WinBinder::CTRL_OBJ]);
                $target = $bearsamppWinbinder->sysDlgPath($window, $bearsamppLang->getValue(Lang::GENSSL_PATH), $target);
                if ($target && is_dir($target)) {
                    $bearsamppWinbinder->setText($this->wbGenSslInputDest[WinBinder::CTRL_OBJ], $target . '\\');
                }
                break;
            case $this->wbGenSslBtnSave[WinBinder::CTRL_ID]:
                $name   = $bearsamppWinbinder->getText($this->wbGenSslInputName[WinBinder::CTRL_OBJ]);
                $target = $bearsamppWinbinder->getText($this->wbGenSslInputDest[WinBinder::CTRL_OBJ]);
 
                $bearsamppWinbinder->setProgressBarMax($this->wbGenSslProgressBar, 3);
                $bearsamppWinbinder->incrProgressBar($this->wbGenSslProgressBar);
 
                $target = Path::formatUnixPath($target);
                if ($bearsamppOpenSsl->createCrt($name, $target)) {
                    $bearsamppWinbinder->incrProgressBar($this->wbGenSslProgressBar);
                    $bearsamppWinbinder->messageBoxInfo(
                        sprintf($bearsamppLang->getValue(Lang::GENSSL_CREATED), $name),
                        $bearsamppLang->getValue(Lang::GENSSL_TITLE)
                    );
                    $bearsamppWinbinder->destroyWindow($window);
                } else {
                    $bearsamppWinbinder->messageBoxError($bearsamppLang->getValue(Lang::GENSSL_CREATED_ERROR), $bearsamppLang->getValue(Lang::GENSSL_TITLE));
                    $bearsamppWinbinder->resetProgressBar($this->wbGenSslProgressBar);
                }
                break;
            case IDCLOSE:
            case $this->wbGenSslBtnCancel[WinBinder::CTRL_ID]:
                $bearsamppWinbinder->destroyWindow($window);
                break;
        }
    }

References $bearsamppLang, WinBinder\CTRL_ID, WinBinder\CTRL_OBJ, Path\formatUnixPath(), Lang\GENSSL_CREATED, Lang\GENSSL_CREATED_ERROR, Lang\GENSSL_PATH, and Lang\GENSSL_TITLE.

Here is the call graph for this function:

◆ getCrts()

getCrts ( )

Retrieves existing certificates from the SSL directory.

Returns: array List of certificate names.

Definition at line 718 of file class.openssl.php.

    {
        $sslPath = $this->ensureSslDirExists();
        $certs   = [];
        if (is_dir($sslPath)) {
            $files = glob($sslPath . '/*.crt');
            if ($files !== false) {
                foreach ($files as $file) {
                    $certs[] = basename($file, '.crt');
                }
            }
        }
        sort($certs);
 
        return $certs;
    }

References ensureSslDirExists().

Referenced by delSslCertificateHandler(), and rebuildAllCerts().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ getFirefoxProfileDirs()

getFirefoxProfileDirs ( )

private

Finds the Firefox profile directories that contain a prefs.js file.

Returns: array List of absolute paths to Firefox profiles.

Definition at line 428 of file class.openssl.php.

    {
        $dirs         = array();
        $bases        = array();
        $appData      = getenv('APPDATA');
        $localAppData = getenv('LOCALAPPDATA');
        if (!empty($appData)) {
            $bases[] = $appData . '/Mozilla/Firefox/Profiles';
        }
        if (!empty($localAppData)) {
            $bases[] = $localAppData . '/Mozilla/Firefox/Profiles';
        }
 
        foreach ($bases as $base) {
            if (!is_dir($base)) {
                continue;
            }
            $entries = @scandir($base);
            if ($entries === false) {
                continue;
            }
            foreach ($entries as $entry) {
                if ($entry === '.' || $entry === '..') {
                    continue;
                }
                $dir = $base . '/' . $entry;
                if (is_dir($dir) && file_exists($dir . '/prefs.js')) {
                    $dirs[] = $dir;
                }
            }
        }
 
        return array_values(array_unique($dirs));
    }

Referenced by isFirefoxEnterpriseRootsConfigured(), and trustRootCaInFirefox().

Here is the caller graph for this function:

◆ isExpired()

isExpired ( $name )

Checks if a certificate with the specified name is expired or about to expire.

Parameters

string $name The name of the certificate.

Returns: bool True if the certificate is expired or missing, false otherwise.

Definition at line 742 of file class.openssl.php.

    {
        $crtPath = Path::getSslPath() . '/' . $name . '.crt';
        $pubPath = Path::getSslPath() . '/' . $name . '.pub';
 
        if (!is_file($crtPath)) {
            Log::trace('SSL certificate file missing: ' . $crtPath);
 
            return true;
        }
 
        if (!is_file($pubPath)) {
            Log::trace('SSL public certificate file missing: ' . $pubPath);
 
            return true;
        }
 
        if (!extension_loaded('openssl')) {
            Log::warning('OpenSSL extension not loaded. Cannot parse certificate for expiry check. Assuming NOT expired if file exists.');
 
            return false;
        }
 
        $crtContent = file_get_contents($crtPath);
        if ($crtContent === false) {
            Log::error('Could not read certificate file: ' . $crtPath);
 
            return true;
        }
 
        $certInfo = openssl_x509_parse($crtContent);
        if ($certInfo === false) {
            Log::error('Could not parse certificate: ' . $crtPath . '. OpenSSL error: ' . openssl_error_string());
 
            return true;
        }
 
        if (isset($certInfo['validTo_time_t'])) {
            $isExpired = $certInfo['validTo_time_t'] < time();
            if ($isExpired) {
                Log::trace('SSL certificate expired: ' . $name . ' (Expired on ' . date('Y-m-d H:i:s', $certInfo['validTo_time_t']) . ')');
            }
 
            return $isExpired;
        }
 
        Log::error('Could not find expiry date in certificate: ' . $crtPath);
 
        return true;
    }

References Log\error(), Path\getSslPath(), Log\trace(), and Log\warning().

Here is the call graph for this function:

◆ isFirefoxEnterpriseRootsConfigured()

isFirefoxEnterpriseRootsConfigured ( )

private

Checks whether all found Firefox profiles are configured to trust the system root certificates (security.enterprise_roots.enabled).

Returns: bool True if all profiles are configured, or if no Firefox profiles were found.

Definition at line 469 of file class.openssl.php.

    {
        $profiles = $this->getFirefoxProfileDirs();
        if (empty($profiles)) {
            return true;
        }
 
        foreach ($profiles as $profile) {
            $userJs  = $profile . '/user.js';
            $content = file_exists($userJs) ? @file_get_contents($userJs) : '';
            if ($content === false) {
                $content = '';
            }
            if (!preg_match('/user_pref\‍(\s*["\']security\.enterprise_roots\.enabled["\']\s*,\s*true\s*\‍)/i', $content)) {
                return false;
            }
        }
 
        return true;
    }

References getFirefoxProfileDirs().

Referenced by maybePromptTrustRootCa().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ makeRootCa()

makeRootCa ( )

Creates a new Root CA and reinstalls it, then rebuilds all certificates.

Returns: bool True if successful.

Definition at line 118 of file class.openssl.php.

    {
        if (!$this->ensureMkcertExeExists()) {
            return false;
        }
        $destPath  = Path::getSslPath();
        $mkcertExe = Path::getMkcertExe();
 
        Log::info('Creating new Root CA and installing it...');
 
        $rootCaPath = Path::getSslPath() . '/' . Path::getMkcertRootCaName();
        $batch      = 'SET "CAROOT=' . Path::formatWindowsPath(Path::getSslPath()) . '"' . PHP_EOL;
        $batch      .= '"' . $mkcertExe . '" -uninstall' . PHP_EOL;
        $batch      .= '"' . $mkcertExe . '" -install' . PHP_EOL;
        $batch      .= 'IF EXIST "' . Path::formatWindowsPath($rootCaPath) . '" (ECHO OK)' . PHP_EOL;
 
        // Wait for the Root CA file to appear or timeout
        $result = Batch::exec('mkcertMakeRootCa', $batch);
 
        if (!file_exists($rootCaPath)) {
            Log::error('Failed to create Root CA file at: ' . $rootCaPath);
 
            return false;
        }
 
        // Display info about the new Root CA
        $batch      = 'SET "CAROOT=' . Path::formatWindowsPath(Path::getSslPath()) . '"' . PHP_EOL;
        $batch      .= '"' . $mkcertExe . '" -CAROOT' . PHP_EOL;
        $caRootInfo = Batch::exec('mkcertCaRootInfo', $batch);
        if ($caRootInfo && isset($caRootInfo[0])) {
            Log::info('mkcert CAROOT is set to: ' . $caRootInfo[0]);
        }
 
        // A brand new Root CA was created: ask the user whether to trust it
        $this->maybePromptTrustRootCa($rootCaPath, true);
 
        Log::info('Root CA created. Rebuilding all existing certificates and ensuring localhost exists...');
 
        // Ensure localhost is created/rebuilt
        $this->createCrt('localhost');
 
        return $this->rebuildAllCerts();
    }

References $result, createCrt(), ensureMkcertExeExists(), Log\error(), Batch\exec(), Path\formatWindowsPath(), Path\getMkcertExe(), Path\getMkcertRootCaName(), Path\getSslPath(), Log\info(), maybePromptTrustRootCa(), and rebuildAllCerts().

Here is the call graph for this function:

◆ maybePromptTrustRootCa()

maybePromptTrustRootCa	(		$rootCaPath,
			$force )

private

Asks the user whether to trust the SSL Root CA and, if accepted, configures the browsers to trust it. The prompt is shown at most once per run.

Parameters

string	$rootCaPath	The path to the Root CA certificate file.
bool	$force	True when a brand new Root CA was just created, false when checking an existing one.

Returns: bool True if the user accepted and the trust was configured, false otherwise.

Definition at line 363 of file class.openssl.php.

    {
        global $bearsamppLang, $bearsamppWinbinder;
 
        if ($this->trustPromptShownThisRun) {
            return false;
        }
 
        $declinedFile = Path::getSslPath() . '/' . $this->firefoxTrustDeclinedFile;
 
        if ($force) {
            // A brand new Root CA was created: forget any previous decline and offer trust again
            @unlink($declinedFile);
        } else {
            // Existing Root CA: only offer to configure Firefox if it is not configured yet
            if ($this->isFirefoxEnterpriseRootsConfigured()) {
                return false;
            }
            if (file_exists($declinedFile)) {
                Log::info('Skipping SSL Root CA trust prompt (previously declined).');
 
                return false;
            }
        }
 
        $this->trustPromptShownThisRun = true;
 
        $message = $force
            ? $bearsamppLang->getValue(Lang::SSL_TRUST_ROOT_CA_MSG)
            : $bearsamppLang->getValue(Lang::SSL_TRUST_FIREFOX_MSG);
        $title   = $bearsamppLang->getValue(Lang::SSL_TRUST_ROOT_CA_TITLE);
 
        $trusted = false;
        if (is_object($bearsamppWinbinder) && method_exists($bearsamppWinbinder, 'messageBoxYesNo')) {
            $trusted = (bool)$bearsamppWinbinder->messageBoxYesNo($message, $title);
        } else {
            Log::warning('WinBinder not available, cannot prompt to trust the SSL Root CA.');
        }
 
        if (!$trusted) {
            Log::info('User declined to trust the SSL Root CA: ' . $rootCaPath);
            file_put_contents($declinedFile, date('Y-m-d H:i:s') . PHP_EOL);
 
            return false;
        }
 
        Log::info('User accepted to trust the SSL Root CA. Configuring browsers...');
        $this->trustRootCaInFirefox($rootCaPath);
        @unlink($declinedFile);
 
        if (is_object($bearsamppWinbinder) && method_exists($bearsamppWinbinder, 'messageBoxInfo')) {
            $bearsamppWinbinder->messageBoxInfo(
                $bearsamppLang->getValue(Lang::SSL_TRUST_ROOT_CA_DONE),
                $title
            );
        }
 
        return true;
    }

References $bearsamppLang, $firefoxTrustDeclinedFile, Path\getSslPath(), Log\info(), isFirefoxEnterpriseRootsConfigured(), Lang\SSL_TRUST_FIREFOX_MSG, Lang\SSL_TRUST_ROOT_CA_DONE, Lang\SSL_TRUST_ROOT_CA_MSG, Lang\SSL_TRUST_ROOT_CA_TITLE, trustRootCaInFirefox(), and Log\warning().

Referenced by ensureFirefoxTrustPrompt(), ensureRootCaExists(), and makeRootCa().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rebuildAllCerts()

rebuildAllCerts ( )

Rebuilds all existing certificates in the SSL directory.

Returns: bool True if all certificates were rebuilt successfully.

Definition at line 167 of file class.openssl.php.

    {
        $certs   = $this->getCrts();
        $success = true;
 
        foreach ($certs as $cert) {
            Log::info('Rebuilding certificate: ' . $cert);
            if (!$this->createCrt($cert)) {
                Log::error('Failed to rebuild certificate: ' . $cert);
                $success = false;
            }
        }
 
        return $success;
    }

References createCrt(), Log\error(), getCrts(), and Log\info().

Referenced by makeRootCa().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ removeCrt()

removeCrt	(		$name,
			$destPath = null )

Removes a certificate with the specified name.

Parameters

string	$name	The name of the certificate.
string \| null	$destPath	The destination path where the certificate files are saved. If null, the default SSL path is used.

Returns: bool True if the certificate was removed successfully, false otherwise.

Definition at line 801 of file class.openssl.php.

    {
        if ($name === 'localhost') {
            Log::warning('Attempted to remove protected "localhost" certificate. Operation cancelled.');
 
            return false;
        }
        $destPath = empty($destPath) ? $this->ensureSslDirExists() : $destPath;
 
        // Basic validation for name to prevent arbitrary file deletion
        if (!preg_match('/^[a-zA-Z0-9._-]+$/', $name)) {
            Log::error('Invalid certificate name for removal: ' . $name);
 
            return false;
        }
 
        $ppkPath = $destPath . '/' . $name . '.ppk';
        $crtPath = $destPath . '/' . $name . '.crt';
        $pubPath = $destPath . '/' . $name . '.pub';
 
        Log::info('Removing SSL certificate: ' . $name . ' from ' . $destPath);
 
        return @unlink($ppkPath) && @unlink($crtPath) && @unlink($pubPath);
    }

References ensureSslDirExists(), Log\error(), Log\info(), and Log\warning().

Here is the call graph for this function:

◆ trustRootCaInFirefox()

trustRootCaInFirefox ( $rootCaPath )

private

Configures all found Firefox profiles to trust the system root certificates, which makes HTTPS sites signed by the Bearsampp Root CA display the secure lock.

Parameters

string $rootCaPath The path to the Root CA certificate file.

Returns: void

Definition at line 498 of file class.openssl.php.

    {
        $profiles = $this->getFirefoxProfileDirs();
        if (empty($profiles)) {
            Log::info('No Firefox profiles found. Skipping Firefox SSL Root CA configuration.');
 
            return;
        }
 
        foreach ($profiles as $profile) {
            $userJs  = $profile . '/user.js';
            $content = file_exists($userJs) ? @file_get_contents($userJs) : '';
            if ($content === false) {
                $content = '';
            }
            $lines = $content === '' ? array() : explode("\n", str_replace("\r\n", "\n", $content));
 
            // Remove any existing enterprise_roots pref so we only keep the trusted one
            $lines = array_values(array_filter($lines, function ($line) {
                return preg_match('/security\.enterprise_roots\.enabled/i', trim($line)) ? false : true;
            }));
 
            $lines[] = 'user_pref("security.enterprise_roots.enabled", true);';
 
            if (@file_put_contents($userJs, implode("\n", $lines) . PHP_EOL) !== false) {
                Log::info('Configured Firefox profile to trust system root certificates: ' . $profile);
            } else {
                Log::error('Failed to write Firefox user.js: ' . $userJs);
            }
        }
    }

References Log\error(), getFirefoxProfileDirs(), and Log\info().

Referenced by maybePromptTrustRootCa().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ validateCertificateName()

validateCertificateName ( $name )

private

Validates the certificate name to prevent command injection attacks. Requires names to start with alphanumeric character to prevent mkcert flag injection. Uses filesystem-safe whitelist (same as removeCrt) to support existing cert names and prevent CMD metacharacter injection. Allows: alphanumeric, dots, dashes, underscores.

Parameters

string $name The certificate name to validate.

Returns: bool True if the name is valid, false otherwise.

Definition at line 193 of file class.openssl.php.

    {
        if (empty($name)) {
            return false;
        }
 
        // Filesystem-safe whitelist with mandatory alphanumeric first character:
        // - Prevents CLI flag injection (leading `-`)
        // - Prevents relative path traversal (leading `.`)
        // - Allows remaining chars to be alphanumeric, dots, dashes, underscores
        if (!preg_match('/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/', $name)) {
            return false;
        }
 
        return true;
    }

Referenced by createCrt().

Here is the caller graph for this function:

Field Documentation

◆ $firefoxTrustDeclinedFile

$firefoxTrustDeclinedFile = 'firefoxTrustDeclined'

private

Definition at line 50 of file class.openssl.php.

Referenced by maybePromptTrustRootCa().

◆ $rootCaName

$rootCaName = 'BearsamppRootCA'

private

Definition at line 46 of file class.openssl.php.

◆ $trustPromptShownThisRun

$trustPromptShownThisRun = false

private

Definition at line 48 of file class.openssl.php.

◆ $wbDelSslBtnCancel

$wbDelSslBtnCancel

private

Definition at line 44 of file class.openssl.php.

◆ $wbDelSslBtnDelete

$wbDelSslBtnDelete

private

Definition at line 42 of file class.openssl.php.

◆ $wbDelSslBtnDest

$wbDelSslBtnDest

private

Definition at line 38 of file class.openssl.php.

◆ $wbDelSslInputDest

$wbDelSslInputDest

private

Definition at line 36 of file class.openssl.php.

◆ $wbDelSslListCerts

$wbDelSslListCerts

private

Definition at line 34 of file class.openssl.php.

◆ $wbDelSslProgressBar

$wbDelSslProgressBar

private

Definition at line 40 of file class.openssl.php.

◆ $wbGenSslBtnCancel

$wbGenSslBtnCancel

private

Definition at line 31 of file class.openssl.php.

◆ $wbGenSslBtnDest

$wbGenSslBtnDest

private

Definition at line 25 of file class.openssl.php.

◆ $wbGenSslBtnSave

$wbGenSslBtnSave

private

Definition at line 29 of file class.openssl.php.

◆ $wbGenSslInputDest

$wbGenSslInputDest

private

Definition at line 23 of file class.openssl.php.

◆ $wbGenSslInputName

$wbGenSslInputName

private

Definition at line 21 of file class.openssl.php.

◆ $wbGenSslProgressBar

$wbGenSslProgressBar

private

Definition at line 27 of file class.openssl.php.

The documentation for this class was generated from the following file:

E:/Bearsampp-development/sandbox/core/classes/class.openssl.php

Public Member Functions

Private Member Functions

Private Attributes

Detailed Description

Member Function Documentation

◆ createCrt()

◆ delSslCertificate()

◆ delSslCertificateHandler()

◆ ensureFirefoxTrustPrompt()

◆ ensureMkcertExeExists()

◆ ensureRootCaExists()

◆ ensureSslDirExists()

◆ existsCrt()

◆ genSslCertificate()

◆ genSslCertificateHandler()

◆ getCrts()

◆ getFirefoxProfileDirs()

◆ isExpired()

◆ isFirefoxEnterpriseRootsConfigured()

◆ makeRootCa()

◆ maybePromptTrustRootCa()

◆ rebuildAllCerts()

◆ removeCrt()

◆ trustRootCaInFirefox()

◆ validateCertificateName()

Field Documentation

◆ $firefoxTrustDeclinedFile

◆ $rootCaName

◆ $trustPromptShownThisRun

◆ $wbDelSslBtnCancel

◆ $wbDelSslBtnDelete

◆ $wbDelSslBtnDest

◆ $wbDelSslInputDest

◆ $wbDelSslListCerts

◆ $wbDelSslProgressBar

◆ $wbGenSslBtnCancel

◆ $wbGenSslBtnDest

◆ $wbGenSslBtnSave

◆ $wbGenSslInputDest

◆ $wbGenSslInputName

◆ $wbGenSslProgressBar