Weave Code
Pki Framework Laravel Package
spomky-labs/pki-framework
PHP 8.1+ framework for Public Key Infrastructure: X.509 certificates (incl. attribute certs), ASN.1 DER encoding/decoding, X.501/X.520 DN parsing, PEM (RFC 7468) handling, and PKCS-oriented cryptography utilities.
A PHP framework for managing Public Key Infrastructures. It comprises X.509 public key certificates, attribute certificates, certification requests and certification path validation.
Frequently asked questions about Pki Framework
- Can I use this package to build a self-hosted Certificate Authority (CA) for Laravel applications?
- Yes, this package provides all the tools needed to create a self-hosted CA. You can generate X.509 certificates, manage private keys, and issue certificates programmatically. For Laravel, you can integrate it with Artisan commands or middleware to automate certificate issuance and validation, replacing cloud-based CAs like AWS ACM or Sectigo.
- How do I integrate this PKI framework with Laravel’s authentication system (e.g., Sanctum or Passport)?
- You can extend Laravel’s authentication by validating certificates in middleware or guards. For Sanctum/Passport, use the package to decode and verify client certificates before issuing tokens. The framework’s modular design lets you focus only on certificate validation logic without bloating your auth stack.
- Does this package support mutual TLS (mTLS) for service-to-service communication in Laravel?
- Absolutely. The package includes tools to parse and validate X.509 certificates, making it perfect for mTLS in Laravel. You can create middleware to validate client certificates in HTTP requests, ensuring secure communication with services like Istio or Linkerd. Combine it with Laravel’s middleware stack for seamless integration.
- What Laravel versions are compatible with spomky-labs/pki-framework?
- This package requires PHP 8.1+, so it works with Laravel 9 and 10. For Laravel 11 or future versions, check the package’s changelog or test compatibility early, as Laravel’s PHP version requirements may shift. Pin to LTS Laravel versions (e.g., 10.x) for stability in production.
- How do I store private keys securely in Laravel when using this PKI framework?
- Avoid storing private keys in plaintext. Use Laravel’s encryption services (e.g., `config['app.cipher']`) or integrate with HSMs like AWS KMS or HashiCorp Vault. For added security, combine this with Laravel’s filesystem encryption or a dedicated secrets manager. Never commit private keys to version control.
- Can I use this package to parse and validate certificates in a Laravel middleware for API gateways?
- Yes, the package’s `Certificate` class can decode and validate X.509 certificates, making it ideal for middleware. Create a custom middleware (e.g., `ValidateCertificate`) to check client certificates in API requests. This works well for mTLS in microservices or API gateways like Kong or Traefik.
- What are the performance implications of using this package for bulk certificate operations?
- For bulk operations (e.g., issuing 10,000+ certificates), performance may vary. Benchmark against PHP’s `ext-openssl` for critical paths. Use Laravel’s queue system to offload heavy tasks (e.g., certificate generation) to workers. Enable GMP/BCMath in PHP for faster cryptographic operations.
- How do I handle certificate revocation in Laravel (e.g., CRL or OCSP)?
- The package supports CRL (Certificate Revocation Lists) and OCSP (Online Certificate Status Protocol). Cache revocation data in Redis and use Laravel’s queue system to update CRLs/OCSP responses periodically. For soft deletes, store revocation status in a Laravel database table and query it during validation.
- Are there alternatives to this package for PKI in Laravel, and how does it compare?
- Alternatives include `phpseclib` (broader crypto but heavier) or `web3/php-ethereum` (not PKI-focused). This package is lightweight, specialized for PKI, and integrates seamlessly with Laravel’s ecosystem. Unlike `openssl` CLI commands, it provides a pure PHP API for certificate operations, reducing dependency on system tools.
- Can I use this package to extend Laravel’s Artisan CLI with custom PKI commands (e.g., `pki:issue`, `pki:revoke`)?
- Yes, the package’s modular design makes it easy to create custom Artisan commands. For example, build a `pki:issue` command to generate certificates or `pki:revoke` to update CRLs. Use Laravel’s service container to inject the PKI framework into your commands, ensuring clean dependency management.
Weaver
How can I help you explore Laravel packages today?