<?php
 declare(strict_types=1); namespace SpomkyLabs\Pki\X509\Certificate; use SpomkyLabs\Pki\ASN1\Type\Constructed\Sequence; use SpomkyLabs\Pki\ASN1\Type\UnspecifiedType; use SpomkyLabs\Pki\CryptoBridge\Crypto; use SpomkyLabs\Pki\CryptoEncoding\PEM; use SpomkyLabs\Pki\CryptoTypes\AlgorithmIdentifier\AlgorithmIdentifier; use SpomkyLabs\Pki\CryptoTypes\AlgorithmIdentifier\Feature\SignatureAlgorithmIdentifier; use SpomkyLabs\Pki\CryptoTypes\Asymmetric\PublicKeyInfo; use SpomkyLabs\Pki\CryptoTypes\Signature\Signature; use Stringable; use UnexpectedValueException; final class Certificate implements Stringable { private function __construct( private readonly TBSCertificate $tbsCertificate, private readonly SignatureAlgorithmIdentifier $signatureAlgorithm, private readonly Signature $signatureValue ) { } public function __toString(): string { return $this->toPEM() ->string(); } public static function create( TBSCertificate $tbsCertificate, SignatureAlgorithmIdentifier $signatureAlgorithm, Signature $signatureValue ): self { return new self($tbsCertificate, $signatureAlgorithm, $signatureValue); } public static function fromASN1(Sequence $seq): self { $tbsCert = TBSCertificate::fromASN1($seq->at(0)->asSequence()); $algo = AlgorithmIdentifier::fromASN1($seq->at(1)->asSequence()); if (! $algo instanceof SignatureAlgorithmIdentifier) { throw new UnexpectedValueException('Unsupported signature algorithm ' . $algo->oid() . '.'); } $signature = Signature::fromSignatureData($seq->at(2)->asBitString()->string(), $algo); return self::create($tbsCert, $algo, $signature); } public static function fromDER(string $data): self { return self::fromASN1(UnspecifiedType::fromDER($data)->asSequence()); } public static function fromPEM(PEM $pem): self { if ($pem->type() !== PEM::TYPE_CERTIFICATE) { throw new UnexpectedValueException('Invalid PEM type.'); } return self::fromDER($pem->data()); } public function tbsCertificate(): TBSCertificate { return $this->tbsCertificate; } public function signatureAlgorithm(): SignatureAlgorithmIdentifier { return $this->signatureAlgorithm; } public function signatureValue(): Signature { return $this->signatureValue; } public function isSelfIssued(): bool { return $this->tbsCertificate->subject() ->equals($this->tbsCertificate->issuer()); } public function equals(self $cert): bool { return $this->_hasEqualSerialNumber($cert) && $this->_hasEqualPublicKey($cert) && $this->_hasEqualSubject($cert); } public function toASN1(): Sequence { return Sequence::create( $this->tbsCertificate->toASN1(), $this->signatureAlgorithm->toASN1(), $this->signatureValue->bitString() ); } public function toDER(): string { return $this->toASN1() ->toDER(); } public function toPEM(): PEM { return PEM::create(PEM::TYPE_CERTIFICATE, $this->toDER()); } public function verify(PublicKeyInfo $pubkey_info, ?Crypto $crypto = null): bool { $crypto ??= Crypto::getDefault(); $data = $this->tbsCertificate->toASN1() ->toDER(); return $crypto->verify($data, $this->signatureValue, $pubkey_info, $this->signatureAlgorithm); } private function _hasEqualSerialNumber(self $cert): bool { $sn1 = $this->tbsCertificate->serialNumber(); $sn2 = $cert->tbsCertificate->serialNumber(); return $sn1 === $sn2; } private function _hasEqualPublicKey(self $cert): bool { $kid1 = $this->tbsCertificate->subjectPublicKeyInfo() ->keyIdentifier(); $kid2 = $cert->tbsCertificate->subjectPublicKeyInfo() ->keyIdentifier(); return $kid1 === $kid2; } private function _hasEqualSubject(self $cert): bool { $dn1 = $this->tbsCertificate->subject(); $dn2 = $cert->tbsCertificate->subject(); return $dn1->equals($dn2); } } 