6

如何在 Linux 服务器上运行的 PHP 应用程序中使用符合 PKCS#11 的 HSM(例如 SafeNet iKey 2032 [USB] 或 Aladdin eToken PRO [USB])中的密钥材料?

4

4 回答 4

3

I have not seen, and a cursory search has not found, a PCKS#11 glue library for PHP. Probably not the answer you're looking for. (: If you have better search fu than I, do update this thread.

I think your best bet would be to write a C program that calls PKCS#11 and accesses the HSM, and call that from your PHP app as an external binary. Even if a PKCS#11 wrapper emerges for PHP, this approach will give you the full API available to the C code rather than having to make do with whatever the author of the wrapper needed to satisfy their own requirements. PKCS#11 is a large API, and wrapper implementations are often less than complete.

于 2011-02-26T20:09:49.207 回答
2

您需要查看 OpenSC 项目中的pkcs11-helper。如果您尝试直接从 PHP 访问 PKCS#11 模块,这将是一个艰难的过程。

于 2012-04-28T09:49:43.987 回答
0

我假设您正在询问用户使用他们的令牌来生成签名。签名是在客户端生成的,即在浏览器中。您的解决方案在 linux/php 上的事实并不重要。

您必须添加一个称为签名者的软件组件,它将读取证书并生成签名。

现有的开源签名者是用 java 编写的,原因是 java applet 仍然是最可用的客户端技术。

于 2011-01-09T06:19:39.670 回答
0

您应该使用 php-pkcs11,它允许将您的私钥保存到基于 Oasis 组织的 PKCS11 标准的 HSM(硬件库)中。见:https ://github.com/gamringer/php-pkcs11

您的 HSM 可以是 U 盘、TPM 或智能卡。

于 2021-04-10T16:26:32.057 回答