openssl_pkcs12_read reads a password-protected PKCS#12 string and extracts its certificate, private key and optional chain.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: openssl_pkcs12_read reads a password-protected PKCS#12 string and extracts its certificate, private key and optional chain.
The OpenSSL extension must be enabled.
Syntax and Return Value
openssl_pkcs12_read(string $pkcs12, $certificates, string $passphrase): bool| Parameter | Purpose |
|---|---|
| $pkcs12 (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $certificates (mixed) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $passphrase (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: PKCS#12 contains sensitive private keys: protect the export password, output path and file permissions.
Example 1: Basic Operation
Protect PKCS#12 bundles: they may contain the private key even when the file is password-protected.
<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_pkcs12_export($cert, $pfx, $private, 'example-passphrase');
var_dump(openssl_pkcs12_read($pfx, $parts, 'example-passphrase'));Example 2: A Different Use Case
Test export and readback with a fresh bundle passphrase; do not reuse these illustrative secrets.
<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_pkcs12_export($cert, $pfx, $private, 'second-test-passphrase');
var_dump(openssl_pkcs12_read($pfx, $parts, 'second-test-passphrase'));Practical Example: Checking the Result
Test export and readback with a fresh bundle passphrase; do not reuse these illustrative secrets.
<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_pkcs12_export($cert, $pfx, $private, 'third-test-passphrase');
var_dump(openssl_pkcs12_read($pfx, $parts, 'third-test-passphrase'));Important Behavior and Edge Cases
PKCS#12 contains sensitive private keys: protect the export password, output path and file permissions.
PKCS#12 contains sensitive private keys: protect the export password, output path and file permissions.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| openssl_pkcs12_read | openssl_pkcs12_read reads a password-protected PKCS#12 string and extracts its certificate, private key and optional chain. |
| Related technique | PEM certificates and private keys can be handled separately with openssl_x509_export and openssl_pkey_export. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | PEM certificates and private keys can be handled separately with openssl_x509_export and openssl_pkey_export. |
| Ignoring a security prerequisite or failure case | PKCS#12 contains sensitive private keys: protect the export password, output path and file permissions. |
Key Takeaways
- openssl_pkcs12_read reads a password-protected PKCS#12 string and extracts its certificate, private key and optional chain.
- PKCS#12 contains sensitive private keys: protect the export password, output path and file permissions.
- PEM certificates and private keys can be handled separately with openssl_x509_export and openssl_pkey_export.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.