PHP openssl_pkcs7_read() Function: Usage and Examples

openssl_pkcs7_read extracts certificate material embedded in an S/MIME PKCS#7 message from an input string.

The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.

What It Does

The operation is intended for: openssl_pkcs7_read extracts certificate material embedded in an S/MIME PKCS#7 message from an input string.

The OpenSSL extension must be enabled.

Syntax and Return Value

openssl_pkcs7_read(string $data, $certificates): bool

The declared return type is shown above. Errors can include false results or exceptions depending on this API: The result may be in S/MIME form. A cryptographic signature check alone is not a complete certificate trust decision.

Example 1: Basic Operation

The local certificate is self-signed for demonstration; signature acceptance here does not verify a trusted CA chain.

<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$input = tempnam(sys_get_temp_dir(), 'cms_input_');
$output = tempnam(sys_get_temp_dir(), 'cms_output_');
$decoded = tempnam(sys_get_temp_dir(), 'cms_plain_');
$certPath = tempnam(sys_get_temp_dir(), 'cms_cert_');
$keyPath = tempnam(sys_get_temp_dir(), 'cms_key_');
file_put_contents($input, 'Private message for recipient');
openssl_x509_export($cert, $certPem);
openssl_pkey_export($private, $keyPem);
file_put_contents($certPath, $certPem);
file_put_contents($keyPath, $keyPem);
openssl_cms_sign($input, $output, $cert, $private, [], 0, OPENSSL_ENCODING_DER);
$pkcs7 = "-----BEGIN PKCS7-----\n" . chunk_split(base64_encode(file_get_contents($output)), 64, "\n") . "-----END PKCS7-----\n";
$certificates = [];
var_dump(openssl_pkcs7_read($pkcs7, $certificates) && count($certificates) > 0);
foreach ([$input,$output,$decoded,$certPath,$keyPath] as $file) { @unlink($file); }

Example 2: A Different Use Case

Exercise the container operation with a different document, including binary document bytes.

<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$input = tempnam(sys_get_temp_dir(), 'cms_input_');
$output = tempnam(sys_get_temp_dir(), 'cms_output_');
$decoded = tempnam(sys_get_temp_dir(), 'cms_plain_');
$certPath = tempnam(sys_get_temp_dir(), 'cms_cert_');
$keyPath = tempnam(sys_get_temp_dir(), 'cms_key_');
file_put_contents($input, 'A second authenticated document');
openssl_x509_export($cert, $certPem);
openssl_pkey_export($private, $keyPem);
file_put_contents($certPath, $certPem);
file_put_contents($keyPath, $keyPem);
openssl_cms_sign($input, $output, $cert, $private, [], 0, OPENSSL_ENCODING_DER);
$pkcs7 = "-----BEGIN PKCS7-----\n" . chunk_split(base64_encode(file_get_contents($output)), 64, "\n") . "-----END PKCS7-----\n";
$certificates = [];
var_dump(openssl_pkcs7_read($pkcs7, $certificates) && count($certificates) > 0);
foreach ([$input,$output,$decoded,$certPath,$keyPath] as $file) { @unlink($file); }

Practical Example: Checking the Result

Exercise the container operation with a different document, including binary document bytes.

<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$input = tempnam(sys_get_temp_dir(), 'cms_input_');
$output = tempnam(sys_get_temp_dir(), 'cms_output_');
$decoded = tempnam(sys_get_temp_dir(), 'cms_plain_');
$certPath = tempnam(sys_get_temp_dir(), 'cms_cert_');
$keyPath = tempnam(sys_get_temp_dir(), 'cms_key_');
file_put_contents($input, random_bytes(48));
openssl_x509_export($cert, $certPem);
openssl_pkey_export($private, $keyPem);
file_put_contents($certPath, $certPem);
file_put_contents($keyPath, $keyPem);
openssl_cms_sign($input, $output, $cert, $private, [], 0, OPENSSL_ENCODING_DER);
$pkcs7 = "-----BEGIN PKCS7-----\n" . chunk_split(base64_encode(file_get_contents($output)), 64, "\n") . "-----END PKCS7-----\n";
$certificates = [];
var_dump(openssl_pkcs7_read($pkcs7, $certificates) && count($certificates) > 0);
foreach ([$input,$output,$decoded,$certPath,$keyPath] as $file) { @unlink($file); }

Important Behavior and Edge Cases

The result may be in S/MIME form. A cryptographic signature check alone is not a complete certificate trust decision.

These file-based APIs write encoded containers. The self-signed test certificate used in examples is not production trust material.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• openssl_pkcs7_read extracts certificate material embedded in an S/MIME PKCS#7 message from an input string.
• The result may be in S/MIME form. A cryptographic signature check alone is not a complete certificate trust decision.
• The openssl_cms_* APIs provide a newer related container interface.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.