PHP openssl_x509_verify() Function: Usage and Examples

openssl_x509_verify checks the signature on a certificate against a supplied public key, not its whole trust chain.

The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.

What It Does

The operation is intended for: openssl_x509_verify checks the signature on a certificate against a supplied public key, not its whole trust chain.

The OpenSSL extension must be enabled.

Syntax and Return Value

openssl_x509_verify(OpenSSLCertificate|string $certificate, $public_key): int

The declared return type is shown above. Errors can include false results or exceptions depending on this API: A valid signature, key match or fingerprint alone does not prove hostname identity, certificate chain trust or revocation status.

Example 1: Basic Operation

These checks are not equivalent to verifying a certificate chain and hostname for TLS.

<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$issuerPublic = openssl_pkey_get_public($cert);
var_dump(openssl_x509_verify($cert, $issuerPublic) === 1);

Example 2: A Different Use Case

Use a separately generated certificate to inspect the same operation on another identity.

<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'alternate.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$issuerPublic = openssl_pkey_get_public($cert);
var_dump(openssl_x509_verify($cert, $issuerPublic) === 1);

Practical Example: Checking the Result

Use a separately generated certificate to inspect the same operation on another identity.

<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'production.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$issuerPublic = openssl_pkey_get_public($cert);
var_dump(openssl_x509_verify($cert, $issuerPublic) === 1);

Important Behavior and Edge Cases

A valid signature, key match or fingerprint alone does not prove hostname identity, certificate chain trust or revocation status.

Key-matching, certificate parsing and signature verification are separate from chain-of-trust, hostname and revocation validation.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• openssl_x509_verify checks the signature on a certificate against a supplied public key, not its whole trust chain.
• A valid signature, key match or fingerprint alone does not prove hostname identity, certificate chain trust or revocation status.
• Use full TLS peer verification for HTTPS instead of assembling trust checks from these helpers alone.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.