X.509 certificates & chains

use RoundlyConsulting\Crypto\Facades\Crypto;
use RoundlyConsulting\Crypto\Hash\HashAlgorithm;

$certificate = Crypto::x509()->fromPem($pem);        // also fromDer(), fromBase64() for an x5c entry
$certificate->fingerprint();

$chain = Crypto::x509()->chain()->fromX5c($x5c);     // also fromPems(), fromPemBundle(), fromCertificates()
$chain->isLinked();                                  // the math — the trust call stays yours
$chain->fingerprints(HashAlgorithm::Sha1);

// Shortcuts for the common cases:
Crypto::certificate($pem);
Crypto::chainFromX5c($x5c);
Crypto::chainFromPemBundle($bundle);

use RoundlyConsulting\Crypto\X509\Certificate;

$certificate = Certificate::fromPem($pem);        // also fromDer(), fromBase64() for an x5c entry

$certificate->commonName();                       // 'app.example'
$certificate->dnsNames();                         // ['app.example', '*.api.example'] — SAN dNSNames, read from the DER
$certificate->fingerprint();                      // lower-case sha256 hex, as openssl emits it
$certificate->notAfter();                         // CarbonImmutable
$certificate->publicKey();                        // RsaKey | EcKey — policy-checked
$certificate->isSignedBy($issuer);                // an ALGORITHM question

$certificate->subject()->toString();   // 'CN=leaf.example, O=Acme, C=US'
$certificate->issuer()->commonName;    // DistinguishedName properties
$certificate->serialNumber();          // upper-case hex
$certificate->signatureAlgorithm();    // e.g. 'ecdsa-with-SHA256'
$certificate->version();               // 1, 2 or 3
$certificate->base64();                // the x5c form (standard base64 DER)
$certificate->isSelfSigned();          // the signature math, not a subject == issuer compare
$certificate->equals($other);          // constant-time DER comparison

$extension = $certificate->extension('1.2.840.113635.100.8.2');   // ?Extension
$extension?->critical;                 // bool
$extension?->der;                      // raw, uninterpreted extension bytes
$certificate->extensions();            // every extension, keyed by OID

$certificate->isValidAt();                                  // now (honours Carbon::setTestNow)
$certificate->isValidAt($token->signedAt, leewaySeconds: 60);
$certificate->isExpiredAt(leewaySeconds: 60);              // distinct from a bad signature
$certificate->isNotYetValidAt();                            // a negative leeway throws

use RoundlyConsulting\Crypto\Hash\HashAlgorithm;
use RoundlyConsulting\Crypto\X509\Chain;

// A JOSE x5c chain (leaf first), a concatenated PEM bundle, or a list of PEMs:
$chain = Chain::fromX5c($x5c);                    // ≤ 10 certificates, strict base64, typed errors
$chain = Chain::fromPemBundle($bundle);
$chain = Chain::fromPems([$leafPem, $intermediatePem, $rootPem]);

$chain->isLinked();                               // every cert is signed by the next one up
$chain->fingerprints(HashAlgorithm::Sha1);        // leaf → root
$chain->leaf()->publicKey();
$chain->root();                                   // the LAST certificate — not "a trusted root"
$chain->get(1);                                   // by index
count($chain);                                    // Countable; foreach works too
$chain->pemBundle();