PHPackages                             lyquidity/requester - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. lyquidity/requester

ActiveLibrary[Security](/categories/security)

lyquidity/requester
===================

Library to query HTTPS Certificates revocation status using the Online Certificate Status Protocol (OCSP) and to make a request to a Timestamp authority (TSA)

1.03(3y ago)267.7k—2.8%32MITPHPPHP >=7.4.0

Since Oct 19Pushed 3y ago1 watchersCompare

[ Source](https://github.com/bseddon/requester)[ Packagist](https://packagist.org/packages/lyquidity/requester)[ Docs](https://github.com/bseddon/requester/)[ RSS](/packages/lyquidity-requester/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (5)DependenciesVersions (6)Used By (2)

Online Certificate Status Protocol PHP Library
==============================================

[](#online-certificate-status-protocol-php-library)

This is a modified version of the OCSP repository by #mlocati and the addition of a Timestamp Authority (TSA) class.

The modifications are to support the project [OCSP responder](https://github.com/bseddon/ocsp-responder). Amongst the changes are the addition of new ASN.1 tags and the removal of the dependency on [phpseclib](https://github.com/phpseclib/phpseclib).

This repository contains a PHP library that helps you checking if HTTPS certificates are revoked, by using the Online Certificate Status Protocol (OCSP).

This library doesn't require `exec` calls to system utilities like OpenSSL: it's a pure PHP library.

This library doesn't include any network-related helpers: you have to use your own transport libraries (cURL, Zend HTTP, Guzzle or whatever).

Checking HTTPS certificates requires:

- the certificate to be checked, in PEM format (that is, the text files that starts with `-----BEGIN CERTIFICATE-----), or in DER format (that is, binary files)
- the issuer certificate, that is the certificate of the Certification Authority that provided you the HTTPS certificate
- the URL, provided by the Certification Authority, to be used for OCSP calls (the so-called `OCSR Responder URL`)

Obtaining the certificate and the issuer certificate from an HTTPS URL
----------------------------------------------------------------------

[](#obtaining-the-certificate-and-the-issuer-certificate-from-an-https-url)

You can get the HTTPS certificate and the issuer certificate from an HTTPS URL by using some code like this:

```
$hCurl = curl_init($url);
curl_setopt($hCurl, CURLOPT_RETURNTRANSFER, false);
curl_setopt($hCurl, CURLOPT_CUSTOMREQUEST, 'HEAD');
curl_setopt($hCurl, CURLOPT_NOBODY, true);
curl_setopt($hCurl, CURLOPT_CERTINFO, true);
curl_exec($hCurl);
$certInfo = curl_getinfo($hCurl, CURLINFO_CERTINFO);

$certificate = $certInfo[0]['Cert'];
$issuerCertificate = $certInfo[1]['Cert'];
```

Obtaining the issuer certificate from a certificate
---------------------------------------------------

[](#obtaining-the-issuer-certificate-from-a-certificate)

HTTPS certificates usually contain an URL where you can find the certificate of the certificate issuer.

You can use this code to extract this URL, provided that `'/path/to/certificate'` is the path to a local file that contains your HTTPS certificate:

```
$certificateLoader = new \Ocsp\CertificateLoader();
$certificate = $certificateLoader->fromFile('/path/to/certificate');
$certificateInfo = new \Ocsp\CertificateInfo();
$urlOfIssuerCertificate = $certificateInfo->extractIssuerCertificateUrl($certificate);
```

At this point, `$urlOfIssuerCertificate` will contain the URL where the issuer certificate can be downloaded from (if it's an empty string, that means that the issuer certificate URL is not included in your certificate).

Obtaining the OCSP Responder URL
--------------------------------

[](#obtaining-the-ocsp-responder-url)

To check if a certificate is valid, we need to know an URL, provided by the authority that issued the certificate, that can be called to check if the certificate has been revoked.

This URL may be included in the HTTPS certificate itself.

To get it, you can use the following code (provided that `'/path/to/certificate'` is the path to a local file that contains your HTTPS certificate):

```
$certificateLoader = new \Ocsp\CertificateLoader();
$certificate = $certificateLoader->fromFile('/path/to/certificate');
$certificateInfo = new \Ocsp\CertificateInfo();
$ocspResponderUrl = $certificateInfo->extractOcspResponderUrl($certificate);
```

Checking if a certificate has been revoked
------------------------------------------

[](#checking-if-a-certificate-has-been-revoked)

Once you have the HTTPS certificate, the issuer certificate, and the OCSP Responder URL, you can check if the HTTPS certificate has been revoked, or if it's still valid.

In order to do so, you have to write some code like this (here we use cURL, but you can use any other transport library):

```
$certificateLoader = new \Ocsp\CertificateLoader();
$certificateInfo = new \Ocsp\CertificateInfo();
$ocsp = new \Ocsp\Ocsp();

// Load the HTTPS certificate and the issuer certificate
$certificate = $certificateLoader->fromFile('/path/to/certificate');
$issuerCertificate = $certificateLoader->fromFile('/path/to/issuer/certificate');

// Extract the relevant data from the two certificates
$requestInfo = $certificateInfo->extractRequestInfo($certificate, $issuerCertificate);

// Build the raw body to be sent to the OCSP Responder URL
$requestBody = $ocsp->buildOcspRequestBodySingle($requestInfo);

// Actually call the OCSP Responder URL (here we use cURL, you can use any library you prefer)
$hCurl = curl_init();
curl_setopt($hCurl, CURLOPT_URL, $ocspResponderUrl);
curl_setopt($hCurl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($hCurl, CURLOPT_POST, true);
curl_setopt($hCurl, CURLOPT_HTTPHEADER, ['Content-Type: ' . \Ocsp\Ocsp::OCSP_REQUEST_MEDIATYPE]);
curl_setopt($hCurl, CURLOPT_SAFE_UPLOAD, true);
curl_setopt($hCurl, CURLOPT_POSTFIELDS, $requestBody);
$result = curl_exec($hCurl);
$info = curl_getinfo($hCurl);
if ($info['http_code'] !== 200) {
    throw new \RuntimeException("Whoops, here we'd expect a 200 HTTP code");
}
if ($info['content_type'] !== \Ocsp\Ocsp::OCSP_RESPONSE_MEDIATYPE) {
    throw new \RuntimeException("Whoops, the Content-Type header of the response seems wrong!");
}

// Decode the raw response from the OCSP Responder
$response = $ocsp->decodeOcspResponseSingle($result);
```

At this point, `$response` contains an instance of the `Ocsp\Response` class:

- the certificate is not revoked if `$response->isRevoked() === false`
- the certificate is revoked if `$response->isRevoked() === true` (you can get the devocation date/time by calling `$response->getRevokedOn()`)
- in case of unknown state, `$response->isRevoked()` will return `null`

Exceptions
----------

[](#exceptions)

Problems may arise while loading the certificates, creating the request body for the OCSP Responder, analyzing the response from the OCSP Responder. To catch these errors, you can enclose your code within try/catch statements:

```
try {
    // code
} catch (\Ocsp\Exception\Exception $problem) {
    // handle the error cases
}
```

###  Health Score

34

—

LowBetter than 77% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity35

Limited adoption so far

Community15

Small or concentrated contributor base

Maturity54

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 98% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~112 days

Total

5

Last Release

1225d ago

Major Versions

0.9.9 → 1.0.02022-01-15

PHP version history (2 changes)0.9.9PHP >=5.5.9

1.0.0PHP >=7.4.0

### Community

Maintainers

![](https://www.gravatar.com/avatar/d205a6428422f437de21d40def300c0558d946acaadc1f67a5e2faae4e7f3801?d=identicon)[bseddon](/maintainers/bseddon)

---

Top Contributors

[![bseddon](https://avatars.githubusercontent.com/u/1221824?v=4)](https://github.com/bseddon "bseddon (50 commits)")[![lou-perret](https://avatars.githubusercontent.com/u/110917536?v=4)](https://github.com/lou-perret "lou-perret (1 commits)")

---

Tags

requesthttpschecksecuritycertificatetimestamprfc3161revocationocsprevokerevokedonline certificate status protocolrfc6069timestamp authoritytsa

### Embed Badge

![Health badge](/badges/lyquidity-requester/health.svg)

```
[![Health](https://phpackages.com/badges/lyquidity-requester/health.svg)](https://phpackages.com/packages/lyquidity-requester)
```

###  Alternatives

[mlocati/ocsp

Library to query HTTPS Certificates revocation status using the Online Certificate Status Protocol (OCSP)

40754.7k2](/packages/mlocati-ocsp)[kelunik/acme

ACME library written in PHP.

121603.9k3](/packages/kelunik-acme)[acmephp/core

Raw implementation of the ACME protocol in PHP

38973.7k7](/packages/acmephp-core)[spatie/ssl-certificate-chain-resolver

SSL certificate chain resolver

3069.6k](/packages/spatie-ssl-certificate-chain-resolver)[kelunik/acme-client

Let's Encrypt / ACME client written in PHP for the CLI.

3933.9k1](/packages/kelunik-acme-client)[acmephp/ssl

PHP wrapper around OpenSSL extension providing SSL encoding, decoding, parsing and signing features

141.2M4](/packages/acmephp-ssl)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)