PHPackages                             mlocati/ocsp - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. mlocati/ocsp

ActiveLibrary[Security](/categories/security)

mlocati/ocsp
============

Library to query HTTPS Certificates revocation status using the Online Certificate Status Protocol (OCSP)

1.2.1(11mo ago)40754.7k↓16.7%112MITPHPPHP >=7.1CI passing

Since Sep 17Pushed 11mo ago2 watchersCompare

[ Source](https://github.com/mlocati/ocsp)[ Packagist](https://packagist.org/packages/mlocati/ocsp)[ Docs](https://github.com/mlocati/ocsp/)[ Fund](https://paypal.me/mlocati)[ GitHub Sponsors](https://github.com/mlocati)[ RSS](/packages/mlocati-ocsp/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (6)Dependencies (2)Versions (7)Used By (2)

[![Tests](https://github.com/mlocati/ocsp/actions/workflows/tests.yml/badge.svg)](https://github.com/mlocati/ocsp/actions?query=workflow%3A%22tests%22)[![Coverage Status](https://camo.githubusercontent.com/2d2f0d5b85dd564186ae58772d32cccbe75b841af28f3ea6c93ce5e8cfed51ef/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f6d6c6f636174692f6f6373702f62616467652e7376673f6272616e63683d6d61696e)](https://coveralls.io/github/mlocati/ocsp?branch=main)[![Scrutinizer Code Quality](https://camo.githubusercontent.com/ff99db4531efe37a439addca56c964ed27cfecb3d7e2eb4a60a7a855bbe0df74/68747470733a2f2f7363727574696e697a65722d63692e636f6d2f672f6d6c6f636174692f6f6373702f6261646765732f7175616c6974792d73636f72652e706e673f623d6d61696e)](https://scrutinizer-ci.com/g/mlocati/ocsp/?branch=main)[![Packagist Downloads](https://camo.githubusercontent.com/9f39819e37a8409b74e390c8ef32cf1833dfbf6949f982a593dbc3747b354d18/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f646d2f6d6c6f636174692f6f637370)](https://camo.githubusercontent.com/9f39819e37a8409b74e390c8ef32cf1833dfbf6949f982a593dbc3747b354d18/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f646d2f6d6c6f636174692f6f637370)

Online Certificate Status Protocol PHP Library
==============================================

[](#online-certificate-status-protocol-php-library)

This repository contains a PHP library that helps you checking if HTTPS certificates are revoked, by using the Online Certificate Status Protocol (OCSP).

This library doesn't require `exec` calls to system utilities like OpenSSL: it's a pure PHP library.

This library doesn't include any network-related helpers: you have to use your own transport libraries (cURL, Zend HTTP, Guzzle or whatever).

Checking HTTPS certificates requires:

- the certificate to be checked, in PEM format (that is, the text files that starts with `-----BEGIN CERTIFICATE-----), or in DER format (that is, binary files)
- the issuer certificate, that is the certificate of the Certification Authority that provided you the HTTPS certificate
- the URL, provided by the Certification Authority, to be used for OCSP calls (the so-called `OCSR Responder URL`)

Obtaining the certificate and the issuer certificate from an HTTPS URL
----------------------------------------------------------------------

[](#obtaining-the-certificate-and-the-issuer-certificate-from-an-https-url)

You can get the HTTPS certificate and the issuer certificate from an HTTPS URL by using some code like this:

```
$hCurl = curl_init($url);
curl_setopt($hCurl, CURLOPT_RETURNTRANSFER, false);
curl_setopt($hCurl, CURLOPT_CUSTOMREQUEST, 'HEAD');
curl_setopt($hCurl, CURLOPT_NOBODY, true);
curl_setopt($hCurl, CURLOPT_CERTINFO, true);
curl_exec($hCurl);
$certInfo = curl_getinfo($hCurl, CURLINFO_CERTINFO);

$certificate = $certInfo[0]['Cert'];
$issuerCertificate = $certInfo[1]['Cert'];
```

Obtaining the issuer certificate from a certificate
---------------------------------------------------

[](#obtaining-the-issuer-certificate-from-a-certificate)

HTTPS certificates usually contain an URL where you can find the certificate of the certificate issuer.

You can use this code to extract this URL, provided that `'/path/to/certificate'` is the path to a local file that contains your HTTPS certificate:

```
$certificateLoader = new \Ocsp\CertificateLoader();
$certificate = $certificateLoader->fromFile('/path/to/certificate');
$certificateInfo = new \Ocsp\CertificateInfo();
$urlOfIssuerCertificate = $certificateInfo->extractIssuerCertificateUrl($certificate);
```

At this point, `$urlOfIssuerCertificate` will contain the URL where the issuer certificate can be downloaded from (if it's an empty string, that means that the issuer certificate URL is not included in your certificate).

Obtaining the OCSP Responder URL
--------------------------------

[](#obtaining-the-ocsp-responder-url)

To check if a certificate is valid, we need to know an URL, provided by the authority that issued the certificate, that can be called to check if the certificate has been revoked.

This URL may be included in the HTTPS certificate itself.

To get it, you can use the following code (provided that `'/path/to/certificate'` is the path to a local file that contains your HTTPS certificate):

```
$certificateLoader = new \Ocsp\CertificateLoader();
$certificate = $certificateLoader->fromFile('/path/to/certificate');
$certificateInfo = new \Ocsp\CertificateInfo();
$ocspResponderUrl = $certificateInfo->extractOcspResponderUrl($certificate);
```

Checking if a certificate has been revoked
------------------------------------------

[](#checking-if-a-certificate-has-been-revoked)

Once you have the HTTPS certificate, the issuer certificate, and the OCSP Responder URL, you can check if the HTTPS certificate has been revoked, or if it's still valid.

In order to do so, you have to write some code like this (here we use cURL, but you can use any other transport library):

```
$certificateLoader = new \Ocsp\CertificateLoader();
$certificateInfo = new \Ocsp\CertificateInfo();
$ocsp = new \Ocsp\Ocsp();

// Load the HTTPS certificate and the issuer certificate
$certificate = $certificateLoader->fromFile('/path/to/certificate');
$issuerCertificate = $certificateLoader->fromFile('/path/to/issuer/certificate');

// Extract the relevant data from the two certificates
$requestInfo = $certificateInfo->extractRequestInfo($certificate, $issuerCertificate);

// Build the raw body to be sent to the OCSP Responder URL
$requestBody = $ocsp->buildOcspRequestBodySingle($requestInfo);

// Actually call the OCSP Responder URL (here we use cURL, you can use any library you prefer)
$hCurl = curl_init();
curl_setopt($hCurl, CURLOPT_URL, $ocspResponderUrl);
curl_setopt($hCurl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($hCurl, CURLOPT_POST, true);
curl_setopt($hCurl, CURLOPT_HTTPHEADER, ['Content-Type: ' . \Ocsp\Ocsp::OCSP_REQUEST_MEDIATYPE]);
curl_setopt($hCurl, CURLOPT_SAFE_UPLOAD, true);
curl_setopt($hCurl, CURLOPT_POSTFIELDS, $requestBody);
$result = curl_exec($hCurl);
$info = curl_getinfo($hCurl);
if ($info['http_code'] !== 200) {
    throw new \RuntimeException("Whoops, here we'd expect a 200 HTTP code");
}
if ($info['content_type'] !== \Ocsp\Ocsp::OCSP_RESPONSE_MEDIATYPE) {
    throw new \RuntimeException("Whoops, the Content-Type header of the response seems wrong!");
}

// Decode the raw response from the OCSP Responder
$response = $ocsp->decodeOcspResponseSingle($result);
```

At this point, `$response` contains an instance of the `Ocsp\Response` class:

- the certificate is not revoked if `$response->isRevoked() === false`
- the certificate is revoked if `$response->isRevoked() === true` (you can get the devocation date/time by calling `$response->getRevokedOn()`)
- in case of unknown state, `$response->isRevoked()` will return `null`

Exceptions
----------

[](#exceptions)

Problems may arise while loading the certificates, creating the request body for the OCSP Responder, analyzing the response from the OCSP Responder. To catch these errors, you can enclose your code within try/catch statements:

```
try {
    // code
} catch (\Ocsp\Exception\Exception $problem) {
    // handle the error cases
}
```

###  Health Score

48

—

FairBetter than 95% of packages

Maintenance52

Moderate activity, may be stable

Popularity50

Moderate usage in the ecosystem

Community19

Small or concentrated contributor base

Maturity57

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 87.1% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~419 days

Recently: every ~524 days

Total

6

Last Release

338d ago

PHP version history (2 changes)1.0.0PHP >=5.5.9

1.2.1PHP >=7.1

### Community

Maintainers

![](https://www.gravatar.com/avatar/6e9d7ece045fc89575e083ee4852edf31218df403c84f41a0de01863dae982f5?d=identicon)[mlocati](/maintainers/mlocati)

---

Top Contributors

[![mlocati](https://avatars.githubusercontent.com/u/928116?v=4)](https://github.com/mlocati "mlocati (27 commits)")[![splitice](https://avatars.githubusercontent.com/u/468579?v=4)](https://github.com/splitice "splitice (3 commits)")[![flavioheleno](https://avatars.githubusercontent.com/u/471860?v=4)](https://github.com/flavioheleno "flavioheleno (1 commits)")

---

Tags

httpschecksecuritycertificaterevocationocsprevokerevokedonline certificate status protocol

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/mlocati-ocsp/health.svg)

```
[![Health](https://phpackages.com/badges/mlocati-ocsp/health.svg)](https://phpackages.com/packages/mlocati-ocsp)
```

###  Alternatives

[kelunik/acme

ACME library written in PHP.

121603.9k3](/packages/kelunik-acme)[spatie/ssl-certificate-chain-resolver

SSL certificate chain resolver

3069.6k](/packages/spatie-ssl-certificate-chain-resolver)[acmephp/core

Raw implementation of the ACME protocol in PHP

38973.7k7](/packages/acmephp-core)[kelunik/acme-client

Let's Encrypt / ACME client written in PHP for the CLI.

3933.9k1](/packages/kelunik-acme-client)[acmephp/ssl

PHP wrapper around OpenSSL extension providing SSL encoding, decoding, parsing and signing features

141.2M4](/packages/acmephp-ssl)[leonardolima/laravel-security-check

Security validator for Laravel projects

582.4k](/packages/leonardolima-laravel-security-check)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)