PHPackages                             ross-kvit/php-mtls-hmac - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. ross-kvit/php-mtls-hmac

ActiveLibrary[HTTP & Networking](/categories/http)

ross-kvit/php-mtls-hmac
=======================

mTLS + HMAC-signed GET client for testing

00PHP

Since Sep 19Pushed 9mo agoCompare

[ Source](https://github.com/RossKvit/php-mtls-hmac)[ Packagist](https://packagist.org/packages/ross-kvit/php-mtls-hmac)[ RSS](/packages/ross-kvit-php-mtls-hmac/feed)WikiDiscussions main Synced today

READMEChangelogDependenciesVersions (1)Used By (0)

```
# PHP mTLS + HMAC client

Minimal Composer package demonstrating:

- mTLS client configuration using Guzzle
- HMAC-SHA256 signature computation over canonical query string
- PSR-4 autoloading, .env configuration via vlucas/phpdotenv
- Unit and integration tests (integration test uses badssl client endpoint)

## Setup

1. Copy files into a directory and run `composer install`.
2. Create a `.env` file (copy `.env.example`) and set the real paths/secrets.

Example `.env` for testing with badssl (download certs from https://badssl.com/download/):

```ini
MTLS_CLIENT_CERT=./certs/badssl.com-client-cert.pem
MTLS_CLIENT_KEY=./certs/badssl.com-client-key.pem
MTLS_CLIENT_KEY_PASSPHRASE=badssl.com
HMAC_SECRET=your_shared_hmac_secret
API_ENDPOINT=https://client.badssl.com/
```

3. Run unit tests: `./vendor/bin/phpunit --filter SignerTest`
4. Run integration test (if `.env` contains real cert/key/secret): `./vendor/bin/phpunit --filter IntegrationTest`

## Notes

- Guzzle options set `cert` and `ssl_key`. If your private key is encrypted, set `MTLS_CLIENT_KEY_PASSPHRASE`.
- `verify` defaults to system CA if `MTLS_CA_BUNDLE` not set. To force validation with a specific bundle, set `MTLS_CA_BUNDLE` to the path to your CA bundle.
- The Signer canonicalizes by sorting keys and building an RFC3986-encoded query string, then computing HMAC-SHA256.

## Final notes

This package is structured for testability: Signer is pure and unit-testable; Client depends on Config and Guzzle. The integration test is intentionally skipped unless environment variables are set so CI won't fail.
```

###  Health Score

15

—

LowBetter than 3% of packages

Maintenance41

Moderate activity, may be stable

Popularity0

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity14

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/48969922?v=4)[RossKvit](/maintainers/RossKvit)[@RossKvit](https://github.com/RossKvit)

---

Top Contributors

[![RossKvit](https://avatars.githubusercontent.com/u/48969922?v=4)](https://github.com/RossKvit "RossKvit (4 commits)")

### Embed Badge

![Health badge](/badges/ross-kvit-php-mtls-hmac/health.svg)

```
[![Health](https://phpackages.com/badges/ross-kvit-php-mtls-hmac/health.svg)](https://phpackages.com/packages/ross-kvit-php-mtls-hmac)
```

###  Alternatives

[php-http/cache-plugin

PSR-6 Cache plugin for HTTPlug

25126.1M82](/packages/php-http-cache-plugin)[illuminate/http

The Illuminate Http package.

11937.9M6.9k](/packages/illuminate-http)[rdkafka/rdkafka

A PHP extension for Kafka

2.2k24.3k1](/packages/rdkafka-rdkafka)[httpsoft/http-message

Strict and fast implementation of PSR-7 and PSR-17

87965.9k114](/packages/httpsoft-http-message)[mezzio/mezzio-router

Router subcomponent for Mezzio

265.4M91](/packages/mezzio-mezzio-router)[serpapi/google-search-results-php

Get Google, Bing, Baidu, Ebay, Yahoo, Yandex, Home depot, Naver, Apple, Duckduckgo, Youtube search results via SerpApi.com

69127.2k](/packages/serpapi-google-search-results-php)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)