{"id":13473430,"url":"https://github.com/spatie/ssl-certificate-chain-resolver","last_synced_at":"2025-04-12T18:54:13.389Z","repository":{"id":26487875,"uuid":"29939986","full_name":"spatie/ssl-certificate-chain-resolver","owner":"spatie","description":"SSL certificate chain resolver","archived":false,"fork":false,"pushed_at":"2023-12-18T14:28:41.000Z","size":211,"stargazers_count":305,"open_issues_count":0,"forks_count":39,"subscribers_count":10,"default_branch":"main","last_synced_at":"2024-10-24T17:55:47.863Z","etag":null,"topics":["certificate","certificate-authority","php","security","ssl","trust-chain"],"latest_commit_sha":null,"homepage":"https://spatie.be/open-source","language":"PHP","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/spatie.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2015-01-27T23:15:44.000Z","updated_at":"2024-10-21T05:16:30.000Z","dependencies_parsed_at":"2024-01-13T18:12:56.406Z","dependency_job_id":"0d2da43b-fbad-42a2-aabb-2f33bfca8798","html_url":"https://github.com/spatie/ssl-certificate-chain-resolver","commit_stats":{"total_commits":104,"total_committers":15,"mean_commits":6.933333333333334,"dds":0.25,"last_synced_commit":"dc41328040630c5857ae3b2865e414a976739b02"},"previous_names":[],"tags_count":14,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spatie%2Fssl-certificate-chain-resolver","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spatie%2Fssl-certificate-chain-resolver/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spatie%2Fssl-certificate-chain-resolver/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/spatie%2Fssl-certificate-chain-resolver/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/spatie","download_url":"https://codeload.github.com/spatie/ssl-certificate-chain-resolver/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248618262,"owners_count":21134200,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certificate","certificate-authority","php","security","ssl","trust-chain"],"created_at":"2024-07-31T16:01:03.577Z","updated_at":"2025-04-12T18:54:13.369Z","avatar_url":"https://github.com/spatie.png","language":"PHP","funding_links":[],"categories":["PHP"],"sub_categories":[],"readme":"# SSL Certificate Chain Resolver\n[![Latest Version](https://img.shields.io/github/release/spatie/ssl-certificate-chain-resolver.svg?style=flat-square)](https://github.com/spatie/ssl-certificate-chain-resolver/releases)\n[![Software License](https://img.shields.io/badge/license-MIT-brightgreen.svg?style=flat-square)](LICENSE.md)\n[![Build Status](https://img.shields.io/travis/spatie/ssl-certificate-chain-resolver/master.svg?style=flat-square)](https://travis-ci.org/spatie/ssl-certificate-chain-resolver)\n[![Quality Score](https://img.shields.io/scrutinizer/g/spatie/ssl-certificate-chain-resolver.svg?style=flat-square)](https://scrutinizer-ci.com/g/spatie/ssl-certificate-chain-resolver)\n[![StyleCI](https://styleci.io/repos/29939986/shield?branch=master)](https://styleci.io/repos/29939986)\n[![Total Downloads](https://img.shields.io/packagist/dt/spatie/ssl-certificate-chain-resolver.svg?style=flat-square)](https://packagist.org/packages/spatie/ssl-certificate-chain-resolver)\n\nAll operating systems contain a set of default trusted root certificates. But Certificate Authorities usually don't use their root certificate to sign customer certificates. They use so called intermediate certificates instead, because these can be rotated more frequently.\n\nIf not all intermediate certificates are installed on your server, some clients —mostly mobile browsers— will think you are on an insecure connection.\n\nThis tool can help you fix the [incomplete certificate chain issue](#background-the-trust-chain), also reported as *Extra download* by [Qualys SSL Server Test](https://www.ssllabs.com/ssltest/).\n\nSpatie is a webdesign agency in Antwerp, Belgium. You'll find an overview of all our open source projects [on our website](https://spatie.be/opensource).\n\n## Support us\n\n[\u003cimg src=\"https://github-ads.s3.eu-central-1.amazonaws.com/ssl-certificate-chain-resolver.jpg?t=1\" width=\"419px\" /\u003e](https://spatie.be/github-ad-click/ssl-certificate-chain-resolver)\n\nWe invest a lot of resources into creating [best in class open source packages](https://spatie.be/open-source). You can support us by [buying one of our paid products](https://spatie.be/open-source/support-us).\n\nWe highly appreciate you sending us a postcard from your hometown, mentioning which of our package(s) you are using. You'll find our address on [our contact page](https://spatie.be/about-us). We publish all received postcards on [our virtual postcard wall](https://spatie.be/open-source/postcards).\n\n## Postcardware\n\nYou're free to use this package (it's [MIT-licensed](LICENSE.md)), but if it makes it to your production environment you are required to send us a postcard from your hometown, mentioning which of our package(s) you are using.\n\nOur address is: Spatie, Kruikstraat 22, 2018 Antwerp, Belgium.\n\nThe best postcards will get published on the open source page on our website.\n\n## Installation\n\nThis package can be installed using composer by running this command.\n\n```bash\ncomposer global require spatie/ssl-certificate-chain-resolver\n```\n\n## Usage\n\nLet's assume you have an incomplete certificate  called ```cert.crt```. To generate the a file containing the certificate and the entire trust chain, you can use this command:\n\n```bash\nssl-certificate-chain-resolver resolve cert.crt\n```\n\nA file containing the certificate and the entire trust chain will be saved as ```certificate-including-trust-chain.crt```\n\nYou can also pass the name of the file of the outputfile as the second argument:\n```bash\nssl-certificate-chain-resolver resolve cert.crt your-output-file.crt\n```\n\nIf the outputfile already exists, you will be asked if it's ok to overwrite it.\n\n## Updating\n\nYou can update \u003cb\u003essl-certificate-chain-resolver\u003c/b\u003e to the latest version by running:\n\n```bash\ncomposer global update spatie/ssl-certificate-chain-resolver\n```\n\n## Limitations\n\nCurrently this package does not work with Entity validation certificates or certificates issued by Let's Encrypt. A PR that adds this to package would be highly appreciated.\n\n## Testing\n\nFunctional and unit tests are included with the package.\n\nYou can run them yourself with ```vendor/bin/codecept run```\n\n## Credits\n\n- [Freek Van der Herten](https:/murze.be)\n- [All Contributors](https://github.com/freekmurze/ssl-certificate-chain-resolver/contributors)\n\nThis package was inspired by [cert-chain-resolver](https://github.com/zakjan/cert-chain-resolver/) written by [Jan Žák](http://www.zakjan.cz/). Some text, mainly the background about the trust chain, was copied from the readme of his repo.\n\n## Background: the trust chain\n\nAll operating systems contain a set of default trusted root certificates. But Certificate Authorities usually don't use their root certificate to sign customer certificates. Instead of they use so called intermediate certificates, because they can be rotated more frequently.\n\nA certificate can contain a special Authority Information Access extension (RFC-3280) with URL to issuer's certificate. Most browsers can use the AIA extension to download missing intermediate certificate to complete the certificate chain. This is the exact meaning of the Extra download message. But some clients, mostly mobile browsers, don't support this extension, so they report such certificate as untrusted.\n\nThis results in 'untrusted'-warnings like this, since the browser thinks you are on an insecure connection.\n\n![Untrusted Warning](images/untrusted.png)\n\nA server should always send a complete chain, which means concatenated all certificates from the certificate to the trusted root certificate (exclusive, in this order), to prevent such issues.  So when installing a SSL certificate on a server you should install all intermediate certificates as well. You should be able to fetch intermediate certificates from the issuer and concat them together by yourself.\n\nThis tool helps you automatize that boring task by looping over certificate's AIA extension field.\n\n## About Spatie\nSpatie is a webdesign agency in Antwerp, Belgium. You'll find an overview of all our open source projects [on our website](https://spatie.be/opensource).\n\n## License\n\nThe MIT License (MIT). Please see [License File](LICENSE) for more information.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspatie%2Fssl-certificate-chain-resolver","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fspatie%2Fssl-certificate-chain-resolver","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspatie%2Fssl-certificate-chain-resolver/lists"}