How to get SSL certificate info with CURL in PHP

When working with SSL certificates in PHP, it is often necessary to access information about the certificate, such as the issuer, subject, and expiration date. The stream_context_create() function can be used to create a stream context that specifies the SSL certificate to be used. The stream_context_get_params() function can then be used to retrieve the certificate information from the stream context.

For example, the following code gets the SSL certificate information for the Google website:

$url = "https://www.google.com";
$context = stream_context_create(array("ssl" => array("capture_peer_cert" => TRUE)));
$read = fopen($url, 'r', false, $context);
$cert = stream_context_get_params($read);
$certinfo = openssl_x509_parse($cert['options']['ssl']['peer_certificate']);
print_r($certinfo);

This code will output the following information about the Google SSL certificate:

Array
(
    [name] => /C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
    [subject] => Array
        (
            [C] => US
            [ST] => California
            [L] => Mountain View
            [O] => Google Inc
            [CN] => www.google.com
        )

    [hash] => dcdd9741
    [issuer] => Array
        (
            [C] => US
            [O] => Google Inc
            [CN] => Google Internet Authority G2
        )

    [version] => 2
    [serialNumber] => 3007864570594926146
    [validFrom] => 150408141631Z
    [validTo] => 150707000000Z
    [validFrom_time_t] => 1428498991
    [validTo_time_t] => 1436223600
    [purposes] => Array
        (
            [1] => Array
                (
                    [0] => 1
                    [1] =>
                    [2] => sslclient
                )

            [2] => Array
                (
                    [0] => 1
                    [1] =>
                    [2] => sslserver
                )

            [3] => Array
                (
                    [0] => 1
                    [1] =>
                    [2] => nssslserver
                )

            [4] => Array
                (
                    [0] =>
                    [1] =>
                    [2] => smimesign
                )

            [5] => Array
                (
                    [0] =>
                    [1] =>
                    [2] => smimeencrypt
                )

            [6] => Array
                (
                    [0] => 1
                    [1] =>
                    [2] => crlsign
                )

            [7] => Array
                (
                    [0] => 1
                    [1] => 1
                    [2] => any
                )

            [8] => Array
                (
                    [0] => 1
                    [1] =>
                    [2] => ocsphelper
                )

        )

    [extensions] => Array
        (
            [extendedKeyUsage] => TLS Web Server Authentication, TLS Web Client Authentication
            [subjectAltName] => DNS:www.google.com
            [authorityInfoAccess] => CA Issuers - URI:http://pki.google.com/GIAG2.crt
OCSP - URI:http://clients1.google.com/ocsp

            [subjectKeyIdentifier] => FD:1B:28:50:FD:58:F2:8C:12:26:D7:80:E4:94:E7:CD:BA:A2:6A:45
            [basicConstraints] => CA:FALSE
            [authorityKeyIdentifier] => keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F

            [certificatePolicies] => Policy: 1.3.6.1.4.1.11129.2.5.1

            [crlDistributionPoints] => URI:http://pki.google.com/GIAG2.crl

        )

)

This information can be used to verify the identity of the website and to ensure that the certificate is valid.