autenticazione/App/Models/Cns.php

<?php

namespace MwgAuth\Models;

use MwgAuth\Core\Model;

class Cns extends Model
{
    private static $policyValide = [
        '1.3.76.16.2.1',            // CNS
        '1.3.76.47.4',              // CIE
        '1.3.6.1.4.1.29741.1.1.10', // CNS-Like
        '1.3.159.1.10.1',           // Actalis
        '1.3.76.36.1.1.3',          // CNS-Like Infocert
    ];
    private $certificato;
    private $codiceFiscale;

    public function __construct(string $certificato)
    {
        if (null !== $certificato) {
            $this->certificato = openssl_x509_parse($certificato, false);
            $this->verificaCertificato();
            // https://www.agid.gov.it/sites/default/files/repository_files/documentazione_trasparenza/strutturacertificatoautenticazionecns_v1.1_.pdf
            if (isset($this->certificato['subject']['serialNumber'])) {
                $this->codiceFiscale = preg_replace(
                    '/^[A-Za-z]{2}:/',
                    '',
                    $this->certificato['subject']['serialNumber']
                );
            } else {
                $this->codiceFiscale = explode('/', $this->certificato['subject']['commonName'])[0];
            }
        }
    }

    public function getCertificato(): array
    {
        return $this->certificato;
    }

    public function getCodiceFiscale(): ?string
    {
        return $this->codiceFiscale;
    }

    public function getCognome(): ?string
    {
        if (isset($this->certificato['subject']['surname'])) {
            $ret = $this->certificato['subject']['surname'];
        } elseif (isset($this->certificato['subject']['organizationalUnitName'])) {
            $ret = $this->certificato['subject']['organizationalUnitName'];
            if (is_array($ret)) {
                $ret = implode('/', $ret);
            }
        } else {
            $ret = $this->codiceFiscale;
        }
        return $ret;
    }

    public function getNome(): ?string
    {
        return $this->certificato['subject']['givenName'] ?? $this->codiceFiscale;
    }

    public function verificaPolicyCertificato(): bool
    {
        preg_match_all(
            '/Policy: ([0-9\.]+)/',
            $this->certificato['extensions']['certificatePolicies'],
            $policies
        );
        foreach ($policies[1] as $policy) {
            if (in_array($policy, self::$policyValide)) {
                return true;
            }
        }
        $this->salvaCertificato();
        return false;
    }

    private function verificaCertificato()
    {
        if (
            !isset($this->certificato['subject']['commonName'])
            || !isset($this->certificato['subject']['surname'])
            || !isset($this->certificato['subject']['givenName'])
            || isset($this->certificato['subject']['serialNumber'])
            || !isset($this->certificato['extensions']['certificatePolicies'])
        ) {
            $this->salvaCertificato();
        }
    }

    private function salvaCertificato()
    {
        $file = '/var/www/html/cns/policy/cert-' . sha1($this->certificato['subject']['commonName']);
        @file_put_contents($file . '.txt', print_r($this->certificato, true));
        @file_put_contents($file . '.cer', $_SERVER['SSL_CLIENT_CERT']);
    }
}