PHP - Openssl Key Help.

Hi i have php script which i have been running on on my web server which is dreamhost which is working fine...

but here's  the twist i have just set-up a xampp server apache 2.2 on my windows 7 machine my website is running fine expect for the openssl encrypt script which is filing to encrypt

here's a sample of my code.

$MY_KEY_FILE = "c:\\xampp\\apache\\bin\\my-prvkey.pem";

# public certificate file to use
$MY_CERT_FILE = "c:\\xampp\\apache\\bin\\my-pubcert.pem";

# Paypal's public certificate
$PAYPAL_CERT_FILE = "c:\\xampp\\apache\\bin\\paypal_cert_pem.txt";

# path to the openssl binary
$OPENSSL = "c:\\xampp\\apache\\bin\\openssl.exe";
 


$form = array('cmd' => '_xclick',
        'business' => 'removed business name for security ',
        'cert_id' => 'removed cert id for security',
        'lc' => 'AU',
        'custom' => ''.$id.'',
        'invoice' => removed business name for security',
        'currency_code' => 'AUD',
        'no_shipping' => '1',
        'item_name' => 'removed business name for security',
        'item_number' => '1',
   'amount' => $total
   );


   $encrypted = paypal_encrypt($form);


function paypal_encrypt($hash)
{
   //Sample PayPal Button Encryption: Copyright 2006-2010 StellarWebSolutions.com
   //Not for resale - license agreement at
   //http://www.stellarwebsolutions.com/en/eula.php
   global $MY_KEY_FILE;
   global $MY_CERT_FILE;
   global $PAYPAL_CERT_FILE;
   global $OPENSSL;


   if (!file_exists($MY_KEY_FILE)) {
      echo "ERROR: MY_KEY_FILE $MY_KEY_FILE not found\n";
   }
   if (!file_exists($MY_CERT_FILE)) {
      echo "ERROR: MY_CERT_FILE $MY_CERT_FILE not found\n";
   }
   if (!file_exists($PAYPAL_CERT_FILE)) {
      echo "ERROR: PAYPAL_CERT_FILE $PAYPAL_CERT_FILE not found\n";
   }


   //Assign Build Notation for PayPal Support
   $hash['bn']= 'StellarWebSolutions.PHP_EWP2';

   $data = "";
   foreach ($hash as $key => $value) {
      if ($value != "") {
         //echo "Adding to blob: $key=$value\n";
         $data .= "$key=$value\n";
      }
   }
// here's where i believe the problem is when creating and signing the my_cert_file i had to specify where the openssl.cnf file was do i need to do same here..
-config c:\\xampp\\apache\\bin\\openssl.cnf


   $openssl_cmd = "($OPENSSL smime -sign -signer $MY_CERT_FILE -inkey $MY_KEY_FILE " .
                  "-outform der -nodetach -binary <<_EOF_\n$data\n_EOF_\n) | " .
                  "$OPENSSL smime -encrypt -des3 -binary -outform pem $PAYPAL_CERT_FILE";

   exec($openssl_cmd, $output, $error);

   if (!$error) {
      return implode("\n",$output);
   } else {
      return "ERROR: encryption failed";

      
   }
   echo $output;

};

 

Hello guys, i need to create a code for making connections with SSL servers (particularly SMTPS and POP3S) and i know about the existence of OpenSSL extension.

However, i'm in doubt about a basic issue:

1. Is this extension useful for creating SSL clients or SSL servers?

I'm not a SSL expert, so maybe i'm misunderstanding something; i hope you can help me.

Kind regards.

I am trying to use SSH2 functions in PHP and I read the documentation for each LIBSSH2, OpenSSL and PECL SSH2 and I can't figure out how to install any of them on the Windows Server X64 box. Does anyone know how to do this?

http://www.php.net/manual/en/ssh2.requirements.php
http://pecl.php.net/package/ssh2
http://www.openssl.org/
http://www.libssh2.org/

Thanks,
sanchez

I have an ecommerce site on shared hosting enviroment. My ecommerce site stores customer data (name, address, email, phone, and item purchase) in mySQL database.

(No super private data like credit card numbers or social security numbers.)

Using openssl (openssl_cipher, iv, etc.), I've been encrypting this customer data and storing the encrypted data in mySQL.

Today, I'm thinking "what's the point." It's like having a lockbox with the key on the wall above...

My thoughts:
1. The "secret cyphers" are located on my server, so if someone hacks my server, they'll get the secret cyphers anyway.
2. Encrypting the Customer Data will add, at the most, 5 extra minutes, for the hacker to find.
3. Perhaps if mySQL was stored on a different server, encrypting may be useful... but mySQL is on same server.
4. On the flipside, if I did get hacked, at least I could demonstrate I tried my best to encrypt what I could...

What do you all think?

Sorry for my bad english. I am not from around these parts.