--- product: Chilkat product_version: 11.7.0 language: phpext language_label: PHP Extension class: Pem class_name: CkPem license: bundle deprecated: false reference_html: https://www.chilkatsoft.com/refdoc/phpCkPemRef.html --- # Chilkat Pem — PHP Extension — v11.7.0 > Chilkat 11.7.0 · language=phpext · class=Pem (CkPem) > Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0//classes/Pem.md`. > Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/guide.md`. ## Purpose **Load, inspect, assemble, export, and convert PEM certificate and key material.** `Chilkat.Pem` is the Chilkat class for handling PEM-formatted certificate and key material. It can load PEM and PKCS#7 data, add certificates, private keys, public keys, CSRs, and certificate chains, retrieve individual items, remove content, control PKCS#1 vs. PKCS#8 private key output, export PEM with optional encryption and extended attributes, and convert PEM material to PFX or Java KeyStore objects. **Load PEM and PKCS#7** Load PEM-encoded certificates, keys, CSRs, and PKCS#7 certificate data from files, strings, or memory. **Collect certs and keys** Add certificates, private keys, public keys, CSRs, and certificate chains into a single PEM container. **Retrieve individual items** Extract selected certificates, keys, CSRs, or chains for use with `Cert`, `PrivateKey`, `PublicKey`, or related Chilkat classes. **Private-key format control** Choose PKCS#1 or PKCS#8 private-key output depending on the format required by the target system. **Encrypted PEM output** Export private-key material with password-based encryption when PEM data must be stored or transferred securely. **Convert to PFX or JKS** Convert PEM certificates and keys into PFX/P12 or Java KeyStore objects when another platform or API requires those container formats. **Common pattern:** Use `Pem` when certificate and key material is packaged as one or more PEM blocks. Load the PEM, inspect or retrieve the needed items, add or remove entries as needed, then export the result as PEM, PFX/P12, or Java KeyStore data. Use `Chilkat.Cert`, `PrivateKey`, and `PublicKey` when working directly with individual objects. For an extended overview, see [Pem Class Overview](https://www.chilkatsoft.com/pem_class_overview.asp). ## Object creation, unlocking and error handling **Object Creation** ```php $obj = new CkPem(); ``` Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in PHP Extension. How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called. ## Members common to every Chilkat class Documented once per language in `common-members.md`; listed here so this page is self-contained. | Property | Signature | Access | Meaning | |---|---|---|---| | `DebugLogFilePath` | `string debugLogFilePath(); void put_DebugLogFilePath(string strVal);` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. | | `LastErrorHtml` | `(read-only) string lastErrorHtml();` | read-only | Provides HTML-formatted information about the last called method or property. | | `LastErrorText` | `(read-only) string lastErrorText();` | read-only | Provides plain text information about the last called method or property. | | `LastErrorXml` | `(read-only) string lastErrorXml();` | read-only | Provides XML-formatted information about the last called method or property. | | `LastMethodSuccess` | `bool get_LastMethodSuccess() void put_LastMethodSuccess(bool boolVal);` | read/write | Indicates the success or failure of the most recent method call: `true` means success, `false` means failure. | | `Utf8` | `bool get_Utf8() void put_Utf8(bool boolVal);` | read/write | When set to `true`, all `string` arguments and return values are interpreted as UTF-8 strings. | | `VerboseLogging` | `bool get_VerboseLogging() void put_VerboseLogging(bool boolVal);` | read/write | If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. | | `Version` | `(read-only) string version();` | read-only | Version of the component/library, such as "10.1.0" | ## Member index | Member | Kind | Signature | |---|---|---| | `AppendMode` | property, read/write | `bool get_AppendMode() void put_AppendMode(bool boolVal);` | | `NumCerts` | property, read-only | `(read-only) int get_NumCerts()` | | `NumCrls` | property, read-only | `(read-only) int get_NumCrls()` | | `NumCsrs` | property, read-only | `(read-only) int get_NumCsrs()` | | `NumPrivateKeys` | property, read-only | `(read-only) int get_NumPrivateKeys()` | | `NumPublicKeys` | property, read-only | `(read-only) int get_NumPublicKeys()` | | `PrivateKeyFormat` | property, read/write | `string privateKeyFormat(); void put_PrivateKeyFormat(string strVal);` | | `PublicKeyFormat` | property, read/write | `string publicKeyFormat(); void put_PublicKeyFormat(string strVal);` | | `AddCert` | method | `bool AddCert(CkCert $cert, bool $includeChain);` | | `AddItem` | method | `bool AddItem(string $itemType, string $encoding, string $itemData);` | | `AddP7b` | method | `bool AddP7b(CkBinData $bd);` | | `AddPrivateKey` | method | `bool AddPrivateKey(CkPrivateKey $privateKey);` | | `AddPrivateKey2` | method | `bool AddPrivateKey2(CkPrivateKey $privKey, CkCertChain $certChain);` | | `AddPublicKey` | method | `bool AddPublicKey(CkPublicKey $pubkey);` | | `CertAt` | method | `bool CertAt(int $index, CkCert $cert);` | | `Clear` | method | `bool Clear();` | | `GetEncodedItem` | method | `bool GetEncodedItem(string $itemType, string $itemSubType, string $encoding, int $index, CkString outStr); string getEncodedItem(string itemType, string itemSubType, string encoding, int index);` | | `LoadP7bFile` | method | `bool LoadP7bFile(string $path);` | | `LoadPem` | method | `bool LoadPem(string $pemContent, string $password);` | | `LoadPemFile` | method | `bool LoadPemFile(string $path, string $password);` | | `LoadTaskCaller` | method | `bool LoadTaskCaller(CkTask $task);` | | `PrivateKeyAt` | method | `bool PrivateKeyAt(int $index, CkPrivateKey $privKey);` | | `PublicKeyAt` | method | `bool PublicKeyAt(int $index, CkPublicKey $pubKey);` | | `RemoveCert` | method | `bool RemoveCert(int $index);` | | `RemovePrivateKey` | method | `bool RemovePrivateKey(int $index);` | | `ToJksObj` | method | `bool ToJksObj(string $aliasName, string $password, CkJavaKeyStore $jksObj);` | | `ToPem` | method | `bool ToPem(CkString outStr); string toPem();` | | `ToPemEx` | method | `bool ToPemEx(bool $extendedAttrs, bool $noKeys, bool $noCerts, bool $noCaCerts, string $encryptAlg, string $password, CkString outStr); string toPemEx(bool extendedAttrs, bool noKeys, bool noCerts, bool noCaCerts, string encryptAlg, string password);` | | `ToPfxObj` | method | `bool ToPfxObj(CkPfx $pfxObj);` | Deprecated members are listed at the end of this file with their replacements; do not use them in new code. ## Properties ### Pem.AppendMode `Chilkat 11.7.0 · phpext · Pem · AppendMode · property · read/write · since 9.5.0.49` ```php bool get_AppendMode() void put_AppendMode(bool boolVal); ``` When set to `true`, each of the Load\* methods appends to the current contents of this PEM object. When set to `false`, a Load\* method replaces the contents of this PEM object. The default is `false`. ### Pem.NumCerts `Chilkat 11.7.0 · phpext · Pem · NumCerts · property · read-only · since 9.5.0.49` ```php (read-only) int get_NumCerts() ``` The number of certificates in the loaded PEM. To get the 1st certificate, call GetCert(0). ### Pem.NumCrls `Chilkat 11.7.0 · phpext · Pem · NumCrls · property · read-only · since 9.5.0.77` ```php (read-only) int get_NumCrls() ``` The number of certificate revocation lists (CRLs) in the loaded PEM. ### Pem.NumCsrs `Chilkat 11.7.0 · phpext · Pem · NumCsrs · property · read-only · since 9.5.0.50` ```php (read-only) int get_NumCsrs() ``` The number of certificate signing requests (CSRs) in the loaded PEM. ### Pem.NumPrivateKeys `Chilkat 11.7.0 · phpext · Pem · NumPrivateKeys · property · read-only · since 9.5.0.49` ```php (read-only) int get_NumPrivateKeys() ``` The number of private keys in the loaded PEM. To get the 1st private key, call GetPrivateKey(0). ### Pem.NumPublicKeys `Chilkat 11.7.0 · phpext · Pem · NumPublicKeys · property · read-only · since 9.5.0.49` ```php (read-only) int get_NumPublicKeys() ``` The number of public keys in the loaded PEM. To get the 1st public key, call GetPublicKey(0). ### Pem.PrivateKeyFormat `Chilkat 11.7.0 · phpext · Pem · PrivateKeyFormat · property · read/write · since 9.5.0.49` ```php string privateKeyFormat(); void put_PrivateKeyFormat(string strVal); ``` Controls the format to be used for **unencrypted** private keys when writing a PEM. Possible values are `pkcs1` and `pkcs8`. (OpenSSL typically uses the `pkcs8` format.) When writing encrypted private keys to PEM, the format is always PKCS8, and the PEM header is `BEGIN ENCRYPTED PRIVATE KEY`. The default is `pkcs8`. The PKCS1 format uses the PEM header: BEGIN RSA PRIVATE KEY. The PKCS8 format uses the PEM header: BEGIN PRIVATE KEY. ### Pem.PublicKeyFormat `Chilkat 11.7.0 · phpext · Pem · PublicKeyFormat · property · read/write · since 9.5.0.49` ```php string publicKeyFormat(); void put_PublicKeyFormat(string strVal); ``` Controls the format to be used for public keys when writing a PEM. Possible values are `pkcs1` and `pkcs8`. (OpenSSL typically uses the `pkcs8` format.) The default is `pkcs8`. The PKCS1 format uses the PEM header: BEGIN RSA PUBLIC KEY. The PKCS8 format uses the PEM header: BEGIN PUBLIC KEY. ## Methods ### Pem.AddCert `Chilkat 11.7.0 · phpext · Pem · AddCert · method · since 9.5.0.49` ```php bool AddCert(CkCert $cert, bool $includeChain); ``` Adds a certificate, and potentially the certs in its chain of authentication to the PEM. If `includeChain` is `true`, then certificates in the `cert`'s chain of authentication up to and including the root are automatically added. Returns true for success, false for failure. ### Pem.AddItem `Chilkat 11.7.0 · phpext · Pem · AddItem · method · since 9.5.0.59` ```php bool AddItem(string $itemType, string $encoding, string $itemData); ``` Adds a certificate, private key, public key, or csr to the PEM. The possible values for `itemType` are `certificate` (or `cert`), `privateKey`, `publicKey`, or `csr`. The `encoding` can be `Base64`, `modBase64`, `Base32`, `QP` (for quoted-printable), `URL` (for url-encoding), `Hex`, `url_oauth`, `url_rfc1738`, `url_rfc2396`, and `url_rfc3986`. The `itemData` contains the ASN.1 data in string format according to the encoding specified in `encoding`. Returns true for success, false for failure. ### Pem.AddP7b `Chilkat 11.7.0 · phpext · Pem · AddP7b · method · since 11.0.0` ```php bool AddP7b(CkBinData $bd); ``` Loads the PEM from the contents of an PKCS7 container (.p7b) contained in `bd`. A .p7b (or .p7c) file contains a PKCS#7 container, which may include: - One or more X.509 certificates (a certificate chain) - Optionally, CRLs (Certificate Revocation Lists) - No private key Common Use: Used to bundle intermediate and root certificates for things like SSL certificate chains. Returns true for success, false for failure. ### Pem.AddPrivateKey `Chilkat 11.7.0 · phpext · Pem · AddPrivateKey · method · since 9.5.0.49` ```php bool AddPrivateKey(CkPrivateKey $privateKey); ``` Adds a private key to the PEM object. Returns true for success, false for failure. ### Pem.AddPrivateKey2 `Chilkat 11.7.0 · phpext · Pem · AddPrivateKey2 · method · since 9.5.0.49` ```php bool AddPrivateKey2(CkPrivateKey $privKey, CkCertChain $certChain); ``` Adds a private key and it's associated certificate chain to the PEM object. Returns true for success, false for failure. ### Pem.AddPublicKey `Chilkat 11.7.0 · phpext · Pem · AddPublicKey · method · since 9.5.0.49` ```php bool AddPublicKey(CkPublicKey $pubkey); ``` Adds a public key to the PEM object. Returns true for success, false for failure. ### Pem.CertAt `Chilkat 11.7.0 · phpext · Pem · CertAt · method · since 11.0.0` ```php bool CertAt(int $index, CkCert $cert); ``` Returns in `cert` the Nth certificate from the PEM. The first certificate is at index 0. Returns true for success, false for failure. ### Pem.Clear `Chilkat 11.7.0 · phpext · Pem · Clear · method · since 9.5.0.49` ```php bool Clear(); ``` Removes all content from this PEM object. Returns true for success, false for failure. ### Pem.GetEncodedItem `Chilkat 11.7.0 · phpext · Pem · GetEncodedItem · method · since 9.5.0.50` ```php bool GetEncodedItem(string $itemType, string $itemSubType, string $encoding, int $index, CkString outStr); string getEncodedItem(string itemType, string itemSubType, string encoding, int index); ``` Returns the encoded contents of the Nth item of a particular type (0-based `index`). The possible values for `itemType` are `certificate` (or `cert`), `privateKey`, `publicKey`, or `csr`. Input string args are case-insensitive. If the `itemType` is `privateKey`, the `itemSubType` may be `der` or `pkcs8`. If the `itemType` is `publicKey`, the `itemSubType` may be `der` or `pkcs1`. The `itemSubType` is ignored for other values of `itemType`. The valid `encoding` modes are `Base64`, `modBase64`, `Base32`, `Base58`, `QP` (for quoted-printable), `URL` (for url-encoding), `Hex`, `url_oauth`, `url_rfc1738`, `url_rfc2396`, and `url_rfc3986`. Returns true for success, false for failure. ### Pem.LoadP7bFile `Chilkat 11.7.0 · phpext · Pem · LoadP7bFile · method · since 9.5.0.49` ```php bool LoadP7bFile(string $path); ``` Loads the contents of a PKCS7 container (.p7b file). Returns true for success, false for failure. ### Pem.LoadPem `Chilkat 11.7.0 · phpext · Pem · LoadPem · method · since 9.5.0.49` ```php bool LoadPem(string $pemContent, string $password); ``` Loads the PEM from a PEM string. If encrypted, then the `password` is required for decryption. Otherwise, an empty string (or any string) may be passed for the `password`. Returns true for success, false for failure. ### Pem.LoadPemFile `Chilkat 11.7.0 · phpext · Pem · LoadPemFile · method · since 9.5.0.49` ```php bool LoadPemFile(string $path, string $password); ``` Loads the PEM from a PEM file. If encrypted, then the `password` is required for decryption. Otherwise, an empty string (or any string) may be passed for the `password`. Returns true for success, false for failure. ### Pem.LoadTaskCaller `Chilkat 11.7.0 · phpext · Pem · LoadTaskCaller · method · since 9.5.0.80` ```php bool LoadTaskCaller(CkTask $task); ``` Loads the caller of the task's async method. Returns true for success, false for failure. ### Pem.PrivateKeyAt `Chilkat 11.7.0 · phpext · Pem · PrivateKeyAt · method · since 11.0.0` ```php bool PrivateKeyAt(int $index, CkPrivateKey $privKey); ``` Returns in `privKey` the Nth private key from the PEM. The first private key is at index 0. Returns true for success, false for failure. ### Pem.PublicKeyAt `Chilkat 11.7.0 · phpext · Pem · PublicKeyAt · method · since 11.0.0` ```php bool PublicKeyAt(int $index, CkPublicKey $pubKey); ``` Returns in `pubKey` the Nth public key from the PEM. The first public key is at index 0. Returns true for success, false for failure. ### Pem.RemoveCert `Chilkat 11.7.0 · phpext · Pem · RemoveCert · method · since 9.5.0.49` ```php bool RemoveCert(int $index); ``` Removes the Nth certificate from the PEM. The first certificate is at index 0. Returns true for success, false for failure. ### Pem.RemovePrivateKey `Chilkat 11.7.0 · phpext · Pem · RemovePrivateKey · method · since 9.5.0.49` ```php bool RemovePrivateKey(int $index); ``` Removes the Nth private key from the PEM. The first private key is at index 0. Returns true for success, false for failure. ### Pem.ToJksObj `Chilkat 11.7.0 · phpext · Pem · ToJksObj · method · since 11.0.0` ```php bool ToJksObj(string $aliasName, string $password, CkJavaKeyStore $jksObj); ``` This function converts this PEM to a Java KeyStore (JKS) object and stores it in `jksObj`. If `aliasName` is provided, it will be used as the alias for the first object in the PEM (either a private key or certificate), while subsequent objects will receive autogenerated aliases. The resulting JKS will be encrypted with `password`, unless the PEM contains only certificates, in which case `password` is not used. Returns true for success, false for failure. ### Pem.ToPem `Chilkat 11.7.0 · phpext · Pem · ToPem · method · since 9.5.0.47` ```php bool ToPem(CkString outStr); string toPem(); ``` Write the PFX to a PEM formatted string. The resultant PEM will contain the private key, as well as the certs in the chain of authentication (or whatever certs are available in the PFX). For example: ``` -----BEGIN RSA PRIVATE KEY----- ... ... the private key associated with the main certificate. ... -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- ... ... the main certificate ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... ... an intermediate CA certificate (if present) ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... ... the root CA certificate ... -----END CERTIFICATE----- ``` Returns true for success, false for failure. ### Pem.ToPemEx `Chilkat 11.7.0 · phpext · Pem · ToPemEx · method · since 9.5.0.49` ```php bool ToPemEx(bool $extendedAttrs, bool $noKeys, bool $noCerts, bool $noCaCerts, string $encryptAlg, string $password, CkString outStr); string toPemEx(bool extendedAttrs, bool noKeys, bool noCerts, bool noCaCerts, string encryptAlg, string password); ``` Write the PFX to a PEM formatted string. If `extendedAttrs` is `true`, then extended properties (Bag Attributes and Key Attributes) are output. If `noKeys` is `true`, then no private keys are output. If `noCerts` is `true`, then no certificates are output. If `noCaCerts` is `true`, then no CA certs or intermediate CA certs are output. If `encryptAlg` is not empty, it indicates the encryption algorithm to be used for encrypting the private keys (otherwise the private keys are output unencrypted). The possible choices for the `encryptAlg` are `des3`, `aes128`, `aes192`, and `aes256`. (All encryption algorithm choices use CBC mode.) If the private keys are to be encrypted, then `password` is the password to be used. Otherwise, `password` may be left empty. For example: ``` Bag Attributes Microsoft Local Key set: localKeyID: 01 00 00 00 friendlyName: le-2b09a3d2-9037-4a05-95cc-4d44518e8607 Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider Key Attributes X509v3 Key Usage: 10 -----BEGIN RSA PRIVATE KEY----- ... ... the private key associated with the main certificate. ... -----END RSA PRIVATE KEY----- Bag Attributes localKeyID: 01 00 00 00 1.3.6.1.4.1.311.17.3.92: 00 08 00 00 1.3.6.1.4.1.311.17.3.20: C2 53 54 F3 ... 1.3.6.1.4.1.311.17.3.71: 49 00 43 00 ... 1.3.6.1.4.1.311.17.3.75: 31 00 42 00 ... subject=/OU=Domain Control Validated/OU=PositiveSSL/CN=something.com issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA -----BEGIN CERTIFICATE----- ... ... the main certificate ... -----END CERTIFICATE----- ... -----BEGIN CERTIFICATE----- ... ... an intermediate CA certificate (if present) ... -----END CERTIFICATE----- ... -----BEGIN CERTIFICATE----- ... ... the root CA certificate ... -----END CERTIFICATE----- ``` Returns true for success, false for failure. ### Pem.ToPfxObj `Chilkat 11.7.0 · phpext · Pem · ToPfxObj · method · since 11.0.0` ```php bool ToPfxObj(CkPfx $pfxObj); ``` Converts this PEM object, which must contain at least one private key, to PKCS12 and returns the PFX in `pfxObj`. Typically, a PKCS12 file includes one private key, its associated certificate, and the certificate chain. Returns true for success, false for failure. ## Deprecated members — do not use in new code | Member | Kind | Deprecated in | Use instead | |---|---|---|---| | `GetCert` | method | before 11.6.1 | `CertAt` | | `GetPrivateKey` | method | before 11.6.1 | `PrivateKeyAt` | | `GetPublicKey` | method | before 11.6.1 | `PublicKeyAt` | | `LoadP7b` | method | before 11.6.1 | — | | `ToJks` | method | before 11.6.1 | `ToJksObj` | | `ToPfx` | method | before 11.6.1 | `ToPfxObj` | ## Related classes [`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/BinData.md), [`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/Cert.md), [`CertChain`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/CertChain.md), [`JavaKeyStore`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/JavaKeyStore.md), [`Pfx`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/Pfx.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/PrivateKey.md), [`PublicKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/PublicKey.md), [`Task`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/Task.md)