Title: Ssl::verify_certificate
Published: March 29, 2023
Last modified: November 8, 2023

---

# Ssl::verify_certificate( string|WpOrgRequestsStringable $host, array $cert ): bool

## In this article

 * [Description](https://developer.wordpress.org/reference/classes/wporg-requests-ssl/verify_certificate/?output_format=md#description)
 * [Parameters](https://developer.wordpress.org/reference/classes/wporg-requests-ssl/verify_certificate/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/classes/wporg-requests-ssl/verify_certificate/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/classes/wporg-requests-ssl/verify_certificate/?output_format=md#source)

[ Back to top](https://developer.wordpress.org/reference/classes/wporg-requests-ssl/verify_certificate/?output_format=md#wp--skip-link--target)

Verify the certificate against common name and subject alternative names

## 󠀁[Description](https://developer.wordpress.org/reference/classes/wporg-requests-ssl/verify_certificate/?output_format=md#description)󠁿

Unfortunately, PHP doesn’t check the certificate against the alternative names, 
leading things like ‘[https://www.github.com/](https://www.github.com/)‘ to be invalid.

## 󠀁[Parameters](https://developer.wordpress.org/reference/classes/wporg-requests-ssl/verify_certificate/?output_format=md#parameters)󠁿

 `$host`string|WpOrgRequestsStringablerequired

Host name to verify against

`$cert`arrayrequired

Certificate data from openssl_x509_parse()

## 󠀁[Return](https://developer.wordpress.org/reference/classes/wporg-requests-ssl/verify_certificate/?output_format=md#return)󠁿

 bool

## 󠀁[Source](https://developer.wordpress.org/reference/classes/wporg-requests-ssl/verify_certificate/?output_format=md#source)󠁿

    ```php
    public static function verify_certificate($host, $cert) {
    	if (InputValidator::is_string_or_stringable($host) === false) {
    		throw InvalidArgument::create(1, '$host', 'string|Stringable', gettype($host));
    	}

    	if (InputValidator::has_array_access($cert) === false) {
    		throw InvalidArgument::create(2, '$cert', 'array|ArrayAccess', gettype($cert));
    	}

    	$has_dns_alt = false;

    	// Check the subjectAltName
    	if (!empty($cert['extensions']['subjectAltName'])) {
    		$altnames = explode(',', $cert['extensions']['subjectAltName']);
    		foreach ($altnames as $altname) {
    			$altname = trim($altname);
    			if (strpos($altname, 'DNS:') !== 0) {
    				continue;
    			}

    			$has_dns_alt = true;

    			// Strip the 'DNS:' prefix and trim whitespace
    			$altname = trim(substr($altname, 4));

    			// Check for a match
    			if (self::match_domain($host, $altname) === true) {
    				return true;
    			}
    		}

    		if ($has_dns_alt === true) {
    			return false;
    		}
    	}

    	// Fall back to checking the common name if we didn't get any dNSName
    	// alt names, as per RFC2818
    	if (!empty($cert['subject']['CN'])) {
    		// Check for a match
    		return (self::match_domain($host, $cert['subject']['CN']) === true);
    	}

    	return false;
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/requests/src/ssl.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/Requests/src/Ssl.php#L35)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/Requests/src/Ssl.php#L35-L79)

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Fclasses%2Fwporg-requests-ssl%2Fverify_certificate%2F)
before being able to contribute a note or feedback.