openssl_csr_sign

Sign a CSR with another certificate (or itself) and generate a certificate

&reftitle.description; `resource` `openssl_csr_sign` `mixed` `csr` `mixed` `cacert` `mixed` `priv_key` `int` `days` `array` `configargs` `int` `serial` 0

`openssl_csr_sign` generates an x509 certificate resource from the given CSR.

¬e.openssl.cnf;
&reftitle.parameters;

`csr`

- A CSR previously generated by `openssl_csr_new`. It can also be the path to a PEM encoded CSR when specified as `file://path/to/csr` or an exported string generated by `openssl_csr_export`.

`cacert`

- The generated certificate will be signed by `cacert`. If `cacert` is &null;, the generated certificate will be a self-signed certificate.

`priv_key`

- `priv_key` is the private key that corresponds to `cacert`.

`days`

- `days` specifies the length of time for which the generated certificate will be valid, in days.

`configargs`

- You can finetune the CSR signing by `configargs`. See `openssl_csr_new` for more information about `configargs`.

`serial`

- An optional the serial number of issued certificate. If not specified it will default to 0.

&reftitle.returnvalues;

Returns an x509 certificate resource on success, &false; on failure.

&reftitle.changelog;

&Version; | &Description;
4.3.3 | The `serial` parameter was added.

&reftitle.examples;

### `openssl_csr_sign` example - signing a CSR (how to implement your own CA)

    <?php
    // Let's assume that this script is set to receive a CSR that has
    // been pasted into a textarea from another page
    $csrdata = $_POST["CSR"];

    // We will sign the request using our own "certificate authority"
    // certificate.  You can use any certificate to sign another, but
    // the process is worthless unless the signing certificate is trusted
    // by the software/users that will deal with the newly signed certificate

    // We need our CA cert and its private key
    $cacert = "file://path/to/ca.crt";
    $privkey = array("file://path/to/ca.key", "your_ca_key_passphrase");

    $usercert = openssl_csr_sign($csrdata, $cacert, $privkey, 365);

    // Now display the generated certificate so that the user can
    // copy and paste it into their local configuration (such as a file
    // to hold the certificate for their SSL server)
    openssl_x509_export($usercert, $certout);
    echo $certout;

    // Show any errors that occurred here
    while (($e = openssl_error_string()) !== false) {
        echo $e . "\n";
    }
    ?>