openssl_csr_new

Generates a CSR

&reftitle.description; ``OpenSSLCertificateSigningRequest``bool```openssl_csr_new` `array` `distinguished_names` #[\SensitiveParameter]``OpenSSLAsymmetricKey``null```private_key` ``array``null```options`&null; ``array``null```extra_attributes`&null;

`openssl_csr_new` generates a new CSR based on the information provided by `distinguished_names`.

¬e.openssl.cnf;
&reftitle.parameters;

`distinguished_names`

- The Distinguished Name or subject fields to be used in the certificate.

`private_key`

- `private_key` should be set to a private key that was previously generated by `openssl_pkey_new` (or otherwise obtained from the other openssl_pkey family of functions), or &null; variable. If its value is &null; variable, a new private key is generated based on the supplied `options` and assigned to supplied variable. The corresponding public portion of the key will be used to sign the CSR.

`options`

- By default, the information in your system `openssl.conf` is used to initialize the request; you can specify a configuration file section by setting the `config_section_section` key in `options`. You can also specify an alternative OpenSSL configuration file by setting the value of the `config` key to the path of the file you want to use. The following keys, if present in `options` behave as their equivalents in the `openssl.conf`, as listed in the table below.

  ## Configuration overrides

  `options` key | type | `openssl.conf` equivalent | description
  digest_alg | `string` | default_md | Digest method or signature hash, usually one of `openssl_get_md_methods`
  x509_extensions | `string` | x509_extensions | Selects which extensions should be used when creating an x509 certificate
  req_extensions | `string` | req_extensions | Selects which extensions should be used when creating a CSR
  private_key_bits | `int` | default_bits | Specifies how many bits should be used to generate a private key
  private_key_type | `int` | none | Specifies the type of private key to create. This can be one of `OPENSSL_KEYTYPE_DSA`, `OPENSSL_KEYTYPE_DH`, `OPENSSL_KEYTYPE_RSA` or `OPENSSL_KEYTYPE_EC`. The default value is `OPENSSL_KEYTYPE_RSA`.
  encrypt_key | `bool` | encrypt_key | Should an exported key (with passphrase) be encrypted?
  encrypt_key_cipher | `int` | none | One of cipher constants.
  curve_name | `string` | none | One of `openssl_get_curve_names`.
  config | `string` | N/A | Path to your own alternative openssl.conf file.

`extra_attributes`

- `extra_attributes` is used to specify additional configuration options for the CSR. Both `distinguished_names` and `extra_attributes` are associative arrays, whose keys are converted to OIDs and applied to the relevant part of the request.

&reftitle.returnvalues;

Returns the CSR on success, &true; if CSR creation is successful but signing fails&return.falseforfailure;.

&reftitle.changelog;

&Version; | &Description;
8.0.0 | On success, this function returns an `OpenSSLCertificateSigningRequest` instance now; previously, a &resource; of type `OpenSSL X.509 CSR` was returned.
8.0.0 | `private_key` accepts an `OpenSSLAsymmetricKey` instance now; previously, a &resource; of type `OpenSSL key` was accepted.
7.1.0 | `options` now also supports `curve_name`.

&reftitle.examples;

### Creating a self-signed certificate

    <?php
    // for SSL server certificates the commonName is the domain name to be secured
    // for S/MIME email certificates the commonName is the owner of the email address
    // location and identification fields refer to the owner of domain or email subject to be secured
    $dn = array(
        "countryName" => "GB",
        "stateOrProvinceName" => "Somerset",
        "localityName" => "Glastonbury",
        "organizationName" => "The Brain Room Limited",
        "organizationalUnitName" => "PHP Documentation Team",
        "commonName" => "Wez Furlong",
        "emailAddress" => "wez@example.com"
    );

    // Generate a new private (and public) key pair
    $privkey = openssl_pkey_new(array(
        "private_key_bits" => 2048,
        "private_key_type" => OPENSSL_KEYTYPE_RSA,
    ));

    // Generate a certificate signing request
    $csr = openssl_csr_new($dn, $privkey, array('digest_alg' => 'sha256'));

    // Generate a self-signed cert, valid for 365 days
    $x509 = openssl_csr_sign($csr, null, $privkey, $days=365, array('digest_alg' => 'sha256'));

    // Save your private key, CSR and self-signed cert for later use
    openssl_csr_export($csr, $csrout) and var_dump($csrout);
    openssl_x509_export($x509, $certout) and var_dump($certout);
    openssl_pkey_export($privkey, $pkeyout, "mypassword") and var_dump($pkeyout);

    // Show any errors that occurred here
    while (($e = openssl_error_string()) !== false) {
        echo $e . "\n";
    }
    ?>

### Creating a self-signed ECC certificate (as of PHP 7.1.0)

    <?php
    $subject = array(
        "commonName" => "docs.php.net",
    );

    // Generate a new private (and public) key pair
    $private_key = openssl_pkey_new(array(
        "private_key_type" => OPENSSL_KEYTYPE_EC,
        "curve_name" => 'prime256v1',
    ));

    // Generate a certificate signing request
    $csr = openssl_csr_new($subject, $private_key, array('digest_alg' => 'sha384'));

    // Generate self-signed EC cert
    $x509 = openssl_csr_sign($csr, null, $private_key, $days=365, array('digest_alg' => 'sha384'));
    openssl_x509_export_to_file($x509, 'ecc-cert.pem');
    openssl_pkey_export_to_file($private_key, 'ecc-private.key');
    ?>

&reftitle.seealso;

- `openssl_csr_sign`