PHP openssl_csr_export() Function: Usage and Examples

openssl_csr_export serializes a certificate signing request into a PEM-formatted string, usually to send to a certificate issuer.

The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.

What It Does

The operation is intended for: openssl_csr_export serializes a certificate signing request into a PEM-formatted string, usually to send to a certificate issuer.

The OpenSSL extension must be enabled.

Syntax and Return Value

openssl_csr_export(OpenSSLCertificateSigningRequest|string $csr, $output, bool $no_text = ...): bool

The declared return type is shown above. Errors can include false results or exceptions depending on this API: A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.

Example 1: Basic Operation

A CSR contains a requested subject; it does not automatically prove identity.

<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_csr_export($csr, $pem);
echo str_contains($pem, 'CERTIFICATE REQUEST') ? 'CSR in PEM format' : 'check';

Example 2: A Different Use Case

Create a new certificate request for a different subject, then inspect its serialized form.

<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'second.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_csr_export($csr, $pem);
echo str_contains($pem, 'CERTIFICATE REQUEST') ? 'CSR in PEM format' : 'check';

Practical Example: Checking the Result

Create a new certificate request for a different subject, then inspect its serialized form.

<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'third.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_csr_export($csr, $pem);
echo strlen($pem) . ' PEM bytes';

Important Behavior and Edge Cases

A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.

A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• openssl_csr_export serializes a certificate signing request into a PEM-formatted string, usually to send to a certificate issuer.
• A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.
• Use openssl_csr_export to serialize the request and openssl_csr_sign to issue a certificate.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.