PHP openssl_csr_new() Function: Usage and Examples

openssl_csr_new creates a certificate signing request from a distinguished-name field map and the associated private key.

The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.

What It Does

The operation is intended for: openssl_csr_new creates a certificate signing request from a distinguished-name field map and the associated private key.

The OpenSSL extension must be enabled.

Syntax and Return Value

openssl_csr_new(array $distinguished_names, $private_key, ?array $options = ..., ?array $extra_attributes = ...): OpenSSLCertificateSigningRequest|bool

The declared return type is shown above. Errors can include false results or exceptions depending on this API: A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.

Example 1: Basic Operation

A CSR contains a requested subject; it does not automatically prove identity.

<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
var_dump($csr instanceof OpenSSLCertificateSigningRequest);

Example 2: A Different Use Case

Create a new certificate request for a different subject, then inspect its serialized form.

<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'second.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
var_dump($csr instanceof OpenSSLCertificateSigningRequest);

Practical Example: Checking the Result

Create a new certificate request for a different subject, then inspect its serialized form.

<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'third.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
var_dump($csr instanceof OpenSSLCertificateSigningRequest);

Important Behavior and Edge Cases

A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.

A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• openssl_csr_new creates a certificate signing request from a distinguished-name field map and the associated private key.
• A CSR is not a certificate; signing must use the correct issuer key, subject identity and certificate-validity policy.
• Use openssl_csr_export to serialize the request and openssl_csr_sign to issue a certificate.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.