PHP openssl_pkcs12_export() Function: Usage and Examples

openssl_pkcs12_export packages an X.509 certificate and corresponding private key into an optionally password-protected PKCS#12 binary bundle.

The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.

What It Does

The operation is intended for: openssl_pkcs12_export packages an X.509 certificate and corresponding private key into an optionally password-protected PKCS#12 binary bundle.

The OpenSSL extension must be enabled.

Syntax and Return Value

openssl_pkcs12_export(OpenSSLCertificate|string $certificate, $output, $private_key, string $passphrase, array $options = ...): bool

Parameter	Purpose
$certificate (OpenSSLCertificate\|string)	The recipient or signing certificate, issued or trusted for the intended use.
$output (mixed)	Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling.
$private_key (mixed)	The corresponding private key; never expose or log its PEM data.
$passphrase (string)	Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling.
$options (array)	Driver or algorithm-specific options; avoid unchecked user-controlled settings.

The declared return type is shown above. Errors can include false results or exceptions depending on this API: PKCS#12 contains sensitive private keys: protect the export password, output path and file permissions.

Example 1: Basic Operation

Protect PKCS#12 bundles: they may contain the private key even when the file is password-protected.

<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_pkcs12_export($cert, $pfx, $private, 'example-passphrase');
echo strlen($pfx) . ' bytes';

Example 2: A Different Use Case

Test export and readback with a fresh bundle passphrase; do not reuse these illustrative secrets.

<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_pkcs12_export($cert, $pfx, $private, 'second-test-passphrase');
echo strlen($pfx) . ' bytes';

Practical Example: Checking the Result

Test export and readback with a fresh bundle passphrase; do not reuse these illustrative secrets.

<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_pkcs12_export($cert, $pfx, $private, 'third-test-passphrase');
var_dump(is_string($pfx) && strlen($pfx) > 0);

Important Behavior and Edge Cases

PKCS#12 contains sensitive private keys: protect the export password, output path and file permissions.

Comparison with Related Functions

Approach	Key distinction
openssl_pkcs12_export	openssl_pkcs12_export packages an X.509 certificate and corresponding private key into an optionally password-protected PKCS#12 binary bundle.
Related technique	PEM certificates and private keys can be handled separately with openssl_x509_export and openssl_pkey_export.

Common Beginner Mistakes

Mistake	Correct approach
Confusing this operation with a neighboring cryptographic or security mechanism	PEM certificates and private keys can be handled separately with openssl_x509_export and openssl_pkey_export.
Ignoring a security prerequisite or failure case	PKCS#12 contains sensitive private keys: protect the export password, output path and file permissions.

Key Takeaways

openssl_pkcs12_export packages an X.509 certificate and corresponding private key into an optionally password-protected PKCS#12 binary bundle.
PKCS#12 contains sensitive private keys: protect the export password, output path and file permissions.
PEM certificates and private keys can be handled separately with openssl_x509_export and openssl_pkey_export.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.