PHP openssl_pkcs7_sign() Function: Usage and Examples

openssl_pkcs7_sign generates a signed PKCS#7/S/MIME message from input data and a signing certificate.

The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.

What It Does

The operation is intended for: openssl_pkcs7_sign generates a signed PKCS#7/S/MIME message from input data and a signing certificate.

The OpenSSL extension must be enabled.

Syntax and Return Value

openssl_pkcs7_sign(string $input_filename, string $output_filename, OpenSSLCertificate|string $certificate, $private_key, ?array $headers, int $flags = ..., ?string $untrusted_certificates_filename = ...): bool

The declared return type is shown above. Errors can include false results or exceptions depending on this API: The result may be in S/MIME form. A cryptographic signature check alone is not a complete certificate trust decision.

Example 1: Basic Operation

The local certificate is self-signed for demonstration; signature acceptance here does not verify a trusted CA chain.

<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$input = tempnam(sys_get_temp_dir(), 'cms_input_');
$output = tempnam(sys_get_temp_dir(), 'cms_output_');
$decoded = tempnam(sys_get_temp_dir(), 'cms_plain_');
$certPath = tempnam(sys_get_temp_dir(), 'cms_cert_');
$keyPath = tempnam(sys_get_temp_dir(), 'cms_key_');
file_put_contents($input, 'Private message for recipient');
openssl_x509_export($cert, $certPem);
openssl_pkey_export($private, $keyPem);
file_put_contents($certPath, $certPem);
file_put_contents($keyPath, $keyPem);
var_dump(openssl_pkcs7_sign($input, $output, $cert, $private, []));
foreach ([$input,$output,$decoded,$certPath,$keyPath] as $file) { @unlink($file); }

Example 2: A Different Use Case

Exercise the container operation with a different document, including binary document bytes.

<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$input = tempnam(sys_get_temp_dir(), 'cms_input_');
$output = tempnam(sys_get_temp_dir(), 'cms_output_');
$decoded = tempnam(sys_get_temp_dir(), 'cms_plain_');
$certPath = tempnam(sys_get_temp_dir(), 'cms_cert_');
$keyPath = tempnam(sys_get_temp_dir(), 'cms_key_');
file_put_contents($input, 'A second authenticated document');
openssl_x509_export($cert, $certPem);
openssl_pkey_export($private, $keyPem);
file_put_contents($certPath, $certPem);
file_put_contents($keyPath, $keyPem);
var_dump(openssl_pkcs7_sign($input, $output, $cert, $private, []));
foreach ([$input,$output,$decoded,$certPath,$keyPath] as $file) { @unlink($file); }

Practical Example: Checking the Result

Exercise the container operation with a different document, including binary document bytes.

<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$input = tempnam(sys_get_temp_dir(), 'cms_input_');
$output = tempnam(sys_get_temp_dir(), 'cms_output_');
$decoded = tempnam(sys_get_temp_dir(), 'cms_plain_');
$certPath = tempnam(sys_get_temp_dir(), 'cms_cert_');
$keyPath = tempnam(sys_get_temp_dir(), 'cms_key_');
file_put_contents($input, random_bytes(48));
openssl_x509_export($cert, $certPem);
openssl_pkey_export($private, $keyPem);
file_put_contents($certPath, $certPem);
file_put_contents($keyPath, $keyPem);
var_dump(openssl_pkcs7_sign($input, $output, $cert, $private, []));
foreach ([$input,$output,$decoded,$certPath,$keyPath] as $file) { @unlink($file); }

Important Behavior and Edge Cases

The result may be in S/MIME form. A cryptographic signature check alone is not a complete certificate trust decision.

These file-based APIs write encoded containers. The self-signed test certificate used in examples is not production trust material.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• openssl_pkcs7_sign generates a signed PKCS#7/S/MIME message from input data and a signing certificate.
• The result may be in S/MIME form. A cryptographic signature check alone is not a complete certificate trust decision.
• The openssl_cms_* APIs provide a newer related container interface.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.