openssl_sign signs data with a private key, producing a digital signature checked using openssl_verify.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: openssl_sign signs data with a private key, producing a digital signature checked using openssl_verify.
The OpenSSL extension must be enabled.
Syntax and Return Value
openssl_sign(string $data, $signature, $private_key, string|int $algorithm = ...): bool| Parameter | Purpose |
|---|---|
| $data (string) | The input data bytes. Use the exact original bytes when verifying. |
| $signature (mixed) | A signature or MAC produced by the matching signing/authentication function. |
| $private_key (mixed) | The corresponding private key; never expose or log its PEM data. |
| $algorithm (string|int) | A supported hash, encryption, signing or password-hash algorithm identifier. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Verification results are 1 for valid, 0 for invalid and -1 or false for errors. Never confuse verification with decrypting the message.
Example 1: Basic Operation
The public key must be authenticated separately; a signature is not encryption.
<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_sign("annual report", $signature, $private, OPENSSL_ALGO_SHA256);
echo strlen($signature);Example 2: A Different Use Case
The public key must be authenticated separately; a signature is not encryption.
<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_sign("invoice 42", $signature, $private, OPENSSL_ALGO_SHA256);
echo strlen($signature);Practical Example: Checking the Result
The public key must be authenticated separately; a signature is not encryption.
<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_sign("signed event", $signature, $private, OPENSSL_ALGO_SHA256);
echo strlen($signature);Important Behavior and Edge Cases
Verification results are 1 for valid, 0 for invalid and -1 or false for errors. Never confuse verification with decrypting the message.
Verification results are 1 for valid, 0 for invalid and -1 or false for errors. Never confuse verification with decrypting the message.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| openssl_sign | openssl_sign signs data with a private key, producing a digital signature checked using openssl_verify. |
| Related technique | Use a private key to sign and the matching public key to verify. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | Use a private key to sign and the matching public key to verify. |
| Ignoring a security prerequisite or failure case | Verification results are 1 for valid, 0 for invalid and -1 or false for errors. Never confuse verification with decrypting the message. |
Key Takeaways
- openssl_sign signs data with a private key, producing a digital signature checked using openssl_verify.
- Verification results are 1 for valid, 0 for invalid and -1 or false for errors. Never confuse verification with decrypting the message.
- Use a private key to sign and the matching public key to verify.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.