PHP openssl_spki_new() Function: Usage and Examples

openssl_spki_new creates a legacy SPKAC structure containing a signed public key and challenge.

The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.

What It Does

The operation is intended for: openssl_spki_new creates a legacy SPKAC structure containing a signed public key and challenge.

The OpenSSL extension must be enabled.

Syntax and Return Value

openssl_spki_new(OpenSSLAsymmetricKey $private_key, string $challenge, int $digest_algo = ...): string|false

Parameter	Purpose
$private_key (OpenSSLAsymmetricKey)	The corresponding private key; never expose or log its PEM data.
$challenge (string)	Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling.
$digest_algo (int)	Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling.

The declared return type is shown above. Errors can include false results or exceptions depending on this API: SPKAC is a legacy format. An SPKAC signature does not independently establish trust in the key owner.

Example 1: Basic Operation

SPKAC is legacy. Its signature is not proof of real-world identity without additional trust checks.

<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$spkac = substr(openssl_spki_new($private, "sample-challenge", OPENSSL_ALGO_SHA256), 6);
var_dump(is_string($spkac));

Example 2: A Different Use Case

SPKAC signatures cover the public-key challenge; changing the challenge means creating a new signed object.

<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$spkac = substr(openssl_spki_new($private, "new-test-challenge", OPENSSL_ALGO_SHA256), 6);
var_dump(is_string($spkac));

Practical Example: Checking the Result

SPKAC signatures cover the public-key challenge; changing the challenge means creating a new signed object.

<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$spkac = substr(openssl_spki_new($private, "third-test-challenge", OPENSSL_ALGO_SHA256), 6);
var_dump(openssl_spki_verify($spkac));

Important Behavior and Edge Cases

SPKAC is a legacy format. An SPKAC signature does not independently establish trust in the key owner.

Comparison with Related Functions

Approach	Key distinction
openssl_spki_new	openssl_spki_new creates a legacy SPKAC structure containing a signed public key and challenge.
Related technique	Modern key registration generally uses purpose-built protocols rather than SPKAC.

Common Beginner Mistakes

Mistake	Correct approach
Confusing this operation with a neighboring cryptographic or security mechanism	Modern key registration generally uses purpose-built protocols rather than SPKAC.
Ignoring a security prerequisite or failure case	SPKAC is a legacy format. An SPKAC signature does not independently establish trust in the key owner.

Key Takeaways

openssl_spki_new creates a legacy SPKAC structure containing a signed public key and challenge.
SPKAC is a legacy format. An SPKAC signature does not independently establish trust in the key owner.
Modern key registration generally uses purpose-built protocols rather than SPKAC.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.