# openssl_csr_new

(PHP 4 >= 4.2.0, PHP 5, PHP 7)

openssl_csr_new — Generates a CSR

### Description

openssl_csr_new ( array `$dn` , resource `&$privkey` [, array `$configargs` [, array `$extraattribs` ]] ) : mixed

openssl_csr_new() generates a new CSR (Certificate Signing Request) based on the information provided by `dn`.

> Note: You need to have a valid openssl.cnf installed for this function to operate correctly. See the notes under the installation section for more information.

### Parameters

`dn`

  The Distinguished Name or subject fields to be used in the certificate.

`privkey`

  `privkey` should be set to a private key that was previously generated by openssl_pkey_new() (or otherwise obtained from the other openssl_pkey family of functions). The corresponding public portion of the key will be used to sign the CSR.

`configargs`

  By default, the information in your system `openssl.conf` is used to initialize the request; you can specify a configuration file section by setting the `config_section_section` key of `configargs`. You can also specify an alternative openssl configuration file by setting the value of the `config` key to the path of the file you want to use. The following keys, if present in `configargs` behave as their equivalents in the `openssl.conf`, as listed in the table below.

  Configuration overrides
  `configargs` key | type | `openssl.conf` equivalent | description
  --- | --- | --- | ---
  digest_alg | string | default_md | Digest method or signature hash, usually one of openssl_get_md_methods()
  x509_extensions | string | x509_extensions | Selects which extensions should be used when creating an x509 certificate
  req_extensions | string | req_extensions | Selects which extensions should be used when creating a CSR
  private_key_bits | int | default_bits | Specifies how many bits should be used to generate a private key
  private_key_type | int | none | Specifies the type of private key to create. This can be one of `OPENSSL_KEYTYPE_DSA`, `OPENSSL_KEYTYPE_DH`, `OPENSSL_KEYTYPE_RSA` or `OPENSSL_KEYTYPE_EC`. The default value is `OPENSSL_KEYTYPE_RSA`.
  encrypt_key | bool | encrypt_key | Should an exported key (with passphrase) be encrypted?
  encrypt_key_cipher | int | none | One of cipher constants.
  curve_name | string | none | One of openssl_get_curve_names().
  config | string | N/A | Path to your own alternative openssl.conf file.

`extraattribs`

  `extraattribs` is used to specify additional configuration options for the CSR. Both `dn` and `extraattribs` are associative arrays whose keys are converted to OIDs and applied to the relevant part of the request.

### Return Values

Returns the CSR or `FALSE` on failure.

### Changelog

Version | Description
--- | ---
7.1.0 | `configargs` now also supports `curve_name`.

### Examples

Example #1 Creating a self-signed certificate

`<?php
// for SSL server certificates the commonName is the domain name to be secured
// for S/MIME email certificates the commonName is the owner of the email address
// location and identification fields refer to the owner of domain or email subject to be secured
$dn = array(
"countryName" => "GB",
"stateOrProvinceName" => "Somerset",
"localityName" => "Glastonbury",
"organizationName" => "The Brain Room Limited",
"organizationalUnitName" => "PHP Documentation Team",
"commonName" => "Wez Furlong",
"emailAddress" => "wez@example.com"
);
// Generate a new private (and public) key pair
$privkey = openssl_pkey_new(array(
"private_key_bits" => 2048,
"private_key_type" => OPENSSL_KEYTYPE_RSA,
));
// Generate a certificate signing request
$csr = openssl_csr_new($dn, $privkey, array('digest_alg' => 'sha256'));
// Generate a self-signed cert, valid for 365 days
$x509 = openssl_csr_sign($csr, null, $privkey, $days=365, array('digest_alg' => 'sha256'));
// Save your private key, CSR and self-signed cert for later use
openssl_csr_export($csr, $csrout) and var_dump($csrout);
openssl_x509_export($x509, $certout) and var_dump($certout);
openssl_pkey_export($privkey, $pkeyout, "mypassword") and var_dump($pkeyout);
// Show any errors that occurred here
while (($e = openssl_error_string()) !== false) {
echo $e . "\n";
}
?>`

Example #2 Creating a self-signed ECC certificate (as of PHP 7.1.0)

`<?php
$subject = array(
"commonName" => "docs.php.net",
);
// Generate a new private (and public) key pair
$private_key = openssl_pkey_new(array(
"private_key_type" => OPENSSL_KEYTYPE_EC,
"curve_name" => 'prime256v1',
));
// Generate a certificate signing request
$csr = openssl_csr_new($subject, $private_key, array('digest_alg' => 'sha384'));
// Generate self-signed EC cert
$x509 = openssl_csr_sign($csr, null, $private_key, $days=365, array('digest_alg' => 'sha384'));
openssl_x509_export_to_file($x509, 'ecc-cert.pem');
openssl_pkey_export_to_file($private_key, 'ecc-private.key');
?>`

### See Also

- openssl_csr_sign() - Sign a CSR with another certificate (or itself) and generate a certificate