(PHP 4 >= 4.2.0, PHP 5, PHP 7, PHP 8)
openssl_csr_new — 生成一個(gè) CSR
$dn,&$privkey,$configargs = ?,$extraattribs = ?
openssl_csr_new() 根據(jù)dn提供的信息生成新的CSR（證書(shū)簽名請(qǐng)求）。
注意: 必須安裝有效的 openssl.cnf 以保證此函數(shù)正確運(yùn)行。參考有關(guān)安裝的說(shuō)明以獲得更多信息。
dn在證書(shū)中使用的專有名稱或主題字段。
privkey
privkey 應(yīng)該被設(shè)置為由openssl_pkey_new()函數(shù)預(yù)先生成(或者以其他方式從openssl_pkey函數(shù)集中獲得)的私鑰。該密鑰的相應(yīng)公共部分將用于簽署CSR.
configargs
默認(rèn)的， 是通過(guò)你系統(tǒng)里的openssl.conf配置來(lái)初始化請(qǐng)求； 您可以通過(guò)設(shè)置configargs的config_section_section項(xiàng)來(lái)指定配置文件部分。
您還可以通過(guò)將config鍵的值設(shè)置為您想要使用的文件路徑來(lái)指定另一個(gè)openssl配置文件。如果在configargs中存在下列鍵，它們的行為就像在openssl.conf中一樣。如下表所示：
configargs 鍵 |
type | 等同于 openssl.conf |
描述 |
|---|---|---|---|
| digest_alg | string | default_md | 摘要算法或簽名哈希算法，通常是 openssl_get_md_methods() 之一。 |
| x509_extensions | string | x509_extensions | 選擇在創(chuàng)建x509證書(shū)時(shí)應(yīng)該使用哪些擴(kuò)展 |
| req_extensions | string | req_extensions | 創(chuàng)建CSR時(shí)，選擇使用哪個(gè)擴(kuò)展 |
| private_key_bits | integer | default_bits | 指定應(yīng)該使用多少位來(lái)生成私鑰 |
| private_key_type | integer | none | 選擇在創(chuàng)建CSR時(shí)應(yīng)該使用哪些擴(kuò)展?？蛇x值有
OPENSSL_KEYTYPE_DSA,
OPENSSL_KEYTYPE_DH,
OPENSSL_KEYTYPE_RSA 或
OPENSSL_KEYTYPE_EC.
默認(rèn)值是 OPENSSL_KEYTYPE_RSA.
|
| encrypt_key | boolean | encrypt_key | 是否應(yīng)該對(duì)導(dǎo)出的密鑰（帶有密碼短語(yǔ)）進(jìn)行加密? |
| encrypt_key_cipher | integer | none | cipher constants常量之一。 |
| curve_name | string | none | 要求PHP7.1+, openssl_get_curve_names()之一。 |
| config | string | N/A | 自定義 openssl.conf 文件的路徑。 |
extraattribs
extraattribs 用于為CSR指定額外的配置選項(xiàng)。dn 和
extraattribs 都是關(guān)聯(lián)數(shù)組它們的鍵被轉(zhuǎn)換成OIDs，并應(yīng)用到請(qǐng)求的相關(guān)部分。
成功，返回CSR 或者在失敗時(shí)返回 false.
示例 #1 創(chuàng)建一個(gè)自簽名的證書(shū)
<?php
// for SSL server certificates the commonName is the domain name to be secured
// for S/MIME email certificates the commonName is the owner of the email address
// location and identification fields refer to the owner of domain or email subject to be secured
$dn = array(
"countryName" => "GB",
"stateOrProvinceName" => "Somerset",
"localityName" => "Glastonbury",
"organizationName" => "The Brain Room Limited",
"organizationalUnitName" => "PHP Documentation Team",
"commonName" => "Wez Furlong",
"emailAddress" => "wez@example.com"
);
// Generate a new private (and public) key pair
$privkey = openssl_pkey_new(array(
"private_key_bits" => 2048,
"private_key_type" => OPENSSL_KEYTYPE_RSA,
));
// Generate a certificate signing request
$csr = openssl_csr_new($dn, $privkey, array('digest_alg' => 'sha256'));
// Generate a self-signed cert, valid for 365 days
$x509 = openssl_csr_sign($csr, null, $privkey, $days=365, array('digest_alg' => 'sha256'));
// Save your private key, CSR and self-signed cert for later use
openssl_csr_export($csr, $csrout) and var_dump($csrout);
openssl_x509_export($x509, $certout) and var_dump($certout);
openssl_pkey_export($privkey, $pkeyout, "mypassword") and var_dump($pkeyout);
// Show any errors that occurred here
while (($e = openssl_error_string()) !== false) {
echo $e . "\n";
}
?>
示例 #2 在PHP 7.1+版本中創(chuàng)建一個(gè)自簽名的ECC證書(shū)
<?php
$subject = array(
"commonName" => "docs.php.net",
);
// Generate a new private (and public) key pair
$private_key = openssl_pkey_new(array(
"private_key_type" => OPENSSL_KEYTYPE_EC,
"curve_name" => 'prime256v1',
));
// Generate a certificate signing request
$csr = openssl_csr_new($subject, $private_key, array('digest_alg' => 'sha384'));
// Generate self-signed EC cert
$x509 = openssl_csr_sign($csr, null, $private_key, $days=365, array('digest_alg' => 'sha384'));
openssl_x509_export_to_file($x509, 'ecc-cert.pem');
openssl_pkey_export_to_file($private_key, 'ecc-private.key');
?>