* You can finetune the key generation (such as specifying the number of * bits) using configargs. See * openssl_csr_new for more information about * configargs. *

* The key is optionally protected by passphrase. *

* configargs can be used to fine-tune the export * process by specifying and/or overriding options for the openssl * configuration file. See openssl_csr_new for more * information about configargs. *

* Path to the output file. *

* The key can be optionally protected by a * passphrase. *

* configargs can be used to fine-tune the export * process by specifying and/or overriding options for the openssl * configuration file. See openssl_csr_new for more * information about configargs. *

* key can be one of the following: *

*
1. a string having the format * file://path/to/file.pem. The named file must * contain a PEM encoded certificate/private key (it may contain both). *
*
2. A PEM formatted private key.
*

* The optional parameter passphrase must be used * if the specified key is encrypted (protected by a passphrase). *

certificate can be one of the following: *

*
1. an X.509 certificate resource
*
2. a string having the format * file://path/to/file.pem. The named file must * contain a PEM encoded certificate/public key (it may contain both). *
*
3. A PEM formatted public key.
*

* Resource holding the key. *

* Depending on the key type used, additional details may be returned. Note that * some elements may not always be available. */ #[ArrayShape(["bits" => "int", "key" => "string", "rsa" => "array", "dsa" => "array", "dh" => "array", "type" => "int"])] function openssl_pkey_get_details(#[LanguageLevelTypeAware(["8.0" => "OpenSSLAsymmetricKey"], default: "resource")] $key): array|false {} /** * Free key resource * @link https://php.net/manual/en/function.openssl-free-key.php * @param OpenSSLAsymmetricKey|resource $key * @return void */ #[Deprecated(since: '8.0')] function openssl_free_key(#[LanguageLevelTypeAware(["8.0" => "OpenSSLAsymmetricKey"], default: "resource")] $key): void {} /** * Alias of openssl_pkey_get_private * @link https://php.net/manual/en/function.openssl-get-privatekey.php * @param OpenSSLAsymmetricKey|OpenSSLCertificate|array|string $private_key *

* key can be one of the following: *

*
1. a string having the format * file://path/to/file.pem. The named file must * contain a PEM encoded certificate/private key (it may contain both). *
*
2. A PEM formatted private key.
*

* The optional parameter passphrase must be used * if the specified key is encrypted (protected by a passphrase). *

* certificate can be one of the following: *

*
1. an X.509 certificate resource
*
2. a string having the format * file://path/to/file.pem. The named file must * contain a PEM encoded certificate/public key (it may contain both). *
*
3. A PEM formatted public key.
*

* privkey should be set to a private key that was * previously generated by {@link https://php.net/en/manual/function.openssl-pkey-new.php openssl_pkey_new()} (or * otherwise obtained from the other openssl_pkey family of functions). * The corresponding public portion of the key will be used to sign the * CSR. *

The challenge associated to associate with the SPKAC

The digest algorithm. See openssl_get_md_method().

Expects a valid signed public key and challenge

Expects a valid signed public key and challenge

Expects a valid signed public key and challenge

* shortnames controls how the data is indexed in the * array - if shortnames is true (the default) then * fields will be indexed with the short name form, otherwise, the long name * form will be used - e.g.: CN is the shortname form of commonName. *

* The examined certificate. *

* * openssl_x509_checkpurpose purposes * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Constant	Description
X509_PURPOSE_SSL_CLIENT	Can the certificate be used for the client side of an SSL * connection?
X509_PURPOSE_SSL_SERVER	Can the certificate be used for the server side of an SSL * connection?
X509_PURPOSE_NS_SSL_SERVER	Can the cert be used for Netscape SSL server?
X509_PURPOSE_SMIME_SIGN	Can the cert be used to sign S/MIME email?
X509_PURPOSE_SMIME_ENCRYPT	Can the cert be used to encrypt S/MIME email?
X509_PURPOSE_CRL_SIGN	Can the cert be used to sign a certificate revocation list * (CRL)?
X509_PURPOSE_ANY	Can the cert be used for Any/All purposes?

* These options are not bitfields - you may specify one only! *

* cainfo should be an array of trusted CA files/dirs * as described in Certificate * Verification. *

* If specified, this should be the name of a PEM encoded file holding * certificates that can be used to help verify the certificate, although * no trust is placed in the certificates that come from that file. *

* The certificate. *

* The private key. *

* On success, this will hold the PEM. *

* Path to the output file. *

* On success, this will hold the PKCS#12. *

* Private key component of PKCS#12 file. *

* Encryption password for unlocking the PKCS#12 file. *

* Path to the output file. *

* Private key component of PKCS#12 file. *

* Encryption password for unlocking the PKCS#12 file. *

* On success, this will hold the Certificate Store Data. *

* Encryption password for unlocking the PKCS#12 file. *

* The Distinguished Name to be used in the certificate. *

* privkey should be set to a private key that was * previously generated by openssl_pkey_new (or * otherwise obtained from the other openssl_pkey family of functions). * The corresponding public portion of the key will be used to sign the * CSR. *

* By default, the information in your system openssl.conf * is used to initialize the request; you can specify a configuration file * section by setting the config_section_section key of * configargs. You can also specify an alternative * openssl configuration file by setting the value of the * config key to the path of the file you want to use. * The following keys, if present in configargs * behave as their equivalents in the openssl.conf, as * listed in the table below. * * Configuration overrides * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

configargs key	type	openssl.conf equivalent	description
digest_alg	string	default_md	Selects which digest method to use
x509_extensions	string	x509_extensions	Selects which extensions should be used when creating an x509 * certificate
req_extensions	string	req_extensions	Selects which extensions should be used when creating a CSR
private_key_bits	integer	default_bits	Specifies how many bits should be used to generate a private * key
private_key_type	integer	none	Specifies the type of private key to create. This can be one * of OPENSSL_KEYTYPE_DSA, * OPENSSL_KEYTYPE_DH or * OPENSSL_KEYTYPE_RSA. * The default value is OPENSSL_KEYTYPE_RSA which * is currently the only supported key type. *
encrypt_key	boolean	encrypt_key	Should an exported key (with passphrase) be encrypted?
encrypt_key_cipher	integer	none	* One of cipher constants. *

*

* extraattribs is used to specify additional * configuration options for the CSR. Both dn and * extraattribs are associative arrays whose keys are * converted to OIDs and applied to the relevant part of the request. *

* Path to the output file. *

* A CSR previously generated by openssl_csr_new. * It can also be the path to a PEM encoded CSR when specified as * file://path/to/csr or an exported string generated * by openssl_csr_export. *

* The generated certificate will be signed by cacert. * If cacert is null, the generated certificate * will be a self-signed certificate. *

* priv_key is the private key that corresponds to * cacert. *

* days specifies the length of time for which the * generated certificate will be valid, in days. *

* You can finetune the CSR signing by configargs. * See openssl_csr_new for more information about * configargs. *

* An optional the serial number of issued certificate. If not specified * it will default to 0. *

* The data. *

* The digest method. *

* Setting to true will return as raw output data, otherwise the return * value is binhex encoded. *

* The data. *

* The cipher method. For a list of available cipher methods, use {@see openssl_get_cipher_methods()}. *

* The key. *

* options is a bitwise disjunction of the flags OPENSSL_RAW_DATA and OPENSSL_ZERO_PADDING. *

* A non-NULL Initialization Vector. *

The authentication tag passed by reference when using AEAD cipher mode (GCM or CCM).

Additional authentication data.

* The length of the authentication tag. Its value can be between 4 and 16 for GCM mode. *

* The data. *

* The cipher method. *

* The password. *

* Setting to true will take a raw encoded string, * otherwise a base64 string is assumed for the * data parameter. *

* A non-NULL Initialization Vector. *

* The authentication tag in AEAD cipher mode. If it is incorrect, the authentication fails and the function returns FALSE. *

Additional authentication data.

* The method. *

* If the call was successful the signature is returned in * signature. *

* For more information see the list of Signature Algorithms. *

* For more information see the list of Signature Algorithms. *

* If the call is successful the opened data is returned in this * parameter. *

* Path to the message. *

* flags can be used to affect how the signature is * verified - see PKCS7 constants * for more information. *

* If the outfilename is specified, it should be a * string holding the name of a file into which the certificates of the * persons that signed the messages will be stored in PEM format. *

* If the cainfo is specified, it should hold * information about the trusted CA certificates to use in the verification * process - see certificate * verification for more information about this parameter. *

* If the extracerts is specified, it is the filename * of a file containing a bunch of certificates to use as untrusted CAs. *

* You can specify a filename with content that will * be filled with the verified data, but with the signature information * stripped. * @param string|null $output_filename [optional] *

* The decrypted message is written to the file specified by * outfilename. *

* headers is an array of headers that * will be prepended to the data after it has been signed (see * openssl_pkcs7_encrypt for more information about * the format of this parameter). *

* flags can be used to alter the output - see PKCS7 constants. *

* extracerts specifies the name of a file containing * a bunch of extra certificates to include in the signature which can for * example be used to help the recipient to verify the certificate that you used. *

* Either a lone X.509 certificate, or an array of X.509 certificates. *

* headers is an array of headers that * will be prepended to the data after it has been encrypted. *

* headers can be either an associative array * keyed by header name, or an indexed array, where each element contains * a single header line. *

* flags can be used to specify options that affect * the encoding process - see PKCS7 * constants. *

* One of cipher constants. *

* padding can be one of * OPENSSL_PKCS1_PADDING, * OPENSSL_NO_PADDING. *

* key must be the private key corresponding that * was used to encrypt the data. *

* padding can be one of * OPENSSL_PKCS1_PADDING, * OPENSSL_SSLV23_PADDING, * OPENSSL_PKCS1_OAEP_PADDING, * OPENSSL_NO_PADDING. *

* This will hold the result of the encryption. *

* The public key. *

* padding can be one of * OPENSSL_PKCS1_PADDING, * OPENSSL_SSLV23_PADDING, * OPENSSL_PKCS1_OAEP_PADDING, * OPENSSL_NO_PADDING. *

* key must be the public key corresponding that * was used to encrypt the data. *

* padding can be one of * OPENSSL_PKCS1_PADDING, * OPENSSL_NO_PADDING. *

* Set to true if digest aliases should be included within the * returned array. *

* Set to true if cipher aliases should be included within the * returned array. *

* Public key *

* DH key *

It also indicates if a cryptographically strong algorithm was used to produce the pseudo-random bytes, * and does this via the optional crypto_strong parameter. It's rare for this to be FALSE, but some systems may be broken or old.

* The length of the desired string of bytes. Must be a positive integer. PHP will * try to cast this parameter to a non-null integer to use it. *

* If passed into the function, this will hold a boolean value that determines * if the algorithm used was "cryptographically strong", e.g., safe for usage with GPG, * passwords, etc. true if it did, otherwise false *