Reputation: 121

Generate 2048 bit and password protected csr?

I'm trying to generate a CSR via PHP. But the CA keeps denying my CSR since they say its not 2048 bits and not protected with a password. But when I look in the PHP documentation for the function openssl_csr_new() I can't find how to do it?

My current code:

$dn = array(
                   'countryName' => $countryName,
                   'stateOrProvinceName' => $stateOrProvinceName,
                   'localityName' => $localityName,
                   'organizationName' => $organizationName,
                   'commonName' => $commonName,
                   'emailAddress' => $emailAddress
               );

               if(!empty($organizationalUnitName))
               $dn['organizationalUnitName'] = $organizationalUnitName;

               $csrSettings = array('private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA, 'encrypt_key' => true);

               // Generate a new private (and public) key pair
               $privkey = openssl_pkey_new($csrSettings);

               // Generate a certificate signing request
               $csr = openssl_csr_new($dn, $privkey, $csrSettings);
               openssl_csr_export($csr, $csrout);
               openssl_pkey_export($privkey, $pkeyout);

What am I doing wrong?

------ Updated code: -------

$dn = array(
               'countryName' => $countryName,
               'stateOrProvinceName' => $stateOrProvinceName,
               'localityName' => $localityName,
               'organizationName' => $organizationName,
               'commonName' => $commonName,
               'emailAddress' => $emailAddress
           );

           if(!empty($organizationalUnitName))
           $dn['organizationalUnitName'] = $organizationalUnitName;

           $csrSettings = array('private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA, 'encrypt_key' => true);

           // Generate a new private (and public) key pair
           $privkey = openssl_pkey_new($csrSettings);

           // Generate a certificate signing request
           openssl_pkey_export($privkey, $pkeyout, 'test 1235 aaaaa');

           $csr = openssl_csr_new($dn, $pkeyout, $csrSettings);
           openssl_csr_export($csr, $csrout);

Upvotes: 1

Answers (2)

rishadan

Reputation: 11

With phpseclib, a pure PHP CSR implementation,

<?php
include('File/X509.php');
include('Crypt/RSA.php');

$privKey = new Crypt_RSA();
extract($privKey->createKey(2048));
$privKey->loadKey($privatekey);

$x509 = new File_X509();
$x509->setPrivateKey($privKey);
$x509->setDNProp('id-at-organizationName', 'phpseclib demo cert');

$csr = $x509->signCSR();

echo $x509->saveCSR($csr);
?>

You can't password protect CSR's, however. You can password protect the private key but you shouldn't be sharing the private key with the CA anyway.

If the CA insists that you can ask them for an example of how you can do so with OpenSSL via the CLI. Maybe they're just not being very clear about what they mean but having the CLI command will let us know for sure.

Upvotes: 1

Mike

Reputation: 24393

You've got the order all wrong and for some reason you're doing openssl_pkey_new() twice. I would highly suggest that you go through the documentation and actually understand what all of these functions can do because your website's security depends on it. This is what you want:

$dn = array(
    'countryName' => $countryName,
    'stateOrProvinceName' => $stateOrProvinceName,
    'localityName' => $localityName,
    'organizationName' => $organizationName,
    'commonName' => $commonName,
    'emailAddress' => $emailAddress
);

$csrSettings = array('private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA, 'encrypt_key' => true);

// Generate a new private (and public) key pair
$privkey = openssl_pkey_new($csrSettings);

// Generate a certificate signing request
$csr = openssl_csr_new($dn, $privkey, $csrSettings);

openssl_csr_export($csr, $csrout);
openssl_pkey_export($privkey, $pkeyout, "test 1235 aaaaa");

echo $csrout . "\n" . $pkeyout;

Output example:

Upvotes: 0

Generate 2048 bit and password protected csr?

Answers (2)

Output example:

Related Questions