php - 生成 2048 位和密码保护的 csr？

Question

我正在尝试通过 PHP 生成 CSR。但是 CA 一直拒绝我的 CSR，因为他们说它不是 2048 位并且没有密码保护。但是，当我查看函数 openssl_csr_new() 的 PHP 文档时，我找不到该怎么做？

我当前的代码:

$dn = array(
                   'countryName' => $countryName,
                   'stateOrProvinceName' => $stateOrProvinceName,
                   'localityName' => $localityName,
                   'organizationName' => $organizationName,
                   'commonName' => $commonName,
                   'emailAddress' => $emailAddress
               );

               if(!empty($organizationalUnitName))
               $dn['organizationalUnitName'] = $organizationalUnitName;

               $csrSettings = array('private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA, 'encrypt_key' => true);

               // Generate a new private (and public) key pair
               $privkey = openssl_pkey_new($csrSettings);

               // Generate a certificate signing request
               $csr = openssl_csr_new($dn, $privkey, $csrSettings);
               openssl_csr_export($csr, $csrout);
               openssl_pkey_export($privkey, $pkeyout);

我做错了什么？

------ 更新代码:--------

$dn = array(
               'countryName' => $countryName,
               'stateOrProvinceName' => $stateOrProvinceName,
               'localityName' => $localityName,
               'organizationName' => $organizationName,
               'commonName' => $commonName,
               'emailAddress' => $emailAddress
           );

           if(!empty($organizationalUnitName))
           $dn['organizationalUnitName'] = $organizationalUnitName;

           $csrSettings = array('private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA, 'encrypt_key' => true);

           // Generate a new private (and public) key pair
           $privkey = openssl_pkey_new($csrSettings);

           // Generate a certificate signing request
           openssl_pkey_export($privkey, $pkeyout, 'test 1235 aaaaa');

           $csr = openssl_csr_new($dn, $pkeyout, $csrSettings);
           openssl_csr_export($csr, $csrout);

Answer 1

与 phpseclib, a pure PHP CSR implementation ,

<?php
include('File/X509.php');
include('Crypt/RSA.php');

$privKey = new Crypt_RSA();
extract($privKey->createKey(2048));
$privKey->loadKey($privatekey);

$x509 = new File_X509();
$x509->setPrivateKey($privKey);
$x509->setDNProp('id-at-organizationName', 'phpseclib demo cert');

$csr = $x509->signCSR();

echo $x509->saveCSR($csr);
?>

但是，您不能用密码保护 CSR。您可以用密码保护私钥，但无论如何您都不应该与 CA 共享私钥。

如果 CA 坚持要求您可以向他们询问如何通过 CLI 使用 OpenSSL 的示例。也许他们只是不太清楚他们的意思，但使用 CLI 命令可以让我们确定。