I'm generating a Public/Private key pair in PHP with the following:

$config = array(
    "digest_alg" => "sha512",
    "private_key_bits" => 4096,
    "private_key_type" => OPENSSL_KEYTYPE_RSA,

// Create the private and public key
$res = openssl_pkey_new($config);

// Extract the private key from $res to $privKey
openssl_pkey_export($res, $privKey);

// Extract the public key from $res to $pubKey
$pubKey = openssl_pkey_get_details($res);

But I'm doubting about what to choose for the digest_alg variable. What is the 'best' to use here? Where can I choose from? And last but not least, what does it do?

1 Answer 1


digest_alg is not used by openssl_pkey_new() but by openssl_csr_new(): the latter creates a public/private key pair and wraps the public key into a certificate request, which is self-signed (with the newly generated private key). That signature involves using a hash function, hence the parameter.

openssl_pkey_new() entails no signature and thus has no need for a "hash function" parameter.

For openssl_csr_new(), your sensible choices are between SHA-256 (robust, recommended, efficient) and SHA-1 (theoretically less robust, no longer recommended, a bit faster, and, more importantly, supported everywhere). IE 8.0 on Windows XP (with all updates) supports SHA-256 for certificates (I have tried it yesterday), so I incline to assert that SHA-256 is now sufficiently well supported that it can be recommended "by default".

  • 1
    Thank you for the clear explanation; the php-documentation is not very clear about this. Which of the config_vars can I use to create the best/robust private/public key-pair with openssl_pkey_new()
    – stUrb
    Jan 17, 2014 at 20:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .