I'm generating a Public/Private key pair in PHP with the following:

$config = array(
    "digest_alg" => "sha512",
    "private_key_bits" => 4096,
    "private_key_type" => OPENSSL_KEYTYPE_RSA,

// Create the private and public key
$res = openssl_pkey_new($config);

// Extract the private key from $res to $privKey
openssl_pkey_export($res, $privKey);

// Extract the public key from $res to $pubKey
$pubKey = openssl_pkey_get_details($res);

But I'm doubting about what to choose for the digest_alg variable. What is the 'best' to use here? Where can I choose from? And last but not least, what does it do?


digest_alg is not used by openssl_pkey_new() but by openssl_csr_new(): the latter creates a public/private key pair and wraps the public key into a certificate request, which is self-signed (with the newly generated private key). That signature involves using a hash function, hence the parameter.

openssl_pkey_new() entails no signature and thus has no need for a "hash function" parameter.

For openssl_csr_new(), your sensible choices are between SHA-256 (robust, recommended, efficient) and SHA-1 (theoretically less robust, no longer recommended, a bit faster, and, more importantly, supported everywhere). IE 8.0 on Windows XP (with all updates) supports SHA-256 for certificates (I have tried it yesterday), so I incline to assert that SHA-256 is now sufficiently well supported that it can be recommended "by default".

  • 1
    Thank you for the clear explanation; the php-documentation is not very clear about this. Which of the config_vars can I use to create the best/robust private/public key-pair with openssl_pkey_new() – stUrb Jan 17 '14 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.