/**
  * @return string
  */
 public function __toString()
 {
     $this->generate();
     $output = '';
     openssl_csr_export($this->request, $output);
     return $output;
 }

    /**
     * {@inheritdoc}
     */
    public function generate(KeyPair $keyPair, array $domains)
    {
        if (!($privateKey = openssl_pkey_get_private($keyPair->getPrivate()))) {
            // TODO: Improve error message
            throw new AcmeException("Couldn't use private key.");
        }
        $san = implode(",", array_map(function ($dns) {
            return "DNS:{$dns}";
        }, $domains));
        // http://www.heise.de/netze/rfc/rfcs/rfc7633.shtml
        // http://www.heise.de/netze/rfc/rfcs/rfc6066.shtml
        $mustStaple = $this->mustStaple ? "tlsfeature = status_request" : "";
        $tempFile = tempnam(sys_get_temp_dir(), "acme-openssl-config-");
        $tempConf = <<<EOL
[ req ]
distinguished_name = req_distinguished_name
req_extensions = v3_req
{$mustStaple}

[ req_distinguished_name ]

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation
subjectAltName = {$san}
EOL;
        (yield \Amp\File\put($tempFile, $tempConf));
        $csr = openssl_csr_new(["CN" => reset($domains)], $privateKey, ["digest_alg" => "sha256", "config" => $tempFile]);
        (yield \Amp\File\unlink($tempFile));
        if (!$csr) {
            // TODO: Improve error message
            throw new AcmeException("CSR could not be generated.");
        }
        (yield new CoroutineResult(openssl_csr_export($csr, $csr)));
    }

 /**
  * Creates a new public/private key pair using PHP OpenSSL extension.
  *
  * @return \TYPO3\CMS\Rsaauth\Keypair A new key pair or NULL in case of error
  * @see tx_rsaauth_abstract_backend::createNewKeyPair()
  */
 public function createNewKeyPair()
 {
     $result = NULL;
     $privateKey = @openssl_pkey_new();
     if ($privateKey) {
         // Create private key as string
         $privateKeyStr = '';
         openssl_pkey_export($privateKey, $privateKeyStr);
         // Prepare public key information
         $exportedData = '';
         $csr = openssl_csr_new(array(), $privateKey);
         openssl_csr_export($csr, $exportedData, FALSE);
         // Get public key (in fact modulus) and exponent
         $publicKey = $this->extractPublicKeyModulus($exportedData);
         $exponent = $this->extractExponent($exportedData);
         // Create result object
         $result = \TYPO3\CMS\Core\Utility\GeneralUtility::makeInstance('TYPO3\\CMS\\Rsaauth\\Keypair');
         /** @var $result \TYPO3\CMS\Rsaauth\Keypair */
         $result->setExponent($exponent);
         $result->setPrivateKey($privateKeyStr);
         $result->setPublicKey($publicKey);
         // Clean up all resources
         openssl_free_key($privateKey);
     }
     return $result;
 }

 /**
  * Creates a new key pair for the encryption or gets the existing key pair (if one already has been generated).
  *
  * There should only be one key pair per request because the second private key would overwrites the first private
  * key. So the submitting the form with the first public key would not work anymore.
  *
  * @return \TYPO3\CMS\Rsaauth\Keypair|NULL a key pair or NULL in case of error
  */
 public function createNewKeyPair()
 {
     /** @var $keyPair \TYPO3\CMS\Rsaauth\Keypair */
     $keyPair = \TYPO3\CMS\Core\Utility\GeneralUtility::makeInstance('TYPO3\\CMS\\Rsaauth\\Keypair');
     if ($keyPair->isReady()) {
         return $keyPair;
     }
     $privateKey = @openssl_pkey_new();
     if ($privateKey !== FALSE) {
         // Create private key as string
         $privateKeyStr = '';
         openssl_pkey_export($privateKey, $privateKeyStr);
         // Prepare public key information
         $exportedData = '';
         $csr = openssl_csr_new(array('localityName' => 'foo', 'organizationName' => 'bar'), $privateKey);
         openssl_csr_export($csr, $exportedData, FALSE);
         // Get public key (in fact modulus) and exponent
         $publicKey = $this->extractPublicKeyModulus($exportedData);
         $exponent = $this->extractExponent($exportedData);
         $keyPair->setExponent($exponent);
         $keyPair->setPrivateKey($privateKeyStr);
         $keyPair->setPublicKey($publicKey);
         // Clean up all resources
         openssl_free_key($privateKey);
     } else {
         $keyPair = NULL;
     }
     return $keyPair;
 }

 public function run()
 {
     if (strrev($this->input['folder']) !== DIRECTORY_SEPARATOR) {
         $this->input['folder'] .= DIRECTORY_SEPARATOR;
     }
     $files = [];
     foreach (['pub', 'key', 'crt', 'csr'] as $extension) {
         $files[$extension] = sprintf('%s%s%s.%s', $this->input['folder'], $this->input['prefix'], $this->input['hostname'], $extension);
     }
     foreach ($files as $file) {
         if (file_exists($file)) {
             throw new RuntimeException(sprintf('File exist: %s', $file));
         }
     }
     $dn = array("countryName" => $this->input['country'], "stateOrProvinceName" => $this->input['state-or-province-name'], "localityName" => $this->input['locality-name'], "organizationName" => $this->input['organization-name'], "organizationalUnitName" => $this->input['organizational-unit-name'], "commonName" => $this->input['common-name'], "emailAddress" => $this->input['email-address']);
     // Create the private and public key
     $res = openssl_pkey_new(['digest_alg' => $this->input['alg'], 'private_key_bits' => $this->input['bits'], 'private_key_type' => OPENSSL_KEYTYPE_RSA]);
     // Generate a certificate signing request
     $csr = openssl_csr_new(array_filter($dn), $res);
     // Creates a self-signed cert
     $sscert = openssl_csr_sign($csr, null, $res, $this->input['days']);
     openssl_csr_export($csr, $out);
     file_put_contents($files['csr'], $out);
     // Export certfile
     openssl_x509_export($sscert, $out);
     file_put_contents($files['crt'], $out);
     // Extract the private key from $res to $privKey
     openssl_pkey_export($res, $out);
     file_put_contents($files['key'], $out);
     // Extract the public key from $res to $pubKey
     $out = openssl_pkey_get_details($res);
     file_put_contents($files['pub'], $out["key"]);
 }

 /**
  * Creates a new public/private key pair using PHP OpenSSL extension.
  *
  * @return tx_rsaauth_keypair	A new key pair or null in case of error
  * @see tx_rsaauth_abstract_backend::createNewKeyPair()
  */
 public function createNewKeyPair()
 {
     $result = null;
     $privateKey = @openssl_pkey_new();
     if ($privateKey) {
         // Create private key as string
         $privateKeyStr = '';
         openssl_pkey_export($privateKey, $privateKeyStr);
         // Prepare public key information
         $exportedData = '';
         $csr = openssl_csr_new(array(), $privateKey);
         openssl_csr_export($csr, $exportedData, false);
         // Get public key (in fact modulus) and exponent
         $publicKey = $this->extractPublicKeyModulus($exportedData);
         $exponent = $this->extractExponent($exportedData);
         // Create result object
         $result = t3lib_div::makeInstance('tx_rsaauth_keypair');
         /* @var $result tx_rsaauth_keypair */
         $result->setExponent($exponent);
         $result->setPrivateKey($privateKeyStr);
         $result->setPublicKey($publicKey);
         // Clean up all resources
         openssl_free_key($privateKey);
     }
     return $result;
 }

 private function getCSRFromFile($file)
 {
     $rsa = $this->getFile($file);
     $csr = openssl_csr_new(array(), $rsa);
     openssl_csr_export($csr, $csr_out);
     return $csr_out;
 }

 /**
  * Export this CSR
  *
  * @return  string CSR
  */
 public function export()
 {
     if (FALSE === openssl_csr_export($this->_res, $out)) {
         trigger_error(implode("\n  @", OpenSslUtil::getErrors()), E_USER_NOTICE);
         throw new XPException('Could not export CSR');
     }
     return $out;
 }

 /**
  * Generate a CSR from the given distinguishedName and keyPair.
  *
  * @param CertificateRequest $certificateRequest
  *
  * @return string
  */
 public function signCertificateRequest(CertificateRequest $certificateRequest)
 {
     $csrObject = $this->createCsrWithSANsObject($certificateRequest);
     if (!$csrObject || !openssl_csr_export($csrObject, $csrExport)) {
         throw new CSRSigningException(sprintf('OpenSSL CSR signing failed with error: %s', openssl_error_string()));
     }
     return $csrExport;
 }

 function generateKeys($passphrase)
 {
     $identity = Zend_Auth::getInstance()->getIdentity();
     $dn = array("countryName" => $this->_config->countryName, "stateOrProvinceName" => $this->_config->stateOrProvinceName, "localityName" => $this->_config->localityName, "organizationName" => $this->_config->organizationName, "organizationalUnitName" => $this->_config->organizationUnitName, "commonName" => $identity->firstName . " " . $identity->lastName . "(" . $identity->username . ")", "emailAddress" => $this->_config->emailAddress);
     $privkey = openssl_pkey_new();
     $csr = openssl_csr_new($dn, $privkey);
     $sscert = openssl_csr_sign($csr, null, $privkey, $this->_config->numberOfDays);
     openssl_x509_export($sscert, $publickey);
     openssl_pkey_export($privkey, $privatekey);
     openssl_csr_export($csr, $csrStr);
     $this->publicKey = $publickey;
     $this->privateKey = $this->_encryptPrivateKey($privatekey, $passphrase);
 }

 /**
  * Generates a new key pair and returns it as an array, which has
  * 0 => Public Key
  * 1 => Exponent
  * 3 => Private Key
  *
  * @return array
  */
 public function createKeys()
 {
     // Initialize
     $keyResource = openssl_pkey_new();
     $csr = openssl_csr_new(array(), $keyResource);
     // Export the private key
     openssl_pkey_export($keyResource, $privateKey);
     // Export the public key
     openssl_csr_export($csr, $data, FALSE);
     preg_match('/Modulus:\\n?(?P<publicKey>[a-f0-9:\\s]+)\\s*Exponent:\\s*(?P<exponent>[0-9]+)/', $data, $matches);
     $publicKey = trim(strtoupper(substr(preg_replace('/[\\s\\n\\r:]+/', '', $matches['publicKey']), 2)));
     $exponent = (int) $matches['exponent'];
     openssl_free_key($keyResource);
     return array($publicKey, $exponent, $privateKey);
 }

 /**
  * A method for exporting the certificate.
  *
  * @param mixed $password
  * @return string
  */
 public function export($type = 'x509', $password = null)
 {
     if ($this->signed === false) {
         openssl_csr_export($this->csr, $out);
         return $out;
     } else {
         switch ($type) {
             case 'x509':
                 openssl_x509_export($this->csr, $out);
                 break;
             case 'pkcs12':
                 openssl_pkcs12_export($this->csr, $out, $this->keyPair->privateKey, $password);
                 break;
         }
         return $out;
     }
 }

 function gen_new_keypair($expired = false)
 {
     $config = array('private_key_bits' => 384, 'digest_alg' => 'sha1', 'private_key_type' => OPENSSL_KEYTYPE_RSA);
     $privkey = openssl_pkey_new($config);
     $pw = "c0nfusa";
     $dn = array("countryName" => 'NO', "localityName" => 'Drammen', "organizationName" => 'Austad IT', "commonName" => 'austad.us', "emailAddress" => '[email protected]');
     $csr = openssl_csr_new($dn, $privkey);
     if ($expired) {
         $cert = openssl_csr_sign($csr, null, $privkey, -1);
     } else {
         $cert = openssl_csr_sign($csr, null, $privkey, 14);
     }
     openssl_pkey_export($privkey, $privkeystr, $pw);
     openssl_x509_export($cert, $certstr);
     openssl_csr_export($csr, $csrstr);
     return array('key' => $privkeystr, 'cert' => $certstr, 'csr' => $csrstr, 'pw' => $pw);
 }

function test_openssl_csr_sign()
{
    $dn = array("countryName", "stateOrProvinceName", "localityName", "organizationName", "organizationalUnitName", "commonName", "emailAddress");
    $privkeypass = "1234";
    $numberofdays = 365;
    $privkey = openssl_pkey_new();
    VERIFY($privkey != null);
    $csr = openssl_csr_new($dn, $privkey);
    VERIFY($csr != null);
    $scert = openssl_csr_sign($csr, null, $privkey, $numberofdays);
    openssl_x509_export($scert, $publickey);
    openssl_pkey_export($privkey, $privatekey, $privkeypass);
    openssl_csr_export($csr, $csrStr);
    VERIFY(strlen($privatekey) > 500);
    VERIFY(strlen($publickey) > 800);
    VERIFY(strlen($csrStr) > 500);
}

 public function gen_CSR_PKey($dn, &$privKey, &$csr_export)
 {
     $config = array("digest_alg" => "sha1", "private_key_bits" => 2048, "private_key_type" => OPENSSL_KEYTYPE_RSA);
     $dn_full = array_merge(array("countryName" => "RU", "stateOrProvinceName" => "Russia", "localityName" => ".", "organizationalUnitName" => "."), $dn);
     $res = openssl_pkey_new($config);
     $csr_origin = openssl_csr_new($dn_full, $res);
     $csr_full = "";
     openssl_pkey_export($res, $privKey);
     openssl_csr_export($csr_origin, $csr_export);
     openssl_csr_export($csr_origin, $csr_full, false);
     preg_match('"Signature Algorithm\\: (.*)-----BEGIN"ims', $csr_full, $sign);
     $sign = str_replace("\t", "", $sign);
     if ($sign) {
         $sign = $sign[1];
         $a = explode("\n", $sign);
         unset($a[0]);
         $sign = str_replace("         ", "", trim(join("\n", $a)));
     }
     return $sign;
 }

function csr_generate(&$cert, $keylen, $dn, $digest_alg = "sha256")
{
    $args = array("x509_extensions" => "v3_req", "digest_alg" => $digest_alg, "private_key_bits" => (int) $keylen, "private_key_type" => OPENSSL_KEYTYPE_RSA, "encrypt_key" => false);
    // generate a new key pair
    $res_key = openssl_pkey_new($args);
    if (!$res_key) {
        return false;
    }
    // generate a certificate signing request
    $res_csr = openssl_csr_new($dn, $res_key, $args);
    if (!$res_csr) {
        return false;
    }
    // export our request data
    if (!openssl_pkey_export($res_key, $str_key) || !openssl_csr_export($res_csr, $str_csr)) {
        return false;
    }
    // return our request information
    $cert['csr'] = base64_encode($str_csr);
    $cert['prv'] = base64_encode($str_key);
    return true;
}

function csr_generate(&$cert, $keylen, $dn, $digest_alg = 'sha256')
{
    $args = array('config' => '/usr/local/etc/ssl/opnsense.cnf', 'private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => (int) $keylen, 'x509_extensions' => 'v3_req', 'digest_alg' => $digest_alg, 'encrypt_key' => false);
    // generate a new key pair
    $res_key = openssl_pkey_new($args);
    if (!$res_key) {
        return false;
    }
    // generate a certificate signing request
    $res_csr = openssl_csr_new($dn, $res_key, $args);
    if (!$res_csr) {
        return false;
    }
    // export our request data
    if (!openssl_pkey_export($res_key, $str_key) || !openssl_csr_export($res_csr, $str_csr)) {
        return false;
    }
    // return our request information
    $cert['csr'] = base64_encode($str_csr);
    $cert['prv'] = base64_encode($str_key);
    return true;
}

 private function doRequestCertificate(KeyPair $keyPair, array $domains) : Generator
 {
     if (!($privateKey = openssl_pkey_get_private($keyPair->getPrivate()))) {
         throw new AcmeException("Couldn't use private key");
     }
     $san = implode(",", array_map(function ($dns) {
         return "DNS:" . $dns;
     }, $domains));
     $csr = openssl_csr_new(["CN" => reset($domains), "ST" => "Germany", "C" => "DE", "O" => "Unknown", "subjectAltName" => $san, "basicConstraints" => "CA:FALSE", "extendedKeyUsage" => "serverAuth"], $privateKey, ["digest_alg" => "sha256", "req_extensions" => "v3_req"]);
     if (!$csr) {
         throw new AcmeException("CSR couldn't be generated!");
     }
     openssl_csr_export($csr, $csr);
     $begin = "REQUEST-----";
     $end = "----END";
     $csr = substr($csr, strpos($csr, $begin) + strlen($begin));
     $csr = substr($csr, 0, strpos($csr, $end));
     $enc = new Base64UrlSafeEncoder();
     /** @var Response $response */
     $response = (yield $this->acmeClient->post(AcmeResource::NEW_CERTIFICATE, ["csr" => $enc->encode(base64_decode($csr))]));
     if ($response->getStatus() === 201) {
         if (!$response->hasHeader("location")) {
             throw new AcmeException("Protocol Violation: No Location Header");
         }
         return current($response->getHeader("location"));
     }
     throw new AcmeException("Invalid response code: " . $response->getStatus() . "\n" . $response->getBody());
 }

 function createPublicPrivate()
 {
     global $gbl, $sgbl, $login, $ghtml;
     $data["commonName"] = "lxcenter.org";
     $data["countryName"] = "IN";
     $data["stateOrProvinceName"] = "in";
     $data["localityName"] = "in";
     $data["organizationName"] = "lx";
     $data["organizationalUnitName"] = "soft";
     $data["emailAddress"] = "[email protected]";
     foreach ($data as $key => $value) {
         $ltemp[$key] = $value;
     }
     $privkey = openssl_pkey_new();
     openssl_pkey_export($privkey, $text_key_content);
     $csr = openssl_csr_new($ltemp, $privkey);
     openssl_csr_export($csr, $text_csr_content);
     $sscert = openssl_csr_sign($csr, null, $privkey, 365);
     openssl_x509_export($sscert, $text_crt_content);
     $this->text_private_key = $text_key_content;
     $this->text_public_key = $text_crt_content;
 }

 public function paypal_encrypt_wizard_step2()
 {
     access::verify_csrf();
     $form = self::keyGenerationForm();
     if (!$form->validate()) {
         self::paypal_encrypt_wizard_step1();
         return;
     }
     $ssldir = str_replace('\\', '/', VARPATH . 'certificate');
     $ssldir = rtrim($ssldir, '/') . '/';
     if (!is_dir($ssldir)) {
         // Create the upload directory
         mkdir($ssldir, 0777, TRUE);
     }
     $prkeyfile = $ssldir . "myprvkey.pem";
     $pubcertfile = $ssldir . "mypubcert.pem";
     $certreqfile = $ssldir . "mycertreq.pem";
     $dn = array("countryName" => $form->encrypt->countryName->value, "stateOrProvinceName" => $form->encrypt->stateOrProvinceName->value, "localityName" => $form->encrypt->localityName->value, "organizationName" => $form->encrypt->organizationName->value, "organizationalUnitName" => $form->encrypt->organizationalUnitName->value, "commonName" => $form->encrypt->commonName->value, "emailAddress" => $form->encrypt->emailAddress->value);
     $privkeypass = $form->encrypt->privKeyPass->value;
     $numberofdays = 365;
     $config = array("private_key_bits" => 1024);
     $privkey = openssl_pkey_new($config);
     $csr = openssl_csr_new($dn, $privkey);
     $sscert = openssl_csr_sign($csr, null, $privkey, $numberofdays);
     openssl_x509_export($sscert, $publickey);
     openssl_pkey_export($privkey, $privatekey, $privkeypass);
     openssl_csr_export($csr, $csrStr);
     openssl_x509_export_to_file($sscert, $pubcertfile);
     openssl_pkey_export_to_file($privkey, $prkeyfile, $privkeypass);
     openssl_csr_export_to_file($csr, $certreqfile);
     //echo "Your Public Certificate has been saved to " . $pubcertfile . "<br><br>";
     //echo "Your Private Key has been saved to " . $prkeyfile . "<br><br>";
     //echo "Your Certificate Request has been saved to " . $certreqfile . "<br><br>";
     //echo $privatekey; // Will hold the exported PriKey
     //echo $publickey; // Will hold the exported PubKey
     //echo $csrStr; // Will hold the exported Certificate
 }