php - openssl_csr_sign は常に false を返します

Question

次のスクリプトを使用して、新しい署名付き証明書を生成します。

<?php

error_reporting(E_ALL);

// Generate a new private (and public) key pair
$privkey = openssl_pkey_new();

// Generate a certificate signing request

$dn = array(
    "countryName" => "US",
    "stateOrProvinceName" => "Atlantis",
    "localityName" => "NeverEverLand",
    "organizationName" => "only me",
    "organizationalUnitName" => "blah",
    "commonName" => "bleh",
    "emailAddress" => "test@test.com"
);

$csr = openssl_csr_new($dn, $privkey);


$cacert = file_get_contents('ca.crt');
echo $cacert . "<BR/>";
echo "<BR/>";
$ca_key = file_get_contents('ca.key');
$cakey = array($ca_key, "mysecretpass");
echo $ca_key . "<BR/>";
echo "<BR/>";

$sscert = openssl_csr_sign($csr, $cacert, $cakey, 365);

var_dump($sscert);
echo "<BR/>";
echo "<BR/>";


openssl_pkey_export($privkey, $pkeyout, "mypassword"); var_dump($pkeyout);
echo "<BR/>";
echo "<BR/>";

openssl_csr_export($csr, $csrout); var_dump($csrout);
echo "<BR/>";
echo "<BR/>";
openssl_x509_export($sscert, $certout); var_dump($certout);
echo "<BR/>";
echo "<BR/>";

while (($e = openssl_error_string()) !== false) {
    echo $e . "\n";
}
?>

出力でわかるように、ca.crt と ca.key を読み取ることができます。パスも正しいです (上記のソースで変更されています)。

これはスクリプトの出力です:

-----BEGIN CERTIFICATE----- MIIFGDCCAwACCQCO584jngEQdjANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV ... XZ8YaIOkiV4pEiR5 -----END CERTIFICATE----- 

-----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,E616BBF003C1FA9D ... VCPNIOlGzmKUvDn0iMKE0KRmN8o3ip8oy4HKPZmuh4h+qznZdNF/pBTurqcNVN/P -----END RSA PRIVATE KEY----- 

bool(false) 

string(1834) "-----BEGIN ENCRYPTED PRIVATE KEY----- MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIBX0RFXQVx+ICAggA Bfw= -----END ENCRYPTED PRIVATE KEY----- " 

string(1045) "-----BEGIN CERTIFICATE REQUEST----- MIICzDCCAbQCAQAwgYYxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhBdGxhbnRpczEW zZL71nx/8MgG8hyg63vRRJewb/cCIt1q9A4SwGB9iDe75CbR3ij3jHMftXUfvYhV -----END CERTIFICATE REQUEST----- " 

NULL 

だからコマンド

openssl_csr_sign($csr, $cacert, $cakey, 365);

すべての入力パラメーターが有効な場合でも、FALSE を返します。

CentOS 6.4 / Apache/2.2.15 (CentOS) / mod_ssl/2.2.15 を使用