I'm trying to generate a CSR via PHP. But the CA keeps denying my CSR since they say its not 2048 bits and not protected with a password. But when I look in the PHP documentation for the function openssl\_csr\_new() I can't find how to do it? 

My current code:

```
$dn = array(
                   'countryName' => $countryName,
                   'stateOrProvinceName' => $stateOrProvinceName,
                   'localityName' => $localityName,
                   'organizationName' => $organizationName,
                   'commonName' => $commonName,
                   'emailAddress' => $emailAddress
               );

               if(!empty($organizationalUnitName))
               $dn['organizationalUnitName'] = $organizationalUnitName;

               $csrSettings = array('private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA, 'encrypt_key' => true);

               // Generate a new private (and public) key pair
               $privkey = openssl_pkey_new($csrSettings);

               // Generate a certificate signing request
               $csr = openssl_csr_new($dn, $privkey, $csrSettings);
               openssl_csr_export($csr, $csrout);
               openssl_pkey_export($privkey, $pkeyout);

```

What am I doing wrong? 

------ Updated code: -------

```
$dn = array(
               'countryName' => $countryName,
               'stateOrProvinceName' => $stateOrProvinceName,
               'localityName' => $localityName,
               'organizationName' => $organizationName,
               'commonName' => $commonName,
               'emailAddress' => $emailAddress
           );

           if(!empty($organizationalUnitName))
           $dn['organizationalUnitName'] = $organizationalUnitName;

           $csrSettings = array('private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA, 'encrypt_key' => true);

           // Generate a new private (and public) key pair
           $privkey = openssl_pkey_new($csrSettings);

           // Generate a certificate signing request
           openssl_pkey_export($privkey, $pkeyout, 'test 1235 aaaaa');

           $csr = openssl_csr_new($dn, $pkeyout, $csrSettings);
           openssl_csr_export($csr, $csrout);

```