When using `openssl_csr_new()` or `openssl_csr_sign()` for X25519 or Ed25519 certs, you HAVE TO set the `["digest_alg" => ""]` or if you use the `"config"` option to `null`, like so:

<?php
// Setting the "digest_alg" option:
$csr = openssl_csr_new(
    $distinguished_names,
    $private_key,
    ["digest_alg" => ""]
);

// Setting with "config":
$csr = openssl_csr_new(
    $distinguished_names,
    $private_key,
    ["config" => "/path/to/openssl.conf"]
);
?>

openssl.conf
```
[req]
default_md = null
// ...
```

To generate a self-signed certificate, pass NULL as the signing certificate (2nd parameter).  For example:

$req_key = openssl_pkey_new();
$dn = array(
    "countryName" => "US",
    "stateOrProvinceName" => "Colorado",
    "organizationName" => "yPass.net",
    "organizationalUnitName" => "yPass.net",
    "commonName" => "yPass.net Root Certificate"
);
$req_csr = openssl_csr_new($dn, $req_key);
$req_cert = openssl_csr_sign($req_csr, NULL, $req_key, 365);

Here is an sample how to create valid X.509 Public and Private Key (cert/key).
When not using self signed the 4.2.1 segault. You need the CVS code at least for openssl.

<?
Header("Content-Type: text/plain");
$CA_CERT = "CA.cert.pem";
$CA_KEY  = "CA.key.pem";
$req_key = openssl_pkey_new();
if(openssl_pkey_export ($req_key, $out_key)) {
        $dn = array(
                "countryName"            => "DE",
                "stateOrProvinceName"    => "Frankfurt",
                "organizationName"       => "smcc.net",
                "organizationalUnitName" => "E-Mail",
                "commonName"             => "Testcert"
                );
        $req_csr  = openssl_csr_new ($dn, $req_key);
        $req_cert = openssl_csr_sign($req_csr, "file://$CA_CERT", "file://$CA_KEY", 365);
        if(openssl_x509_export ($req_cert, $out_cert)) {
                echo "$out_key\n";
                echo "$out_cert\n";
                }
        else    echo "Failed Cert\n";
        }
else            echo "FailedKey\n";
?>

config_section_section is incorrect. The correct keyword to use is "config_section_name".