Problem

Node PHP-WASM runtimes expose OpenSSL but do not provide the configuration path compiled into the extension. RSA key generation therefore fails in clean Playground processes:

$key = openssl_pkey_new( array(
    'private_key_bits' => 2048,
    'private_key_type' => OPENSSL_KEYTYPE_RSA,
) );

Observed result on @wp-playground/cli 3.1.45/3.1.46 with PHP 8.4:

{
  "key": false,
  "errors": [
    "error:0200102C:system library:fopen:No such file or directory",
    "error:2006D080:BIO routines:BIO_new_file:no such file",
    "error:0E078072:configuration file routines:def_load:no such file"
  ],
  "default_default_cert_area": "/root/install/ssl",
  "OPENSSL_CONF": false
}

openssl_get_cert_locations() reports /root/install/ssl, but that configuration tree is absent. Mounting an openssl.cnf and calling putenv('OPENSSL_CONF=...') from PHP is too late because OpenSSL initialization has already failed. Passing the same readable config explicitly as the config option to openssl_pkey_new() succeeds, proving the configuration is valid.

This currently fails at least five exact WPCOM PHPUnit suites covering AI endpoints, AI Coder GitHub App authentication, and Apple login tokens.

Expected

Every supported Node PHP-WASM runtime should start with a valid OpenSSL configuration available before PHP module initialization. Normal OpenSSL APIs should work without every application passing a custom config option.

Acceptance criteria

• openssl_pkey_new() generates an RSA key without explicit configuration on supported Node PHP versions.
• The configuration file and OPENSSL_CONF are installed before PHP/OpenSSL module initialization, including worker and fresh-process runtimes.
• Primary and runInFreshProcess() runtimes have identical OpenSSL behavior.
• Existing caller-provided OpenSSL environment/configuration remains overridable.
• Coverage asserts key generation, key detail extraction, private-key export, and repeated clean-process execution.
• The fix applies to CLI worker runtimes and the programmatic Node runtime path.

Downstream evidence

• Execute bounded PHP commands through clean Playground processes Automattic/wp-codebox#1937
• Execute bounded PHP commands in clean Playground processes Automattic/wp-codebox#1938
• Automattic/wpcom-codebox#441

AI assistance

• Model: OpenAI GPT-5.6 Sol
• Tool: OpenCode
• Used for: Exact WPCOM failure classification, PHP-WASM probes, configuration control experiments, source inspection, and issue drafting under Chris Huber's direction.