.NET Core C#

Renew a DigiCert Certificate from an EST-enabled profile

See more Certificates Examples

Demonstrates how to renew a certificate from an EST-enabled profile in DigiCert​​®​​ Trust Lifecycle Manager. (The certificate must be within the renewal window configured in the certificate profile. The CSR must have same Subject DN values as the original certificate.) .NET Core C#

bool success = false;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The example below duplicates the following OpenSSL commands:
// 
// # Name of certificate as argument 1
// 
// # Make new key
// openssl ecparam -name prime256v1 -genkey -noout -out ${1}.key.pem
// 
// # Make csr
// openssl req -new -sha256 -key ${1}.key.pem -out ${1}.p10.csr -subj "/CN=${1}"
// 
// # Request new cert
// curl -v --cacert data/ca.pem --cert data/${1}.pem --key data/${1}.key.pem 
//     --data-binary @${1}.p10.csr -o ${1}.p7.b64 -H "Content-Type: application/pkcs10" https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll
// 
// # Convert to PEM
// openssl base64 -d -in ${1}.p7.b64 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${1}.pem

// ------------------------------------------------------------------------------------------------------------------

// Create a Fortuna PRNG and seed it with system entropy.
// This will be our source of random data for generating the ECC private key.
Chilkat.Prng fortuna = new Chilkat.Prng();
string entropy = fortuna.GetEntropy(32,"base64");
success = fortuna.AddEntropy(entropy,"base64");

Chilkat.Ecc ec = new Chilkat.Ecc();

// Generate a random EC private key on the prime256v1 curve.
Chilkat.PrivateKey privKey = new Chilkat.PrivateKey();
success = ec.GenKey("prime256v1",fortuna,privKey);
if (success != true) {
    Debug.WriteLine(ec.LastErrorText);
    return;
}

// Create the CSR object and set properties.
Chilkat.Csr csr = new Chilkat.Csr();

// Specify your CN
csr.CommonName = "mysubdomain.mydomain.com";

// Create the CSR using the private key.
Chilkat.BinData bdCsr = new Chilkat.BinData();
success = csr.GenCsrBd(privKey,bdCsr);
if (success == false) {
    Debug.WriteLine(csr.LastErrorText);
    return;
}

// Save the private key and CSR to files.
privKey.SavePkcs8EncryptedPemFile("password","c:/temp/qa_output/ec_privkey.pem");

bdCsr.WriteFile("c:/temp/qa_output/csr.pem");

// ----------------------------------------------------------------------
// Now do the CURL request to POST the CSR and get the new certificate.

Chilkat.Http http = new Chilkat.Http();

Chilkat.Cert tlsClientCert = new Chilkat.Cert();
success = tlsClientCert.LoadFromFile("data/myTlsClientCert.pem");
if (success == false) {
    Debug.WriteLine(tlsClientCert.LastErrorText);
    return;
}

Chilkat.BinData bdTlsClientCertPrivKey = new Chilkat.BinData();
success = bdTlsClientCertPrivKey.LoadFile("data/myTlsClientCert.key.pem");
if (success == false) {
    Debug.WriteLine("Failed to load data/myTlsClientCert.key.pem");
    return;
}

Chilkat.PrivateKey tlsClientCertPrivKey = new Chilkat.PrivateKey();
success = tlsClientCertPrivKey.LoadAnyFormat(bdTlsClientCertPrivKey,"");
if (success == false) {
    Debug.WriteLine(tlsClientCertPrivKey.LastErrorText);
    return;
}

success = tlsClientCert.SetPrivateKey(tlsClientCertPrivKey);
if (success == false) {
    Debug.WriteLine(tlsClientCert.LastErrorText);
    return;
}

http.SetSslClientCert(tlsClientCert);

http.RequireSslCertVerify = true;

// The body of the HTTP request contains the binary CSR.
Chilkat.HttpResponse resp = new Chilkat.HttpResponse();
string url = "https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll";
success = http.HttpBd("POST",url,bdCsr,"application/pkcs10",resp);
if (success == false) {
    Debug.WriteLine(http.LastErrorText);
    return;
}

if (resp.StatusCode != 200) {
    Debug.WriteLine("response status code = " + Convert.ToString(resp.StatusCode));
    Debug.WriteLine(resp.BodyStr);
    Debug.WriteLine("Failed");
    return;
}

// The response is the Base64 DER of the new certificate.
Chilkat.Cert myNewCert = new Chilkat.Cert();
success = myNewCert.LoadFromBase64(resp.BodyStr);
if (success == false) {
    Debug.WriteLine(myNewCert.LastErrorText);
    Debug.WriteLine("Cert data = " + resp.BodyStr);
    Debug.WriteLine("Failed.");
    return;
}

success = myNewCert.SaveToFile("c:/temp/qa_output/myNewCert.cer");
if (success == false) {
    Debug.WriteLine(myNewCert.LastErrorText);
    Debug.WriteLine("Failed.");
    return;
}

Debug.WriteLine("Success.");