(PureBasic) Renew a DigiCert Certificate from an EST-enabled profile

Demonstrates how to renew a certificate from an EST-enabled profile in DigiCert​​®​​ Trust Lifecycle Manager. (The certificate must be within the renewal window configured in the certificate profile. The CSR must have same Subject DN values as the original certificate.)

Note: This example requires Chilkat v11.0.0 or greater.

Chilkat PureBasic Module Download Chilkat PureBasic Module

IncludeFile "CkBinData.pb"
IncludeFile "CkEcc.pb"
IncludeFile "CkPrivateKey.pb"
IncludeFile "CkPrng.pb"
IncludeFile "CkHttp.pb"
IncludeFile "CkCsr.pb"
IncludeFile "CkHttpResponse.pb"
IncludeFile "CkCert.pb"

Procedure ChilkatExample()

    ; This example requires the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    ; The example below duplicates the following OpenSSL commands:
    ; 
    ; # Name of certificate as argument 1
    ; 
    ; # Make new key
    ; openssl ecparam -name prime256v1 -genkey -noout -out ${1}.key.pem
    ; 
    ; # Make csr
    ; openssl req -new -sha256 -key ${1}.key.pem -out ${1}.p10.csr -subj "/CN=${1}"
    ; 
    ; # Request new cert
    ; curl -v --cacert data/ca.pem --cert data/${1}.pem --key data/${1}.key.pem 
    ;     --data-binary @${1}.p10.csr -o ${1}.p7.b64 -H "Content-Type: application/pkcs10" https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll
    ; 
    ; # Convert to PEM
    ; openssl base64 -d -in ${1}.p7.b64 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${1}.pem

    ; ------------------------------------------------------------------------------------------------------------------

    ; Create a Fortuna PRNG and seed it with system entropy.
    ; This will be our source of random data for generating the ECC private key.
    fortuna.i = CkPrng::ckCreate()
    If fortuna.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    entropy.s = CkPrng::ckGetEntropy(fortuna,32,"base64")
    success.i = CkPrng::ckAddEntropy(fortuna,entropy,"base64")

    ec.i = CkEcc::ckCreate()
    If ec.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; Generate a random EC private key on the prime256v1 curve.
    privKey.i = CkPrivateKey::ckCreate()
    If privKey.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkEcc::ckGenKey(ec,"prime256v1",fortuna,privKey)
    If success <> 1
        Debug CkEcc::ckLastErrorText(ec)
        CkPrng::ckDispose(fortuna)
        CkEcc::ckDispose(ec)
        CkPrivateKey::ckDispose(privKey)
        ProcedureReturn
    EndIf

    ; Create the CSR object and set properties.
    csr.i = CkCsr::ckCreate()
    If csr.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; Specify your CN
    CkCsr::setCkCommonName(csr, "mysubdomain.mydomain.com")

    ; Create the CSR using the private key.
    bdCsr.i = CkBinData::ckCreate()
    If bdCsr.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkCsr::ckGenCsrBd(csr,privKey,bdCsr)
    If success = 0
        Debug CkCsr::ckLastErrorText(csr)
        CkPrng::ckDispose(fortuna)
        CkEcc::ckDispose(ec)
        CkPrivateKey::ckDispose(privKey)
        CkCsr::ckDispose(csr)
        CkBinData::ckDispose(bdCsr)
        ProcedureReturn
    EndIf

    ; Save the private key and CSR to files.
    CkPrivateKey::ckSavePkcs8EncryptedPemFile(privKey,"password","c:/temp/qa_output/ec_privkey.pem")

    CkBinData::ckWriteFile(bdCsr,"c:/temp/qa_output/csr.pem")

    ; ----------------------------------------------------------------------
    ; Now do the CURL request to POST the CSR and get the new certificate.

    http.i = CkHttp::ckCreate()
    If http.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    tlsClientCert.i = CkCert::ckCreate()
    If tlsClientCert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkCert::ckLoadFromFile(tlsClientCert,"data/myTlsClientCert.pem")
    If success = 0
        Debug CkCert::ckLastErrorText(tlsClientCert)
        CkPrng::ckDispose(fortuna)
        CkEcc::ckDispose(ec)
        CkPrivateKey::ckDispose(privKey)
        CkCsr::ckDispose(csr)
        CkBinData::ckDispose(bdCsr)
        CkHttp::ckDispose(http)
        CkCert::ckDispose(tlsClientCert)
        ProcedureReturn
    EndIf

    bdTlsClientCertPrivKey.i = CkBinData::ckCreate()
    If bdTlsClientCertPrivKey.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkBinData::ckLoadFile(bdTlsClientCertPrivKey,"data/myTlsClientCert.key.pem")
    If success = 0
        Debug "Failed to load data/myTlsClientCert.key.pem"
        CkPrng::ckDispose(fortuna)
        CkEcc::ckDispose(ec)
        CkPrivateKey::ckDispose(privKey)
        CkCsr::ckDispose(csr)
        CkBinData::ckDispose(bdCsr)
        CkHttp::ckDispose(http)
        CkCert::ckDispose(tlsClientCert)
        CkBinData::ckDispose(bdTlsClientCertPrivKey)
        ProcedureReturn
    EndIf

    tlsClientCertPrivKey.i = CkPrivateKey::ckCreate()
    If tlsClientCertPrivKey.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkPrivateKey::ckLoadAnyFormat(tlsClientCertPrivKey,bdTlsClientCertPrivKey,"")
    If success = 0
        Debug CkPrivateKey::ckLastErrorText(tlsClientCertPrivKey)
        CkPrng::ckDispose(fortuna)
        CkEcc::ckDispose(ec)
        CkPrivateKey::ckDispose(privKey)
        CkCsr::ckDispose(csr)
        CkBinData::ckDispose(bdCsr)
        CkHttp::ckDispose(http)
        CkCert::ckDispose(tlsClientCert)
        CkBinData::ckDispose(bdTlsClientCertPrivKey)
        CkPrivateKey::ckDispose(tlsClientCertPrivKey)
        ProcedureReturn
    EndIf

    success = CkCert::ckSetPrivateKey(tlsClientCert,tlsClientCertPrivKey)
    If success = 0
        Debug CkCert::ckLastErrorText(tlsClientCert)
        CkPrng::ckDispose(fortuna)
        CkEcc::ckDispose(ec)
        CkPrivateKey::ckDispose(privKey)
        CkCsr::ckDispose(csr)
        CkBinData::ckDispose(bdCsr)
        CkHttp::ckDispose(http)
        CkCert::ckDispose(tlsClientCert)
        CkBinData::ckDispose(bdTlsClientCertPrivKey)
        CkPrivateKey::ckDispose(tlsClientCertPrivKey)
        ProcedureReturn
    EndIf

    CkHttp::ckSetSslClientCert(http,tlsClientCert)

    CkHttp::setCkRequireSslCertVerify(http, 1)

    ; The body of the HTTP request contains the binary CSR.
    resp.i = CkHttpResponse::ckCreate()
    If resp.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    url.s = "https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll"
    success = CkHttp::ckHttpBd(http,"POST",url,bdCsr,"application/pkcs10",resp)
    If success = 0
        Debug CkHttp::ckLastErrorText(http)
        CkPrng::ckDispose(fortuna)
        CkEcc::ckDispose(ec)
        CkPrivateKey::ckDispose(privKey)
        CkCsr::ckDispose(csr)
        CkBinData::ckDispose(bdCsr)
        CkHttp::ckDispose(http)
        CkCert::ckDispose(tlsClientCert)
        CkBinData::ckDispose(bdTlsClientCertPrivKey)
        CkPrivateKey::ckDispose(tlsClientCertPrivKey)
        CkHttpResponse::ckDispose(resp)
        ProcedureReturn
    EndIf

    If CkHttpResponse::ckStatusCode(resp) <> 200
        Debug "response status code = " + Str(CkHttpResponse::ckStatusCode(resp))
        Debug CkHttpResponse::ckBodyStr(resp)
        Debug "Failed"
        CkPrng::ckDispose(fortuna)
        CkEcc::ckDispose(ec)
        CkPrivateKey::ckDispose(privKey)
        CkCsr::ckDispose(csr)
        CkBinData::ckDispose(bdCsr)
        CkHttp::ckDispose(http)
        CkCert::ckDispose(tlsClientCert)
        CkBinData::ckDispose(bdTlsClientCertPrivKey)
        CkPrivateKey::ckDispose(tlsClientCertPrivKey)
        CkHttpResponse::ckDispose(resp)
        ProcedureReturn
    EndIf

    ; The response is the Base64 DER of the new certificate.
    myNewCert.i = CkCert::ckCreate()
    If myNewCert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkCert::ckLoadFromBase64(myNewCert,CkHttpResponse::ckBodyStr(resp))
    If success = 0
        Debug CkCert::ckLastErrorText(myNewCert)
        Debug "Cert data = " + CkHttpResponse::ckBodyStr(resp)
        Debug "Failed."
        CkPrng::ckDispose(fortuna)
        CkEcc::ckDispose(ec)
        CkPrivateKey::ckDispose(privKey)
        CkCsr::ckDispose(csr)
        CkBinData::ckDispose(bdCsr)
        CkHttp::ckDispose(http)
        CkCert::ckDispose(tlsClientCert)
        CkBinData::ckDispose(bdTlsClientCertPrivKey)
        CkPrivateKey::ckDispose(tlsClientCertPrivKey)
        CkHttpResponse::ckDispose(resp)
        CkCert::ckDispose(myNewCert)
        ProcedureReturn
    EndIf

    success = CkCert::ckSaveToFile(myNewCert,"c:/temp/qa_output/myNewCert.cer")
    If success = 0
        Debug CkCert::ckLastErrorText(myNewCert)
        Debug "Failed."
        CkPrng::ckDispose(fortuna)
        CkEcc::ckDispose(ec)
        CkPrivateKey::ckDispose(privKey)
        CkCsr::ckDispose(csr)
        CkBinData::ckDispose(bdCsr)
        CkHttp::ckDispose(http)
        CkCert::ckDispose(tlsClientCert)
        CkBinData::ckDispose(bdTlsClientCertPrivKey)
        CkPrivateKey::ckDispose(tlsClientCertPrivKey)
        CkHttpResponse::ckDispose(resp)
        CkCert::ckDispose(myNewCert)
        ProcedureReturn
    EndIf

    Debug "Success."


    CkPrng::ckDispose(fortuna)
    CkEcc::ckDispose(ec)
    CkPrivateKey::ckDispose(privKey)
    CkCsr::ckDispose(csr)
    CkBinData::ckDispose(bdCsr)
    CkHttp::ckDispose(http)
    CkCert::ckDispose(tlsClientCert)
    CkBinData::ckDispose(bdTlsClientCertPrivKey)
    CkPrivateKey::ckDispose(tlsClientCertPrivKey)
    CkHttpResponse::ckDispose(resp)
    CkCert::ckDispose(myNewCert)


    ProcedureReturn
EndProcedure