Rust Requires Chilkat v11.0.0+

Generate a CSR with keyUsage, extKeyUsage, and other Extensions

See more CSR Examples

Demonstrates how to generate a CSR containing a 1.2.840.113549.1.9.14 extensionRequest with the following extensions:

• 1.3.6.1.4.1.311.20.2 enrollCerttypeExtension
• 2.5.29.15 keyUsage
• 2.5.29.37 extKeyUsage
• 2.5.29.14 subjectKeyIdentifier

Rust

// This requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// This example will generate a secp256r1 ECDSA key for the CSR.
let ecc = chilkat::Ecc::new();
let prng = chilkat::Prng::new();
let priv_key = chilkat::PrivateKey::new();
if ecc.gen_key("secp256r1", &prng, &priv_key).is_err() {
    println!("Failed to generate a new ECDSA private key.");
    return;
}

let csr = chilkat::Csr::new();

// Add common CSR fields:
csr.set_common_name("mysubdomain.mydomain.com");
csr.set_country("GB");
csr.set_state("Yorks");
csr.set_locality("York");
csr.set_company("Internet Widgits Pty Ltd");
csr.set_email_address("support@mydomain.com");

// Add the following 1.2.840.113549.1.9.14 extensionRequest
// Note: The easiest way to know the content and format of the XML to be added is to examine
// a pre-existing CSR with the same desired extensionRequest.  You can use Chilkat to
// get the extensionRequest from an existing CSR. 

// Here is a sample extension request:

// <?xml version="1.0" encoding="utf-8"?>
// <set>
//     <sequence>
//         <sequence>
//             <oid>1.3.6.1.4.1.311.20.2</oid>
//             <asnOctets>
//                 <universal tag="30" constructed="0">AEUAbgBkAEUAbgB0AGkAdAB5AEMAbABpAGUAbgB0AEEAdQB0AGgAQwBlAHIAdABpAGYAaQBjAGEAdABl
// AF8AQwBTAFIAUABhAHMAcwB0AGgAcgBvAHUAZwBoAC8AVgAx</universal>
//             </asnOctets>
//         </sequence>
//         <sequence>
//             <oid>2.5.29.15</oid>
//             <bool>1</bool>
//             <asnOctets>
//                 <bits n="3">A0</bits>
//             </asnOctets>
//         </sequence>
//         <sequence>
//             <oid>2.5.29.37</oid>
//             <asnOctets>
//                 <sequence>
//                     <oid>1.3.6.1.5.5.7.3.3</oid>
//                 </sequence>
//             </asnOctets>
//         </sequence>
//         <sequence>
//             <oid>2.5.29.14</oid>
//             <asnOctets>
//                 <octets>MCzBMQAViXBz8IDt8LsgmJxJ4Xg=</octets>
//             </asnOctets>
//         </sequence>
//     </sequence>
// </set>

// Use this online tool to generate code from sample XML: 
// Generate Code to Create XML

// A few notes:
// The string "AEUAbgBkAEUAbgB0AGkAdAB5AEMAbABpAGUAbgB0AEEAdQB0AGgAQwBlAHIAdABpAGYAaQBjAGEAdABlAF8AQwBTAFIAUABhAHMAcwB0AGgAcgBvAHUAZwBoAC8AVgAx"
// is the base64 encoding of the utf-16be byte representation of the string "EndEntityClientAuthCertificate_CSRPassthrough/V1"

let s = "EndEntityClientAuthCertificate_CSRPassthrough/V1".to_string();
let bd_temp = chilkat::BinData::new();
let _ = bd_temp.append_string(&s, "utf-16be");
let s_base64_utf16be = bd_temp.get_encoded("base64").unwrap_or_default();
// The string should be "AEUA....."
println!("{}", s_base64_utf16be);

// Here's the code to generate the above extension request.

let xml = chilkat::Xml::new();
xml.set_tag("set");
xml.update_child_content("sequence|sequence|oid", "1.3.6.1.4.1.311.20.2");
let _ = xml.update_attr_at("sequence|sequence|asnOctets|universal", true, "tag", "30");
let _ = xml.update_attr_at("sequence|sequence|asnOctets|universal", true, "constructed", "0");
xml.update_child_content("sequence|sequence|asnOctets|universal", &s_base64_utf16be);
xml.update_child_content("sequence|sequence[1]|oid", "2.5.29.15");
xml.update_child_content("sequence|sequence[1]|bool", "1");
let _ = xml.update_attr_at("sequence|sequence[1]|asnOctets|bits", true, "n", "3");
// A0 is hex for decimal 160.
xml.update_child_content("sequence|sequence[1]|asnOctets|bits", "A0");
xml.update_child_content("sequence|sequence[2]|oid", "2.5.29.37");
xml.update_child_content("sequence|sequence[2]|asnOctets|sequence|oid", "1.3.6.1.5.5.7.3.3");

// This is the subjectKeyIdentifier extension.
// The string "MCzBMQAViXBz8IDt8LsgmJxJ4Xg=" is base64 that decodes to 20 bytes, which is a SHA1 hash.
// This is simply a hash of the DER of the public key.

let pub_key = chilkat::PublicKey::new();
let _ = priv_key.to_public_key(&pub_key);
let bd_pub_key_der = chilkat::BinData::new();
let _ = bd_pub_key_der.append_encoded(&pub_key.get_encoded(true, "base64").unwrap_or_default(), "base64");
let ski = bd_pub_key_der.get_hash("sha1", "base64").unwrap_or_default();

xml.update_child_content("sequence|sequence[3]|oid", "2.5.29.14");
xml.update_child_content("sequence|sequence[3]|asnOctets|octets", &ski);

// Add the extension request to the CSR
let _ = csr.set_extension_request(&xml);

// Generate the CSR with the extension request
let Ok(csr_pem) = csr.gen_csr_pem(&priv_key) else {
    println!("{}", csr.last_error_text());
    return;
};

println!("{}", csr_pem);