> From: [email protected] On Behalf Of Kacper86 > Sent: Monday, 06 February, 2012 09:49
> I would like to use openssl library in my iOS application > (Objective-C) to generate certificate signing request [like] > openssl req -new -newkey rsa:2048 -nodes -out common_name.csr -keyout > common_name.key -subj > "/C=pl/ST=state/L=city/O=organization/OU=department/CN=common_name" > > [except] as a library. Can I ask for some hints on > how to do it or what documents should I read in the first place? Do I > have to separately create public/private keys and then use them to > create CSR? > You can read PKCS#10 = RFC 2986 but it doesn't say much. AFAICS OpenSSL doesn't have any man pages for REQ other than the i2d/d2i routines (which are not very interesting). http://en.wikipedia.org/wiki/Certificate_signing_request has a decent introduction, but its description of DN and CN is quite wrong. (DN is the whole sequence of fields CN Org OrgUnit etc., possibly including EmailAddress although that is now preferred in the SubjectAltName extension instead of DN. CN *for an SSL server* is normally the FQDN; in other cases it may be another name. Note that *domain* name as in FQDN != *distinguished* name as in X509&CSR.) It refers to http://www.redkestrel.co.uk/Articles/CSR.html#anchor-whats-in-a-csr which expands a little, and also contains some info on keys and key generation which is not actually part of a CSR but as above is often done together with a CSR. A certreq is inherently for a specific keypair (public/private). If you already have a keypair and want to generate a CSR for it, you can do that. Since in SSL or other PKI a keypair without a cert is basically useless, usually you generate a keypair and immediately either generate a selfsigned cert, or generate a CSR and use it to get a (CA-issued) cert. Typically you would generate a (subsequent) CSR for an existing keypair only if the first CSR was bad (rejected) and needs to be corrected, or the first cert was wrong somehow and needs to be replaced. Even in these cases you might choose to discard the first keypair and generate a new one. > I found out that there a few functions which are responsible for > creating CSR: > > int PEM_write_bio_X509_REQ(BIO *bp, X509_REQ *x); > int PEM_write_X509_REQ(FILE *fp, X509_REQ *x); > int PEM_write_bio_X509_REQ_NEW(BIO *bp, X509_REQ *x); > int PEM_write_X509_REQ_NEW(FILE *fp, X509_REQ *x); > To write a CSR to a PEM file, which may create the *file*, yes. The CSR must already be built (I would say created) in memory. There are different routines to write a DER file, but DER format is less used, especially over the web. If you are newly generating the keypair, you must also write the privatekey in a suitable location and format; otherwise any cert you obtain is useless. The publickey is contained in the CSR and (later) cert, and even if you manage to lose those, for RSA using OpenSSL's preferred (CRT) form, the publickey can be easily recovered from the privatekey. > 1. I assume that after calling PEM_write_X509_REQ_NEW(), file fp will > contain csr only, like this: > > -----BEGIN CERTIFICATE REQUEST----- > ... > -----END CERTIFICATE REQUEST----- > The file open on fp will have the CSR written to it like that. If nothing else is written to the same file before or after calling PEM_write_, and it wasn't a nonempty existing file opened for append, then that will be the only contents. > 2. is there any info on how to initialize X509_REQ object? <snip> > As I look through the dependencies, there are a lot of different > classes. Do I have to initialize all of them manually or is there a > better way? > You should (allocate and) initialize all the fields in req_info, also called the TBS (to be signed), then use X509_REQ_sign to add your (entity's) signature. The minimal fields in req_info are your "subject" name and your publickey. You can also include various attributes and extensions depending on the CA you're using and the desired contents (e.g. capabilities) of the resulting cert. apps/req.c has code to create (and write) a new CSR (with quite a few options for the contents, and optional keypair generation) or to read (and display) an existing one, or to generate a selfsigned cert from a new CSR or an existing one. If you ignore the parts about display and selfsigned, what's left is a smorgasbord for you. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
