|
| 1 | +# NAME |
| 2 | + |
| 3 | +Crypt::OpenSSL::PKCS10 - Perl extension to OpenSSL's PKCS10 API. |
| 4 | + |
| 5 | +# SYNOPSIS |
| 6 | + |
| 7 | +```perl |
| 8 | +use Crypt::OpenSSL::PKCS10 qw( :const ); |
| 9 | + |
| 10 | +my $req = Crypt::OpenSSL::PKCS10->new; |
| 11 | +$req->set_subject("/C=RO/O=UTI/OU=ssi"); |
| 12 | +$req->add_ext(Crypt::OpenSSL::PKCS10::NID_key_usage,"critical,digitalSignature,keyEncipherment"); |
| 13 | +$req->add_ext(Crypt::OpenSSL::PKCS10::NID_ext_key_usage,"serverAuth, nsSGC, msSGC, 1.3.4"); |
| 14 | +$req->add_ext(Crypt::OpenSSL::PKCS10::NID_subject_alt_name,"email:steve@openssl.org"); |
| 15 | +$req->add_custom_ext('1.2.3.3',"My new extension"); |
| 16 | +$req->add_ext_final(); |
| 17 | +$req->sign(); |
| 18 | +$req->write_pem_req('request.pem'); |
| 19 | +$req->write_pem_pk('pk.pem'); |
| 20 | +print $req->get_pem_pubkey(); |
| 21 | +print $req->pubkey_type(); |
| 22 | +print $req->get_pem_req(); |
| 23 | +``` |
| 24 | + |
| 25 | +# ABSTRACT |
| 26 | + |
| 27 | +``` |
| 28 | +Crypt::OpenSSL::PKCS10 - Perl extension to OpenSSL's PKCS10 API. |
| 29 | +``` |
| 30 | + |
| 31 | +# DESCRIPTION |
| 32 | + |
| 33 | +Crypt::OpenSSL::PKCS10 provides the ability to create PKCS10 certificate requests using RSA key pairs. |
| 34 | + |
| 35 | +# Class Methods |
| 36 | + |
| 37 | +- new |
| 38 | + |
| 39 | + Create a new Crypt::OpenSSL::PKCS10 object by generating a new RSA key pair. There is one optional argument, the key size, |
| 40 | + which has the default value of 1024 if omitted. |
| 41 | + |
| 42 | +- new\_from\_rsa( $rsa\_object ) |
| 43 | + |
| 44 | + Create a new Crypt::OpenSSL::PKCS10 object by using key information from a Crypt::OpenSSL::RSA object. Here is an example: |
| 45 | + |
| 46 | + ```perl |
| 47 | + my $rsa = Crypt::OpenSSL::RSA->generate_key(512); |
| 48 | + my $req = Crypt::OpenSSL::PKCS10->new_from_rsa($rsa); |
| 49 | + ``` |
| 50 | + |
| 51 | + OpenSSL 3.0 has deprecated the RSA object which Crypt::OpenSSL::RSA creates. new\_from\_rsa() is now a perl sub which obtains the private key as a string that is also passed to the \_new\_from\_rsa() XS function. |
| 52 | + |
| 53 | +- new\_from\_file( $filename ) |
| 54 | + |
| 55 | + Create a new Crypt::OpenSSL::PKCS10 object by reading the request and key information from a PEM formatted file. Here is an example: |
| 56 | + |
| 57 | + ```perl |
| 58 | + my $req = Crypt::OpenSSL::PKCS10->new_from_file("CSR.csr"); |
| 59 | + ``` |
| 60 | + |
| 61 | +# Instance Methods |
| 62 | + |
| 63 | +- set\_subject($subject, \[ $utf8 \]) |
| 64 | + |
| 65 | + Sets the subject DN of the request. |
| 66 | + Note: $subject is expected to be in the format /type0=value0/type1=value1/type2=... where characters may be escaped by \\. |
| 67 | + If $utf8 is non-zero integer, $subject is interpreted as UTF-8 string. |
| 68 | + |
| 69 | +- add\_ext($nid, $extension) |
| 70 | + |
| 71 | + Adds a new extension to the request. The first argument $nid is one of the exported constants (see below). |
| 72 | + The second one $extension is a string (for more info read `openssl(3)`). |
| 73 | + |
| 74 | + ```perl |
| 75 | + $req->add_ext(Crypt::OpenSSL::PKCS10::NID_key_usage,"critical,digitalSignature,keyEncipherment"); |
| 76 | + $req->add_ext(Crypt::OpenSSL::PKCS10::NID_ext_key_usage,"serverAuth, nsSGC, msSGC, 1.3.4"); |
| 77 | + $req->add_ext(Crypt::OpenSSL::PKCS10::NID_subject_alt_name,"email:steve@openssl.org"); |
| 78 | + ``` |
| 79 | + |
| 80 | +- add\_custom\_ext($oid, $desc) |
| 81 | + |
| 82 | + Adds a new custom extension to the request. The value is added as a text string, using ASN.1 encoding rules inherited from the Netscape Comment OID. |
| 83 | + |
| 84 | + ``` |
| 85 | + $req->add_custom_ext('1.2.3.3',"My new extension"); |
| 86 | + ``` |
| 87 | + |
| 88 | +- add\_custom\_ext\_raw($oid, $bytes) |
| 89 | + |
| 90 | + Adds a new custom extension to the request. The value is added as a raw DER octet string. Use this if you are packing your own ASN.1 structures and need to set the extension value directly. |
| 91 | + |
| 92 | + ``` |
| 93 | + $req->add_custom_ext_raw($oid, pack('H*','1E06006100620063')) # BMPString 'abc' |
| 94 | + ``` |
| 95 | + |
| 96 | +- add\_ext\_final() |
| 97 | + |
| 98 | + This must be called after all extensions has been added. It actually copies the extension stack to request structure. |
| 99 | + |
| 100 | + ```perl |
| 101 | + $req->add_ext(Crypt::OpenSSL::PKCS10::NID_subject_alt_name,"email:my@email.org"); |
| 102 | + $req->add_ext_final(); |
| 103 | + ``` |
| 104 | + |
| 105 | +- sign() |
| 106 | + |
| 107 | + This adds the signature to the PKCS10 request. |
| 108 | + |
| 109 | + ``` |
| 110 | + $req->sign(); |
| 111 | + ``` |
| 112 | + |
| 113 | +- pubkey\_type() |
| 114 | + |
| 115 | + Returns the type of the PKCS10 public key - one of (rsa|dsa|ec). |
| 116 | + |
| 117 | + ``` |
| 118 | + $req->pubkey_type(); |
| 119 | + ``` |
| 120 | + |
| 121 | +- get\_pubkey() |
| 122 | + |
| 123 | + Returns the PEM encoding of the PKCS10 public key. |
| 124 | + |
| 125 | + ``` |
| 126 | + $req->get_pubkey(); |
| 127 | + ``` |
| 128 | + |
| 129 | +- get\_pem\_req() |
| 130 | + |
| 131 | + Returns the PEM encoding of the PKCS10 request. |
| 132 | + |
| 133 | + ``` |
| 134 | + $req->get_pem_req(); |
| 135 | + ``` |
| 136 | + |
| 137 | +- write\_pem\_req($filename) |
| 138 | + |
| 139 | + Writes the PEM encoding of the PKCS10 request to a given file. |
| 140 | + |
| 141 | + ``` |
| 142 | + $req->write_pem_req('request.pem'); |
| 143 | + ``` |
| 144 | + |
| 145 | +- get\_pem\_pk() |
| 146 | + |
| 147 | + Returns the PEM encoding of the private key. |
| 148 | + |
| 149 | + ``` |
| 150 | + $req->get_pem_pk(); |
| 151 | + ``` |
| 152 | + |
| 153 | +- write\_pem\_pk($filename) |
| 154 | + |
| 155 | + Writes the PEM encoding of the private key to a given file. |
| 156 | + |
| 157 | + ``` |
| 158 | + $req->write_pem_pk('request.pem'); |
| 159 | + ``` |
| 160 | + |
| 161 | +- subject() |
| 162 | + |
| 163 | + returns the subject of the PKCS10 request |
| 164 | + |
| 165 | + ```perl |
| 166 | + $subject = $req->subject(); |
| 167 | + ``` |
| 168 | + |
| 169 | +- keyinfo() |
| 170 | + |
| 171 | + returns the human readable info about the key of the PKCS10 request |
| 172 | + |
| 173 | + ``` |
| 174 | + $keyinfo = $req->keyinfo(); |
| 175 | + ``` |
| 176 | + |
| 177 | +## EXPORT |
| 178 | + |
| 179 | +None by default. |
| 180 | + |
| 181 | +On request: |
| 182 | + |
| 183 | +```perl |
| 184 | + NID_key_usage NID_subject_alt_name NID_netscape_cert_type NID_netscape_comment |
| 185 | + NID_ext_key_usage |
| 186 | +``` |
| 187 | + |
| 188 | +# BUGS |
| 189 | + |
| 190 | +If you destroy $req object that is linked to a Crypt::OpenSSL::RSA object, the RSA private key is also freed, |
| 191 | +thus you can't use latter object anymore. Avoid this: |
| 192 | +
|
| 193 | +```perl |
| 194 | +my $rsa = Crypt::OpenSSL::RSA->generate_key(512); |
| 195 | +my $req = Crypt::OpenSSL::PKCS10->new_from_rsa($rsa); |
| 196 | +undef $req; |
| 197 | +print $rsa->get_private_key_string(); |
| 198 | +``` |
| 199 | +
|
| 200 | +# SEE ALSO |
| 201 | +
|
| 202 | +`Crypt::OpenSSL::RSA`, `Crypt::OpenSSL::X509`. |
| 203 | +
|
| 204 | +# AUTHOR |
| 205 | +
|
| 206 | +JoNO, <jonozzz@yahoo.com> |
| 207 | +
|
| 208 | +# COPYRIGHT AND LICENSE |
| 209 | +
|
| 210 | +Copyright (C) 2006 by JoNO |
| 211 | +
|
| 212 | +This library is free software; you can redistribute it and/or modify |
| 213 | +it under the same terms as Perl itself, either Perl version 5.8.2 or, |
| 214 | +at your option, any later version of Perl 5 you may have available. |
0 commit comments