(AutoIt) Generate a CSR with keyUsage, extKeyUsage, and other Extensions

See more CSR Examples

Demonstrates how to generate a CSR containing a 1.2.840.113549.1.9.14 extensionRequest with the following extensions:

• 1.3.6.1.4.1.311.20.2 enrollCerttypeExtension
• 2.5.29.15 keyUsage
• 2.5.29.37 extKeyUsage
• 2.5.29.14 subjectKeyIdentifier

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

; This requires the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

; This example will generate a secp256r1 ECDSA key for the CSR.
$oEcc = ObjCreate("Chilkat.Ecc")
$oPrng = ObjCreate("Chilkat.Prng")

Local $oPrivKey = $oEcc.GenEccKey("secp256r1",$oPrng)
If ($oEcc.LastMethodSuccess = False) Then
    ConsoleWrite("Failed to generate a new ECDSA private key." & @CRLF)
    Exit
EndIf

$oCsr = ObjCreate("Chilkat.Csr")

; Add common CSR fields:
$oCsr.CommonName = "mysubdomain.mydomain.com"
$oCsr.Country = "GB"
$oCsr.State = "Yorks"
$oCsr.Locality = "York"
$oCsr.Company = "Internet Widgits Pty Ltd"
$oCsr.EmailAddress = "support@mydomain.com"

; Add the following 1.2.840.113549.1.9.14 extensionRequest
; Note: The easiest way to know the content and format of the XML to be added is to examine
; a pre-existing CSR with the same desired extensionRequest.  You can use Chilkat to
; get the extensionRequest from an existing CSR. 

; 
; Here is a sample extension request:

; <?xml version="1.0" encoding="utf-8"?>
; <set>
;     <sequence>
;         <sequence>
;             <oid>1.3.6.1.4.1.311.20.2</oid>
;             <asnOctets>
;                 <universal tag="30" constructed="0">AEUAbgBkAEUAbgB0AGkAdAB5AEMAbABpAGUAbgB0AEEAdQB0AGgAQwBlAHIAdABpAGYAaQBjAGEAdABl
; AF8AQwBTAFIAUABhAHMAcwB0AGgAcgBvAHUAZwBoAC8AVgAx</universal>
;             </asnOctets>
;         </sequence>
;         <sequence>
;             <oid>2.5.29.15</oid>
;             <bool>1</bool>
;             <asnOctets>
;                 <bits n="3">A0</bits>
;             </asnOctets>
;         </sequence>
;         <sequence>
;             <oid>2.5.29.37</oid>
;             <asnOctets>
;                 <sequence>
;                     <oid>1.3.6.1.5.5.7.3.3</oid>
;                 </sequence>
;             </asnOctets>
;         </sequence>
;         <sequence>
;             <oid>2.5.29.14</oid>
;             <asnOctets>
;                 <octets>MCzBMQAViXBz8IDt8LsgmJxJ4Xg=</octets>
;             </asnOctets>
;         </sequence>
;     </sequence>
; </set>

; Use this online tool to generate code from sample XML: 
; Generate Code to Create XML

; A few notes:
; The string "AEUAbgBkAEUAbgB0AGkAdAB5AEMAbABpAGUAbgB0AEEAdQB0AGgAQwBlAHIAdABpAGYAaQBjAGEAdABlAF8AQwBTAFIAUABhAHMAcwB0AGgAcgBvAHUAZwBoAC8AVgAx"
; is the base64 encoding of the utf-16be byte representation of the string "EndEntityClientAuthCertificate_CSRPassthrough/V1"

Local $s = "EndEntityClientAuthCertificate_CSRPassthrough/V1"
$oBdTemp = ObjCreate("Chilkat.BinData")
$oBdTemp.AppendString($s,"utf-16be")
Local $s_base64_utf16be = $oBdTemp.GetEncoded("base64")
; The string should be "AEUA....."
ConsoleWrite($s_base64_utf16be & @CRLF)

; Here's the code to generate the above extension request.

$oXml = ObjCreate("Chilkat.Xml")
$oXml.Tag = "set"
$oXml.UpdateChildContent "sequence|sequence|oid","1.3.6.1.4.1.311.20.2"
$oXml.UpdateAttrAt("sequence|sequence|asnOctets|universal",True,"tag","30")
$oXml.UpdateAttrAt("sequence|sequence|asnOctets|universal",True,"constructed","0")
$oXml.UpdateChildContent "sequence|sequence|asnOctets|universal",$s_base64_utf16be
$oXml.UpdateChildContent "sequence|sequence[1]|oid","2.5.29.15"
$oXml.UpdateChildContent "sequence|sequence[1]|bool","1"
$oXml.UpdateAttrAt("sequence|sequence[1]|asnOctets|bits",True,"n","3")
; A0 is hex for decimal 160.
$oXml.UpdateChildContent "sequence|sequence[1]|asnOctets|bits","A0"
$oXml.UpdateChildContent "sequence|sequence[2]|oid","2.5.29.37"
$oXml.UpdateChildContent "sequence|sequence[2]|asnOctets|sequence|oid","1.3.6.1.5.5.7.3.3"

; This is the subjectKeyIdentifier extension.
; The string "MCzBMQAViXBz8IDt8LsgmJxJ4Xg=" is base64 that decodes to 20 bytes, which is a SHA1 hash.
; This is simply a hash of the DER of the public key.

Local $oPubKey = $oPrivKey.GetPublicKey()
$oBdPubKeyDer = ObjCreate("Chilkat.BinData")
$oBdPubKeyDer.AppendEncoded($oPubKey.GetEncoded(True,"base64"),"base64")
Local $ski = $oBdPubKeyDer.GetHash("sha1","base64")

$oXml.UpdateChildContent "sequence|sequence[3]|oid","2.5.29.14"
$oXml.UpdateChildContent "sequence|sequence[3]|asnOctets|octets",$ski

; Add the extension request to the CSR
$oCsr.SetExtensionRequest($oXml)

; Generate the CSR with the extension request
Local $sCsrPem = $oCsr.GenCsrPem($oPrivKey)
If ($oCsr.LastMethodSuccess = False) Then
    ConsoleWrite($oCsr.LastErrorText & @CRLF)

    Exit
EndIf

ConsoleWrite($sCsrPem & @CRLF)