(JavaScript) Renew a DigiCert Certificate from an EST-enabled profile

Demonstrates how to renew a certificate from an EST-enabled profile in DigiCert​​®​​ Trust Lifecycle Manager. (The certificate must be within the renewal window configured in the certificate profile. The CSR must have same Subject DN values as the original certificate.)

Note: This example requires Chilkat v11.0.0 or greater.

Note

This example is intended for running within a Chilkat.Js embedded JavaScript engine. All Chilkat JavaScript examples require Chilkat v11.4.0 or greater.

var success = false;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The example below duplicates the following OpenSSL commands:
// 
// # Name of certificate as argument 1
// 
// # Make new key
// openssl ecparam -name prime256v1 -genkey -noout -out ${1}.key.pem
// 
// # Make csr
// openssl req -new -sha256 -key ${1}.key.pem -out ${1}.p10.csr -subj "/CN=${1}"
// 
// # Request new cert
// curl -v --cacert data/ca.pem --cert data/${1}.pem --key data/${1}.key.pem 
//     --data-binary @${1}.p10.csr -o ${1}.p7.b64 -H "Content-Type: application/pkcs10" https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll
// 
// # Convert to PEM
// openssl base64 -d -in ${1}.p7.b64 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${1}.pem

// ------------------------------------------------------------------------------------------------------------------

// Create a Fortuna PRNG and seed it with system entropy.
// This will be our source of random data for generating the ECC private key.
var fortuna = new CkPrng();
var entropy = fortuna.GetEntropy(32,"base64");
success = fortuna.AddEntropy(entropy,"base64");

var ec = new CkEcc();

// Generate a random EC private key on the prime256v1 curve.
var privKey = new CkPrivateKey();
success = ec.GenKey("prime256v1",fortuna,privKey);
if (success !== true) {
    console.log(ec.LastErrorText);
    return;
}

// Create the CSR object and set properties.
var csr = new CkCsr();

// Specify your CN
csr.CommonName = "mysubdomain.mydomain.com";

// Create the CSR using the private key.
var bdCsr = new CkBinData();
success = csr.GenCsrBd(privKey,bdCsr);
if (success == false) {
    console.log(csr.LastErrorText);
    return;
}

// Save the private key and CSR to files.
privKey.SavePkcs8EncryptedPemFile("password","c:/temp/qa_output/ec_privkey.pem");

bdCsr.WriteFile("c:/temp/qa_output/csr.pem");

// ----------------------------------------------------------------------
// Now do the CURL request to POST the CSR and get the new certificate.

var http = new CkHttp();

var tlsClientCert = new CkCert();
success = tlsClientCert.LoadFromFile("data/myTlsClientCert.pem");
if (success == false) {
    console.log(tlsClientCert.LastErrorText);
    return;
}

var bdTlsClientCertPrivKey = new CkBinData();
success = bdTlsClientCertPrivKey.LoadFile("data/myTlsClientCert.key.pem");
if (success == false) {
    console.log("Failed to load data/myTlsClientCert.key.pem");
    return;
}

var tlsClientCertPrivKey = new CkPrivateKey();
success = tlsClientCertPrivKey.LoadAnyFormat(bdTlsClientCertPrivKey,"");
if (success == false) {
    console.log(tlsClientCertPrivKey.LastErrorText);
    return;
}

success = tlsClientCert.SetPrivateKey(tlsClientCertPrivKey);
if (success == false) {
    console.log(tlsClientCert.LastErrorText);
    return;
}

http.SetSslClientCert(tlsClientCert);

http.RequireSslCertVerify = true;

// The body of the HTTP request contains the binary CSR.
var resp = new CkHttpResponse();
var url = "https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll";
success = http.HttpBd("POST",url,bdCsr,"application/pkcs10",resp);
if (success == false) {
    console.log(http.LastErrorText);
    return;
}

if (resp.StatusCode !== 200) {
    console.log("response status code = " + resp.StatusCode);
    console.log(resp.BodyStr);
    console.log("Failed");
    return;
}

// The response is the Base64 DER of the new certificate.
var myNewCert = new CkCert();
success = myNewCert.LoadFromBase64(resp.BodyStr);
if (success == false) {
    console.log(myNewCert.LastErrorText);
    console.log("Cert data = " + resp.BodyStr);
    console.log("Failed.");
    return;
}

success = myNewCert.SaveToFile("c:/temp/qa_output/myNewCert.cer");
if (success == false) {
    console.log(myNewCert.LastErrorText);
    console.log("Failed.");
    return;
}

console.log("Success.");