Rust Requires Chilkat v11.0.0+

Renew a DigiCert Certificate from an EST-enabled profile

See more Certificates Examples

Demonstrates how to renew a certificate from an EST-enabled profile in DigiCert​​®​​ Trust Lifecycle Manager. (The certificate must be within the renewal window configured in the certificate profile. The CSR must have same Subject DN values as the original certificate.) Rust

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The example below duplicates the following OpenSSL commands:
// 
// # Name of certificate as argument 1
// 
// # Make new key
// openssl ecparam -name prime256v1 -genkey -noout -out ${1}.key.pem
// 
// # Make csr
// openssl req -new -sha256 -key ${1}.key.pem -out ${1}.p10.csr -subj "/CN=${1}"
// 
// # Request new cert
// curl -v --cacert data/ca.pem --cert data/${1}.pem --key data/${1}.key.pem 
//     --data-binary @${1}.p10.csr -o ${1}.p7.b64 -H "Content-Type: application/pkcs10" https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll
// 
// # Convert to PEM
// openssl base64 -d -in ${1}.p7.b64 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${1}.pem

// ------------------------------------------------------------------------------------------------------------------

// Create a Fortuna PRNG and seed it with system entropy.
// This will be our source of random data for generating the ECC private key.
let fortuna = chilkat::Prng::new();
let entropy = fortuna.get_entropy(32, "base64").unwrap_or_default();
let _ = fortuna.add_entropy(&entropy, "base64").is_ok();

let ec = chilkat::Ecc::new();

// Generate a random EC private key on the prime256v1 curve.
let priv_key = chilkat::PrivateKey::new();
if ec.gen_key("prime256v1", &fortuna, &priv_key).is_err() {
    println!("{}", ec.last_error_text());
    return;
}

// Create the CSR object and set properties.
let csr = chilkat::Csr::new();

// Specify your CN
csr.set_common_name("mysubdomain.mydomain.com");

// Create the CSR using the private key.
let bd_csr = chilkat::BinData::new();
if csr.gen_csr_bd(&priv_key, &bd_csr).is_err() {
    println!("{}", csr.last_error_text());
    return;
}

// Save the private key and CSR to files.
let _ = priv_key.save_pkcs8_encrypted_pem_file("password", "c:/temp/qa_output/ec_privkey.pem");

let _ = bd_csr.write_file("c:/temp/qa_output/csr.pem");

// ----------------------------------------------------------------------
// Now do the CURL request to POST the CSR and get the new certificate.

let http = chilkat::Http::new();

let tls_client_cert = chilkat::Cert::new();
if tls_client_cert.load_from_file("data/myTlsClientCert.pem").is_err() {
    println!("{}", tls_client_cert.last_error_text());
    return;
}

let bd_tls_client_cert_priv_key = chilkat::BinData::new();
if bd_tls_client_cert_priv_key.load_file("data/myTlsClientCert.key.pem").is_err() {
    println!("Failed to load data/myTlsClientCert.key.pem");
    return;
}

let tls_client_cert_priv_key = chilkat::PrivateKey::new();
if tls_client_cert_priv_key.load_any_format(&bd_tls_client_cert_priv_key, "").is_err() {
    println!("{}", tls_client_cert_priv_key.last_error_text());
    return;
}

if tls_client_cert.set_private_key(&tls_client_cert_priv_key).is_err() {
    println!("{}", tls_client_cert.last_error_text());
    return;
}

let _ = http.set_ssl_client_cert(&tls_client_cert);

http.set_require_ssl_cert_verify(true);

// The body of the HTTP request contains the binary CSR.
let resp = chilkat::HttpResponse::new();
let url = "https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll".to_string();
if http.http_bd("POST", &url, &bd_csr, "application/pkcs10", &resp).is_err() {
    println!("{}", http.last_error_text());
    return;
}

if resp.status_code() != 200 {
    println!("response status code = {}", resp.status_code());
    println!("{}", resp.body_str());
    println!("Failed");
    return;
}

// The response is the Base64 DER of the new certificate.
let my_new_cert = chilkat::Cert::new();
if my_new_cert.load_from_base64(&resp.body_str()).is_err() {
    println!("{}", my_new_cert.last_error_text());
    println!("Cert data = {}", resp.body_str());
    println!("Failed.");
    return;
}

if my_new_cert.save_to_file("c:/temp/qa_output/myNewCert.cer").is_err() {
    println!("{}", my_new_cert.last_error_text());
    println!("Failed.");
    return;
}

println!("Success.");