Rust Requires Chilkat v11.0.0+

Duplicate openssl req -newkey rsa:2048 -nodes -keyout mydomain.pem -out mydomain.csr

See more OpenSSL Examples

Demonstrates how to duplicate this OpenSSL command:

openssl req -newkey rsa:2048 -nodes -keyout mydomain.pem -out mydomain.csr

This command creates 2 files:

1. mydomain.csr: this is the file to send to DigiCert or Let's Encrypt (or any other CA)
2. mydomain.pem: this is the private key of the domain.

The second file is needed to pair with the certificate that will later be received from the CA.

Rust

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

let rsa = chilkat::Rsa::new();

// Generate a 2048-bit key.  Chilkat RSA supports
// key sizes ranging from 512 bits to 8192 bits.
let priv_key = chilkat::PrivateKey::new();
if rsa.gen_key(2048, &priv_key).is_err() {
    println!("{}", rsa.last_error_text());
    return;
}

let _ = rsa.use_private_key(&priv_key);

// Save the private key to unencrypted PKCS8 PEM
let _ = priv_key.save_pkcs8_pem_file("mydomain.pem").is_ok();

// (alternatively) Save the private key to encrypted PKCS8 PEM
let _ = priv_key.save_pkcs8_encrypted_pem_file("myPassword", "mydomain_enc.pem").is_ok();

// We'll need the private key's modulus for the CSR.
// The modulus is not something that needs to be protected.  Most people don't realize
// that a public key is actually just a subset of the private key.  The public parts of
// an RSA private key are the modulus and exponent.  The exponent is always 65537.
let priv_key_xml = chilkat::Xml::new();
let _ = priv_key_xml.load_xml(&priv_key.get_xml().unwrap_or_default()).is_ok();

// Get the modulus in base64 format:
let key_modulus = priv_key_xml.get_child_content("Modulus").unwrap_or_default();

// --------------------------------------------------------------------------------
// Now build the CSR using Chilkat's ASN.1 API.
// The keyModulus will be embedded within the ASN.1.

// A new ASN.1 object is automatically a SEQUENCE.
// Given that the CSR's root item is a SEQUENCE, we can use
// this as the root of our CSR.
let asn_root = chilkat::Asn::new();

// Beneath the root, we have a SEQUENCE (the certificate request info), 
// another SEQUENCE (the algorithm identifier), and a BITSTRING (the signature data)

let _ = asn_root.append_sequence().is_ok();
let _ = asn_root.append_sequence().is_ok();

// ----------------------------------
// Build the Certificate Request Info
// ----------------------------------
let asn_cert_req_info = asn_root.get_sub_item(0).unwrap();
let _ = asn_cert_req_info.append_int(0).is_ok();

// Build the Subject part of the Certificate Request Info
let asn_cert_subject = asn_cert_req_info.append_sequence_r().unwrap();

// Add each subject part..
let mut asn_temp = asn_cert_subject.append_set_r().unwrap();
let _ = asn_temp.append_sequence2().is_ok();
// AppendSequence2 updates the internal reference to the newly appended SEQUENCE.
// The OID and printable string are added to the SEQUENCE.
let _ = asn_temp.append_oid("2.5.4.6").is_ok();
let _ = asn_temp.append_string("printable", "US").is_ok();

asn_temp = asn_cert_subject.append_set_r().unwrap();
let _ = asn_temp.append_sequence2().is_ok();
let _ = asn_temp.append_oid("2.5.4.8").is_ok();
let _ = asn_temp.append_string("utf8", "Utah").is_ok();

asn_temp = asn_cert_subject.append_set_r().unwrap();
let _ = asn_temp.append_sequence2().is_ok();
let _ = asn_temp.append_oid("2.5.4.7").is_ok();
let _ = asn_temp.append_string("utf8", "Lindon").is_ok();

asn_temp = asn_cert_subject.append_set_r().unwrap();
let _ = asn_temp.append_sequence2().is_ok();
let _ = asn_temp.append_oid("2.5.4.10").is_ok();
let _ = asn_temp.append_string("utf8", "DigiCert Inc.").is_ok();

asn_temp = asn_cert_subject.append_set_r().unwrap();
let _ = asn_temp.append_sequence2().is_ok();
let _ = asn_temp.append_oid("2.5.4.11").is_ok();
let _ = asn_temp.append_string("utf8", "DigiCert").is_ok();

asn_temp = asn_cert_subject.append_set_r().unwrap();
let _ = asn_temp.append_sequence2().is_ok();
let _ = asn_temp.append_oid("2.5.4.3").is_ok();
let _ = asn_temp.append_string("utf8", "example.digicert.com").is_ok();

// Build the Public Key Info part of the Certificate Request Info
let asn_pub_key_info = asn_cert_req_info.append_sequence_r().unwrap();

let asn_pub_key_alg_id = asn_pub_key_info.append_sequence_r().unwrap();
let _ = asn_pub_key_alg_id.append_oid("1.2.840.113549.1.1.1").is_ok();
let _ = asn_pub_key_alg_id.append_null().is_ok();

// The public key itself is a BIT STRING, but the bit string is composed of ASN.1
// for the RSA public key.  We'll first build the RSA ASN.1 for the public key
// (containing the 2048 bit modulus and exponent), and encoded it to DER, and then add
// the DER bytes as a BIT STRING (as a sub-item of asnPubKeyInfo)

// This is already a SEQUENCE..
let asn_rsa_key = chilkat::Asn::new();

// The RSA modulus is a big integer.
let _ = asn_rsa_key.append_big_int(&key_modulus, "base64").is_ok();
let _ = asn_rsa_key.append_int(65537).is_ok();

let rsa_key_der_base64 = asn_rsa_key.get_encoded_der("base64").unwrap_or_default();

// Now add the RSA key DER as a BIT STRING.
let _ = asn_pub_key_info.append_bits(&rsa_key_der_base64, "base64").is_ok();

// The last part of the certificate request info is an empty context-specific constructed item
// with a tag equal to 0.
let _ = asn_cert_req_info.append_context_constructed(0).is_ok();

// Get the DER of the asnCertReqInfo.  
// This will be signed using the RSA private key.
let bd_der = chilkat::BinData::new();
let _ = asn_cert_req_info.write_bd(&bd_der).is_ok();

// Add the signature to the ASN.1
let bd_sig = chilkat::BinData::new();
let _ = rsa.sign_bd(&bd_der, "SHA1", &bd_sig).is_ok();
let _ = asn_root.append_bits(&bd_sig.get_encoded("base64").unwrap_or_default(), "base64").is_ok();

// ----------------------------------
// Finally, add the algorithm identifier, which is the 2nd sub-item under the root.
// ----------------------------------
let asn_alg_id = asn_root.get_sub_item(1).unwrap();
let _ = asn_alg_id.append_oid("1.2.840.113549.1.1.5").is_ok();
let _ = asn_alg_id.append_null().is_ok();

// Write the CSR to a DER encoded binary file:
if asn_root.write_binary_der("qa_output/mydomain.csr").is_err() {
    println!("{}", asn_root.last_error_text());
    return;
}

// It is also possible to get the CSR in base64 format:
let csr_base64 = asn_root.get_encoded_der("base64").unwrap_or_default();

println!("Base64 CSR:");
println!("{}", csr_base64);