Xbase++ Requires Chilkat v11.0.0+
Generate a CSR with keyUsage, extKeyUsage, and other Extensions

Demonstrates how to generate a CSR containing a 1.2.840.113549.1.9.14 extensionRequest with the following extensions:
1.3.6.1.4.1.311.20.2 enrollCerttypeExtension
2.5.29.15 keyUsage
2.5.29.37 extKeyUsage
2.5.29.14 subjectKeyIdentifier
Chilkat Xbase++ Downloads

Xbase++
LOCAL nSuccess
LOCAL oEcc
LOCAL oPrng
LOCAL oPrivKey
LOCAL oCsr
LOCAL s
LOCAL oBdTemp
LOCAL cS_base64_utf16be
LOCAL oXml
LOCAL oPubKey
LOCAL oBdPubKeyDer
LOCAL cSki
LOCAL cCsrPem

nSuccess := 0

//  This requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  This example will generate a secp256r1 ECDSA key for the CSR.
oEcc := CreateObject("Chilkat.Ecc")
oPrng := CreateObject("Chilkat.Prng")
oPrivKey := CreateObject("Chilkat.PrivateKey")
nSuccess := oEcc:GenKey("secp256r1", oPrng, oPrivKey)
IF (nSuccess == 0)
    ? "Failed to generate a new ECDSA private key."
    oEcc:destroy()
    oPrng:destroy()
    oPrivKey:destroy()
    RETURN
ENDIF

oCsr := CreateObject("Chilkat.Csr")

//  Add common CSR fields:
oCsr:CommonName := "mysubdomain.mydomain.com"
oCsr:Country := "GB"
oCsr:State := "Yorks"
oCsr:Locality := "York"
oCsr:Company := "Internet Widgits Pty Ltd"
oCsr:EmailAddress := "support@mydomain.com"

//  Add the following 1.2.840.113549.1.9.14 extensionRequest
//  Note: The easiest way to know the content and format of the XML to be added is to examine
//  a pre-existing CSR with the same desired extensionRequest.  You can use Chilkat to
//  get the extensionRequest from an existing CSR. 

//  Here is a sample extension request:

//  <?xml version="1.0" encoding="utf-8"?>
//  <set>
//      <sequence>
//          <sequence>
//              <oid>1.3.6.1.4.1.311.20.2</oid>
//              <asnOctets>
//                  <universal tag="30" constructed="0">AEUAbgBkAEUAbgB0AGkAdAB5AEMAbABpAGUAbgB0AEEAdQB0AGgAQwBlAHIAdABpAGYAaQBjAGEAdABl
//  AF8AQwBTAFIAUABhAHMAcwB0AGgAcgBvAHUAZwBoAC8AVgAx</universal>
//              </asnOctets>
//          </sequence>
//          <sequence>
//              <oid>2.5.29.15</oid>
//              <bool>1</bool>
//              <asnOctets>
//                  <bits n="3">A0</bits>
//              </asnOctets>
//          </sequence>
//          <sequence>
//              <oid>2.5.29.37</oid>
//              <asnOctets>
//                  <sequence>
//                      <oid>1.3.6.1.5.5.7.3.3</oid>
//                  </sequence>
//              </asnOctets>
//          </sequence>
//          <sequence>
//              <oid>2.5.29.14</oid>
//              <asnOctets>
//                  <octets>MCzBMQAViXBz8IDt8LsgmJxJ4Xg=</octets>
//              </asnOctets>
//          </sequence>
//      </sequence>
//  </set>

//  Use this online tool to generate code from sample XML: 
//  Generate Code to Create XML

//  A few notes:
//  The string "AEUAbgBkAEUAbgB0AGkAdAB5AEMAbABpAGUAbgB0AEEAdQB0AGgAQwBlAHIAdABpAGYAaQBjAGEAdABlAF8AQwBTAFIAUABhAHMAcwB0AGgAcgBvAHUAZwBoAC8AVgAx"
//  is the base64 encoding of the utf-16be byte representation of the string "EndEntityClientAuthCertificate_CSRPassthrough/V1"

s := "EndEntityClientAuthCertificate_CSRPassthrough/V1"
oBdTemp := CreateObject("Chilkat.BinData")
oBdTemp:AppendString(s, "utf-16be")
cS_base64_utf16be := oBdTemp:GetEncoded("base64")
//  The string should be "AEUA....."
? cS_base64_utf16be

//  Here's the code to generate the above extension request.

oXml := CreateObject("Chilkat.Xml")
oXml:Tag := "set"
oXml:UpdateChildContent("sequence|sequence|oid", "1.3.6.1.4.1.311.20.2")
oXml:UpdateAttrAt("sequence|sequence|asnOctets|universal", 1, "tag", "30")
oXml:UpdateAttrAt("sequence|sequence|asnOctets|universal", 1, "constructed", "0")
oXml:UpdateChildContent("sequence|sequence|asnOctets|universal", cS_base64_utf16be)
oXml:UpdateChildContent("sequence|sequence[1]|oid", "2.5.29.15")
oXml:UpdateChildContent("sequence|sequence[1]|bool", "1")
oXml:UpdateAttrAt("sequence|sequence[1]|asnOctets|bits", 1, "n", "3")
//  A0 is hex for decimal 160.
oXml:UpdateChildContent("sequence|sequence[1]|asnOctets|bits", "A0")
oXml:UpdateChildContent("sequence|sequence[2]|oid", "2.5.29.37")
oXml:UpdateChildContent("sequence|sequence[2]|asnOctets|sequence|oid", "1.3.6.1.5.5.7.3.3")

//  This is the subjectKeyIdentifier extension.
//  The string "MCzBMQAViXBz8IDt8LsgmJxJ4Xg=" is base64 that decodes to 20 bytes, which is a SHA1 hash.
//  This is simply a hash of the DER of the public key.

oPubKey := CreateObject("Chilkat.PublicKey")
oPrivKey:ToPublicKey(oPubKey)
oBdPubKeyDer := CreateObject("Chilkat.BinData")
oBdPubKeyDer:AppendEncoded(oPubKey:GetEncoded(1, "base64"), "base64")
cSki := oBdPubKeyDer:GetHash("sha1", "base64")

oXml:UpdateChildContent("sequence|sequence[3]|oid", "2.5.29.14")
oXml:UpdateChildContent("sequence|sequence[3]|asnOctets|octets", cSki)

//  Add the extension request to the CSR
oCsr:SetExtensionRequest(oXml)

//  Generate the CSR with the extension request
cCsrPem := oCsr:GenCsrPem(oPrivKey)
IF (oCsr:LastMethodSuccess == 0)
    ? oCsr:LastErrorText
    oEcc:destroy()
    oPrng:destroy()
    oPrivKey:destroy()
    oCsr:destroy()
    oBdTemp:destroy()
    oXml:destroy()
    oPubKey:destroy()
    oBdPubKeyDer:destroy()
    RETURN
ENDIF

? cCsrPem

oEcc:destroy()
oPrng:destroy()
oPrivKey:destroy()
oCsr:destroy()
oBdTemp:destroy()
oXml:destroy()
oPubKey:destroy()
oBdPubKeyDer:destroy()