Xbase++ Requires Chilkat v11.0.0+
Renew a DigiCert Certificate from an EST-enabled profile

Demonstrates how to renew a certificate from an EST-enabled profile in DigiCert® Trust Lifecycle Manager. (The certificate must be within the renewal window configured in the certificate profile. The CSR must have same Subject DN values as the original certificate.)
Chilkat Xbase++ Downloads

Download Chilkat for Xbase++
Xbase++
LOCAL nSuccess
LOCAL oFortuna
LOCAL cEntropy
LOCAL oEc
LOCAL oPrivKey
LOCAL oCsr
LOCAL oBdCsr
LOCAL oHttp
LOCAL oTlsClientCert
LOCAL oBdTlsClientCertPrivKey
LOCAL oTlsClientCertPrivKey
LOCAL oResp
LOCAL cUrl
LOCAL oMyNewCert

nSuccess := 0

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  The example below duplicates the following OpenSSL commands:
//  
//  # Name of certificate as argument 1
//  
//  # Make new key
//  openssl ecparam -name prime256v1 -genkey -noout -out ${1}.key.pem
//  
//  # Make csr
//  openssl req -new -sha256 -key ${1}.key.pem -out ${1}.p10.csr -subj "/CN=${1}"
//  
//  # Request new cert
//  curl -v --cacert data/ca.pem --cert data/${1}.pem --key data/${1}.key.pem 
//      --data-binary @${1}.p10.csr -o ${1}.p7.b64 -H "Content-Type: application/pkcs10" https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll
//  
//  # Convert to PEM
//  openssl base64 -d -in ${1}.p7.b64 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${1}.pem

//  ------------------------------------------------------------------------------------------------------------------

//  Create a Fortuna PRNG and seed it with system entropy.
//  This will be our source of random data for generating the ECC private key.
oFortuna := CreateObject("Chilkat.Prng")
cEntropy := oFortuna:GetEntropy(32, "base64")
nSuccess := oFortuna:AddEntropy(cEntropy, "base64")

oEc := CreateObject("Chilkat.Ecc")

//  Generate a random EC private key on the prime256v1 curve.
oPrivKey := CreateObject("Chilkat.PrivateKey")
nSuccess := oEc:GenKey("prime256v1", oFortuna, oPrivKey)
IF (nSuccess != 1)
    ? oEc:LastErrorText
    oFortuna:destroy()
    oEc:destroy()
    oPrivKey:destroy()
    RETURN
ENDIF

//  Create the CSR object and set properties.
oCsr := CreateObject("Chilkat.Csr")

//  Specify your CN
oCsr:CommonName := "mysubdomain.mydomain.com"

//  Create the CSR using the private key.
oBdCsr := CreateObject("Chilkat.BinData")
nSuccess := oCsr:GenCsrBd(oPrivKey, oBdCsr)
IF (nSuccess == 0)
    ? oCsr:LastErrorText
    oFortuna:destroy()
    oEc:destroy()
    oPrivKey:destroy()
    oCsr:destroy()
    oBdCsr:destroy()
    RETURN
ENDIF

//  Save the private key and CSR to files.
oPrivKey:SavePkcs8EncryptedPemFile("password", "c:/temp/qa_output/ec_privkey.pem")

oBdCsr:WriteFile("c:/temp/qa_output/csr.pem")

//  ----------------------------------------------------------------------
//  Now do the CURL request to POST the CSR and get the new certificate.

oHttp := CreateObject("Chilkat.Http")

oTlsClientCert := CreateObject("Chilkat.Cert")
nSuccess := oTlsClientCert:LoadFromFile("data/myTlsClientCert.pem")
IF (nSuccess == 0)
    ? oTlsClientCert:LastErrorText
    oFortuna:destroy()
    oEc:destroy()
    oPrivKey:destroy()
    oCsr:destroy()
    oBdCsr:destroy()
    oHttp:destroy()
    oTlsClientCert:destroy()
    RETURN
ENDIF

oBdTlsClientCertPrivKey := CreateObject("Chilkat.BinData")
nSuccess := oBdTlsClientCertPrivKey:LoadFile("data/myTlsClientCert.key.pem")
IF (nSuccess == 0)
    ? "Failed to load data/myTlsClientCert.key.pem"
    oFortuna:destroy()
    oEc:destroy()
    oPrivKey:destroy()
    oCsr:destroy()
    oBdCsr:destroy()
    oHttp:destroy()
    oTlsClientCert:destroy()
    oBdTlsClientCertPrivKey:destroy()
    RETURN
ENDIF

oTlsClientCertPrivKey := CreateObject("Chilkat.PrivateKey")
nSuccess := oTlsClientCertPrivKey:LoadAnyFormat(oBdTlsClientCertPrivKey, "")
IF (nSuccess == 0)
    ? oTlsClientCertPrivKey:LastErrorText
    oFortuna:destroy()
    oEc:destroy()
    oPrivKey:destroy()
    oCsr:destroy()
    oBdCsr:destroy()
    oHttp:destroy()
    oTlsClientCert:destroy()
    oBdTlsClientCertPrivKey:destroy()
    oTlsClientCertPrivKey:destroy()
    RETURN
ENDIF

nSuccess := oTlsClientCert:SetPrivateKey(oTlsClientCertPrivKey)
IF (nSuccess == 0)
    ? oTlsClientCert:LastErrorText
    oFortuna:destroy()
    oEc:destroy()
    oPrivKey:destroy()
    oCsr:destroy()
    oBdCsr:destroy()
    oHttp:destroy()
    oTlsClientCert:destroy()
    oBdTlsClientCertPrivKey:destroy()
    oTlsClientCertPrivKey:destroy()
    RETURN
ENDIF

oHttp:SetSslClientCert(oTlsClientCert)

oHttp:RequireSslCertVerify := 1

//  The body of the HTTP request contains the binary CSR.
oResp := CreateObject("Chilkat.HttpResponse")
cUrl := "https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll"
nSuccess := oHttp:HttpBd("POST", cUrl, oBdCsr, "application/pkcs10", oResp)
IF (nSuccess == 0)
    ? oHttp:LastErrorText
    oFortuna:destroy()
    oEc:destroy()
    oPrivKey:destroy()
    oCsr:destroy()
    oBdCsr:destroy()
    oHttp:destroy()
    oTlsClientCert:destroy()
    oBdTlsClientCertPrivKey:destroy()
    oTlsClientCertPrivKey:destroy()
    oResp:destroy()
    RETURN
ENDIF

IF (oResp:StatusCode != 200)
    ? "response status code = " + Str(oResp:StatusCode)
    ? oResp:BodyStr
    ? "Failed"
    oFortuna:destroy()
    oEc:destroy()
    oPrivKey:destroy()
    oCsr:destroy()
    oBdCsr:destroy()
    oHttp:destroy()
    oTlsClientCert:destroy()
    oBdTlsClientCertPrivKey:destroy()
    oTlsClientCertPrivKey:destroy()
    oResp:destroy()
    RETURN
ENDIF

//  The response is the Base64 DER of the new certificate.
oMyNewCert := CreateObject("Chilkat.Cert")
nSuccess := oMyNewCert:LoadFromBase64(oResp:BodyStr)
IF (nSuccess == 0)
    ? oMyNewCert:LastErrorText
    ? "Cert data = " + oResp:BodyStr
    ? "Failed."
    oFortuna:destroy()
    oEc:destroy()
    oPrivKey:destroy()
    oCsr:destroy()
    oBdCsr:destroy()
    oHttp:destroy()
    oTlsClientCert:destroy()
    oBdTlsClientCertPrivKey:destroy()
    oTlsClientCertPrivKey:destroy()
    oResp:destroy()
    oMyNewCert:destroy()
    RETURN
ENDIF

nSuccess := oMyNewCert:SaveToFile("c:/temp/qa_output/myNewCert.cer")
IF (nSuccess == 0)
    ? oMyNewCert:LastErrorText
    ? "Failed."
    oFortuna:destroy()
    oEc:destroy()
    oPrivKey:destroy()
    oCsr:destroy()
    oBdCsr:destroy()
    oHttp:destroy()
    oTlsClientCert:destroy()
    oBdTlsClientCertPrivKey:destroy()
    oTlsClientCertPrivKey:destroy()
    oResp:destroy()
    oMyNewCert:destroy()
    RETURN
ENDIF

? "Success."

oFortuna:destroy()
oEc:destroy()
oPrivKey:destroy()
oCsr:destroy()
oBdCsr:destroy()
oHttp:destroy()
oTlsClientCert:destroy()
oBdTlsClientCertPrivKey:destroy()
oTlsClientCertPrivKey:destroy()
oResp:destroy()
oMyNewCert:destroy()