Zig Requires Chilkat v11.0.0+

Duplicate openssl req -newkey rsa:2048 -nodes -keyout mydomain.pem -out mydomain.csr

See more OpenSSL Examples

Demonstrates how to duplicate this OpenSSL command:

openssl req -newkey rsa:2048 -nodes -keyout mydomain.pem -out mydomain.csr

This command creates 2 files:

1. mydomain.csr: this is the file to send to DigiCert or Let's Encrypt (or any other CA)
2. mydomain.pem: this is the private key of the domain.

The second file is needed to pair with the certificate that will later be received from the CA.

Zig

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    const rsa = try chilkat.Rsa.init();
    defer rsa.deinit();

    // Generate a 2048-bit key.  Chilkat RSA supports
    // key sizes ranging from 512 bits to 8192 bits.
    const priv_key = try chilkat.PrivateKey.init();
    defer priv_key.deinit();
    rsa.genKey(2048, priv_key) catch {
        std.debug.print("{s}\n", .{try rsa.getLastErrorText(alloc)});
        return;
    };

    rsa.usePrivateKey(priv_key) catch {};

    // Save the private key to unencrypted PKCS8 PEM
    try priv_key.savePkcs8PemFile("mydomain.pem");

    // (alternatively) Save the private key to encrypted PKCS8 PEM
    try priv_key.savePkcs8EncryptedPemFile("myPassword", "mydomain_enc.pem");

    // We'll need the private key's modulus for the CSR.
    // The modulus is not something that needs to be protected.  Most people don't realize
    // that a public key is actually just a subset of the private key.  The public parts of
    // an RSA private key are the modulus and exponent.  The exponent is always 65537.
    const priv_key_xml = try chilkat.Xml.init();
    defer priv_key_xml.deinit();
    try priv_key_xml.loadXml(try priv_key.getXml(alloc));

    // Get the modulus in base64 format:
    const key_modulus = try priv_key_xml.getChildContent(alloc, "Modulus");

    // --------------------------------------------------------------------------------
    // Now build the CSR using Chilkat's ASN.1 API.
    // The keyModulus will be embedded within the ASN.1.

    // A new ASN.1 object is automatically a SEQUENCE.
    // Given that the CSR's root item is a SEQUENCE, we can use
    // this as the root of our CSR.
    const asn_root = try chilkat.Asn.init();
    defer asn_root.deinit();

    // Beneath the root, we have a SEQUENCE (the certificate request info),
    // another SEQUENCE (the algorithm identifier), and a BITSTRING (the signature data)

    try asn_root.appendSequence();
    try asn_root.appendSequence();

    // ----------------------------------
    // Build the Certificate Request Info
    // ----------------------------------
    const asn_cert_req_info = try asn_root.getSubItem(0);
    defer asn_cert_req_info.deinit();
    try asn_cert_req_info.appendInt(0);

    // Build the Subject part of the Certificate Request Info
    const asn_cert_subject = try asn_cert_req_info.appendSequenceR();
    defer asn_cert_subject.deinit();

    // Add each subject part..
    var asn_temp: chilkat.Asn = try asn_cert_subject.appendSetR();
    defer asn_temp.deinit();
    try asn_temp.appendSequence2();
    // AppendSequence2 updates the internal reference to the newly appended SEQUENCE.
    // The OID and printable string are added to the SEQUENCE.
    try asn_temp.appendOid("2.5.4.6");
    try asn_temp.appendString("printable", "US");

    {
        const next = try asn_cert_subject.appendSetR();
        asn_temp.deinit();
        asn_temp = next;
    }
    try asn_temp.appendSequence2();
    try asn_temp.appendOid("2.5.4.8");
    try asn_temp.appendString("utf8", "Utah");

    {
        const next = try asn_cert_subject.appendSetR();
        asn_temp.deinit();
        asn_temp = next;
    }
    try asn_temp.appendSequence2();
    try asn_temp.appendOid("2.5.4.7");
    try asn_temp.appendString("utf8", "Lindon");

    {
        const next = try asn_cert_subject.appendSetR();
        asn_temp.deinit();
        asn_temp = next;
    }
    try asn_temp.appendSequence2();
    try asn_temp.appendOid("2.5.4.10");
    try asn_temp.appendString("utf8", "DigiCert Inc.");

    {
        const next = try asn_cert_subject.appendSetR();
        asn_temp.deinit();
        asn_temp = next;
    }
    try asn_temp.appendSequence2();
    try asn_temp.appendOid("2.5.4.11");
    try asn_temp.appendString("utf8", "DigiCert");

    {
        const next = try asn_cert_subject.appendSetR();
        asn_temp.deinit();
        asn_temp = next;
    }
    try asn_temp.appendSequence2();
    try asn_temp.appendOid("2.5.4.3");
    try asn_temp.appendString("utf8", "example.digicert.com");

    // Build the Public Key Info part of the Certificate Request Info
    const asn_pub_key_info = try asn_cert_req_info.appendSequenceR();
    defer asn_pub_key_info.deinit();

    const asn_pub_key_alg_id = try asn_pub_key_info.appendSequenceR();
    defer asn_pub_key_alg_id.deinit();
    try asn_pub_key_alg_id.appendOid("1.2.840.113549.1.1.1");
    try asn_pub_key_alg_id.appendNull();

    // The public key itself is a BIT STRING, but the bit string is composed of ASN.1
    // for the RSA public key.  We'll first build the RSA ASN.1 for the public key
    // (containing the 2048 bit modulus and exponent), and encoded it to DER, and then add
    // the DER bytes as a BIT STRING (as a sub-item of asnPubKeyInfo)

    // This is already a SEQUENCE..
    const asn_rsa_key = try chilkat.Asn.init();
    defer asn_rsa_key.deinit();

    // The RSA modulus is a big integer.
    try asn_rsa_key.appendBigInt(key_modulus, "base64");
    try asn_rsa_key.appendInt(65537);

    const rsa_key_der_base64 = try asn_rsa_key.getEncodedDer(alloc, "base64");

    // Now add the RSA key DER as a BIT STRING.
    try asn_pub_key_info.appendBits(rsa_key_der_base64, "base64");

    // The last part of the certificate request info is an empty context-specific constructed item
    // with a tag equal to 0.
    try asn_cert_req_info.appendContextConstructed(0);

    // Get the DER of the asnCertReqInfo.
    // This will be signed using the RSA private key.
    const bd_der = try chilkat.BinData.init();
    defer bd_der.deinit();
    try asn_cert_req_info.writeBd(bd_der);

    // Add the signature to the ASN.1
    const bd_sig = try chilkat.BinData.init();
    defer bd_sig.deinit();
    try rsa.signBd(bd_der, "SHA1", bd_sig);
    try asn_root.appendBits(try bd_sig.getEncoded(alloc, "base64"), "base64");

    // ----------------------------------
    // Finally, add the algorithm identifier, which is the 2nd sub-item under the root.
    // ----------------------------------
    const asn_alg_id = try asn_root.getSubItem(1);
    defer asn_alg_id.deinit();
    try asn_alg_id.appendOid("1.2.840.113549.1.1.5");
    try asn_alg_id.appendNull();

    // Write the CSR to a DER encoded binary file:
    asn_root.writeBinaryDer("qa_output/mydomain.csr") catch {
        std.debug.print("{s}\n", .{try asn_root.getLastErrorText(alloc)});
        return;
    };

    // It is also possible to get the CSR in base64 format:
    const csr_base64 = try asn_root.getEncodedDer(alloc, "base64");

    std.debug.print("Base64 CSR:\n", .{});
    std.debug.print("{s}\n", .{csr_base64});
}