使用Go创建证书签名请求（CSR）

我试图使用“crypto/x509”包生成CSR，但未找到将“emailAddress”字段添加到其Subject的方式。使用Go创建证书签名请求（CSR）

根据文档CertificateRequest结构有一个“EmailAddresses []字符串”字段，但它被序列化为SAN扩展。下面是测试代码，我用： http://play.golang.org/p/OtObaTyuTM

此外，我创建了使用“OpenSSL的请求”程序，并比较结果的CSR：

% openssl req -in openssl.csr -noout -text 
Certificate Request: 
    Data: 
     Version: 0 (0x0) 
     Subject: C=AU, ST=Some-State, L=MyCity, O=Company Ltd, OU=IT, CN=domain.com/[email protected] 
     Subject Public Key Info: 
      Public Key Algorithm: rsaEncryption 
       Public-Key: (512 bit) 
       Modulus: 
        00:a3:05:e3:37:63:f9:8b:d0:37:46:2d:a8:d9:26: 
        4e:be:83:1d:b9:30:88:2b:80:4b:53:cc:7c:01:86: 
        b0:9b:1d:3b:0a:05:c4:56:47:4e:5d:90:f9:5a:29: 
        8b:9a:7f:fa:4b:5e:e4:5d:dd:c6:8b:87:33:c4:b4: 
        fa:6b:b4:67:bd 
       Exponent: 65537 (0x10001) 
     Attributes: 
      a0:00 
    Signature Algorithm: sha1WithRSAEncryption 
     0b:24:6e:0a:f9:bf:23:d7:41:5f:96:da:78:d1:99:18:fb:d6: 
     71:7e:79:f0:02:e9:8a:50:a9:00:32:df:26:14:2f:f4:3e:c4: 
     22:c9:5c:4e:79:c1:c2:22:1b:2a:da:79:6f:51:ba:8a:12:63: 
     27:02:4a:b3:22:97:59:f7:6e:d6 
=============================================================== 
% openssl req -in golang.csr -noout -text 
Certificate Request: 
    Data: 
     Version: 0 (0x0) 
     Subject: C=AU, O=Company Ltd, OU=IT, L=MyCity, ST=Some-State, CN=domain.com 
     Subject Public Key Info: 
      Public Key Algorithm: rsaEncryption 
       Public-Key: (512 bit) 
       Modulus: 
        00:ac:b6:51:5b:53:44:44:20:91:da:01:45:72:49: 
        95:83:78:74:7c:05:f9:a7:77:88:02:3a:23:5f:04: 
        c3:69:45:b9:5a:bb:fd:e7:d3:24:5f:46:14:b8:7d: 
        30:ce:a0:c6:ea:e3:3b:ec:4c:75:24:cc:ce:60:1d: 
        e9:33:57:ae:21 
       Exponent: 65537 (0x10001) 
     Attributes: 
     Requested Extensions: 
      X509v3 Subject Alternative Name: 
       email:[email protected] 
    Signature Algorithm: sha256WithRSAEncryption 
     a1:c1:b7:80:a0:f0:c3:b6:44:06:f4:ad:12:3a:67:19:fa:84: 
     34:22:2a:d9:56:d9:8b:c9:a4:d0:cf:8d:a1:36:87:fa:75:b7: 
     05:40:0a:15:1f:72:61:85:a8:09:bc:f4:13:e6:24:5e:2e:b7: 
     99:e3:93:53:4e:2d:d5:0c:22:fc

在我看来，我应该建立RawSubject场自己与emainAddress OID但我没有找到任何代码示例。 UPD： 我找到了解决方案。正如我如上所述，RawSubject字段必须手动制备：

subj := pkix.Name{ 
       CommonName:   cn, 
       Country:   []string{c}, 
       Organization:  []string{o}, 
       OrganizationalUnit: []string{ou}, 
       Locality:   []string{l}, 
       Province:   []string{s}, 
} 
rawSubj := subj.ToRDNSequence() 
rawSubj = appendRDNs(rawSubj, []string{e}, oidEmailAddress) 
asn1Subj, err := asn1.Marshal(rawSubj) 
template := x509.CertificateRequest{ 
      RawSubject: asn1Subj, 
      SignatureAlgorithm: x509.SHA1WithRSA, 
}

其中：

变种oidEmailAddress = asn1.ObjectIdentifier {1，2，840，113549，1,9，1}
appendRDNs（）在crypto/x509/pkix中定义（因为它的名称不是以大写字母开头，默认情况下不会导出，您可以将其重新定义为自己的函数，副本为& paste）。

来源

2014-09-25 mephist

只要把它放在CommonName？

CommonName:   "domain.com/[email protected]",

主题：C = AU，O =有限责任公司，OU = IT，L = MyCity，ST =一些国家，CN=domain.com/[email protected]

来源

2014-09-26 01:48:17 pram

谢谢，婴儿车！ – mephist 2014-09-29 11:07:59

我检查了你的解决方案。根据openssl来源，“CN”和“emailAddress”字段有其专用的oid（分别是'2.5.4.3'和'1.2.840.113549.1.9.1'），所以只需将电子邮件附加到CommonName是错误的。 – mephist 2014-09-29 18:20:01

我知道梅弗斯回答他自己的问题，但他留下了一些东西拼凑在一起。因此，为了完整的缘故（因为我已经在这里两次降落在过去的2年... ...）这是一个完整的工作示例：https://play.golang.org/p/YL_qfPe4Zz

package main 

import (
    "crypto/rand" 
    "crypto/rsa" 
    "crypto/x509" 
    "crypto/x509/pkix" 
    "encoding/asn1" 
    "encoding/pem" 
    "os" 
) 

var oidEmailAddress = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 1} 

func main() { 
    keyBytes, _ := rsa.GenerateKey(rand.Reader, 1024) 

    emailAddress := "[email protected]" 
    subj := pkix.Name{ 
     CommonName:   "example.com", 
     Country:   []string{"AU"}, 
     Province:   []string{"Some-State"}, 
     Locality:   []string{"MyCity"}, 
     Organization:  []string{"Company Ltd"}, 
     OrganizationalUnit: []string{"IT"}, 
    } 
    rawSubj := subj.ToRDNSequence() 
    rawSubj = append(rawSubj, []pkix.AttributeTypeAndValue{ 
     {Type: oidEmailAddress, Value: emailAddress}, 
    }) 

    asn1Subj, _ := asn1.Marshal(rawSubj) 
    template := x509.CertificateRequest{ 
     RawSubject:   asn1Subj, 
     EmailAddresses:  []string{emailAddress}, 
     SignatureAlgorithm: x509.SHA256WithRSA, 
    } 

    csrBytes, _ := x509.CreateCertificateRequest(rand.Reader, &template, keyBytes) 
    pem.Encode(os.Stdout, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrBytes}) 

}

来源

2016-08-02 01:36:40

使用Go创建证书签名请求（CSR）

回答

相关问题