github.com/mholt/acmez/v3 v3.1.2: OrderParametersFromCSR

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/mholt/acmez/v3.OrderParametersFromCSR in pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Demonstrate these symbols/APIs:
  - github.com/mholt/acmez/v3.OrderParametersFromCSR
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:2c5fe15c1c236b4688518db12c2421884cb5cc333ccc2b398582bf54da17a264","contract":["acmez.OrderParametersFromCSR maps DNS names, IP addresses, and email SANs from CertificateRequest into matching ACME Identifiers","acmez.OrderParametersFromCSR handles direct x509.CertificateRequest with DNSNames and IPAddresses without requiring Subject.CommonName","acmez.OrderParametersFromCSR rejects CSRs containing only Subject.CommonName without SANs with a no subjects found error","acmez.OrderParametersFromCSR rejects empty CSRs containing no SAN identifiers with a no subjects found error"],"goal":"verify github.com/mholt/acmez/v3.OrderParametersFromCSR in pkg:golang/github.com/mholt/acmez/v3@v3.1.2","kind":"HOW","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"symbols":["github.com/mholt/acmez/v3.OrderParametersFromCSR"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"subject":"pkg:golang/github.com/mholt/acmez/v3@v3.1.2","symbols":["github.com/mholt/acmez/v3.OrderParametersFromCSR"],"verifierAdapter":"golang@1"}

module sample-acmez

go 1.22

require github.com/mholt/acmez/v3 v3.1.2

require (
	golang.org/x/crypto v0.27.0 // indirect
	golang.org/x/net v0.29.0 // indirect
	golang.org/x/text v0.18.0 // indirect
)

github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"fmt"
	"log"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

func main() {
	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		log.Fatalf("failed to generate private key: %v", err)
	}

	csr, err := acmez.NewCSR(privKey, []string{"example.com", "192.0.2.1"})
	if err != nil {
		log.Fatalf("failed to create CSR: %v", err)
	}

	account := acme.Account{
		PrivateKey: privKey,
		Location:   "https://example.com/acme/acct/1",
		Status:     acme.StatusValid,
	}

	orderParams, err := acmez.OrderParametersFromCSR(account, csr)
	if err != nil {
		log.Fatalf("failed to extract order parameters: %v", err)
	}

	fmt.Printf("Order contains %d identifiers\n", len(orderParams.Identifiers))
	for _, id := range orderParams.Identifiers {
		fmt.Printf(" - %s: %s\n", id.Type, id.Value)
	}
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/mholt/acmez/v3.OrderParametersFromCSR in pkg:golang/github.com/mholt/acmez/v3@v3.1.2",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/mholt/acmez/v3@v3.1.2"
  ],
  "symbols": [
    "github.com/mholt/acmez/v3.OrderParametersFromCSR"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"net"
	"os"
	"strings"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

func main() {
	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: key generation error: %v\n", err)
		os.Exit(1)
	}

	account := acme.Account{
		PrivateKey: privKey,
		Location:   "https://example.com/acme/acct/1",
		Status:     acme.StatusValid,
	}

	// 1. OrderParametersFromCSR maps DNSNames, IPAddresses, and EmailAddresses SANs into ACME Identifiers
	sans := []string{"example.com", "sub.example.com", "192.0.2.1", "2001:db8::1", "admin@example.com"}
	csr, err := acmez.NewCSR(privKey, sans)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: NewCSR failed: %v\n", err)
		os.Exit(1)
	}

	orderParams, err := acmez.OrderParametersFromCSR(account, csr)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: OrderParametersFromCSR failed on SAN CSR: %v\n", err)
		os.Exit(1)
	}

	if len(orderParams.Identifiers) != 5 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 5 identifiers, got %d: %+v\n", len(orderParams.Identifiers), orderParams.Identifiers)
		os.Exit(1)
	}

	expected := []acme.Identifier{
		{Type: "dns", Value: "example.com"},
		{Type: "dns", Value: "sub.example.com"},
		{Type: "ip", Value: "192.0.2.1"},
		{Type: "ip", Value: "2001:db8::1"},
		{Type: "email", Value: "admin@example.com"},
	}

	for i, exp := range expected {
		if orderParams.Identifiers[i].Type != exp.Type || orderParams.Identifiers[i].Value != exp.Value {
			fmt.Fprintf(os.Stderr, "FAIL: identifier[%d] mismatch: expected %+v, got %+v\n", i, exp, orderParams.Identifiers[i])
			os.Exit(1)
		}
	}

	// 2. OrderParametersFromCSR handles direct x509.CertificateRequest with DNSNames and IPAddresses
	directCSRTemplate := &x509.CertificateRequest{
		DNSNames:    []string{"api.example.com"},
		IPAddresses: []net.IP{net.ParseIP("10.0.0.1"), net.ParseIP("127.0.0.1")},
	}
	directCSRDER, err := x509.CreateCertificateRequest(rand.Reader, directCSRTemplate, privKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CreateCertificateRequest failed: %v\n", err)
		os.Exit(1)
	}
	directCSR, err := x509.ParseCertificateRequest(directCSRDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseCertificateRequest direct failed: %v\n", err)
		os.Exit(1)
	}

	directParams, err := acmez.OrderParametersFromCSR(account, directCSR)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: OrderParametersFromCSR failed for direct CSR: %v\n", err)
		os.Exit(1)
	}
	if len(directParams.Identifiers) != 3 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 3 identifiers (1 DNS + 2 IP), got %d: %+v\n", len(directParams.Identifiers), directParams.Identifiers)
		os.Exit(1)
	}
	if directParams.Identifiers[0].Type != "dns" || directParams.Identifiers[0].Value != "api.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: expected api.example.com dns identifier, got %+v\n", directParams.Identifiers[0])
		os.Exit(1)
	}
	if directParams.Identifiers[1].Type != "ip" || directParams.Identifiers[1].Value != "10.0.0.1" {
		fmt.Fprintf(os.Stderr, "FAIL: expected 10.0.0.1 ip identifier, got %+v\n", directParams.Identifiers[1])
		os.Exit(1)
	}
	if directParams.Identifiers[2].Type != "ip" || directParams.Identifiers[2].Value != "127.0.0.1" {
		fmt.Fprintf(os.Stderr, "FAIL: expected 127.0.0.1 ip identifier, got %+v\n", directParams.Identifiers[2])
		os.Exit(1)
	}

	// 3. OrderParametersFromCSR rejects CSRs having only CommonName without SANs with error containing "no subjects"
	cnCSRTemplate := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName: "app.example.com",
		},
	}
	cnCSRDER, err := x509.CreateCertificateRequest(rand.Reader, cnCSRTemplate, privKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CreateCertificateRequest CN failed: %v\n", err)
		os.Exit(1)
	}
	cnCSR, err := x509.ParseCertificateRequest(cnCSRDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseCertificateRequest CN failed: %v\n", err)
		os.Exit(1)
	}

	_, cnErr := acmez.OrderParametersFromCSR(account, cnCSR)
	if cnErr == nil || !strings.Contains(cnErr.Error(), "no subjects") {
		fmt.Fprintf(os.Stderr, "FAIL: expected 'no subjects' error for CN-only CSR, got: %v\n", cnErr)
		os.Exit(1)
	}

	// 4. OrderParametersFromCSR returns error for empty CSR without SANs
	emptyCSRTemplate := &x509.CertificateRequest{}
	emptyCSRDER, err := x509.CreateCertificateRequest(rand.Reader, emptyCSRTemplate, privKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CreateCertificateRequest empty failed: %v\n", err)
		os.Exit(1)
	}
	emptyCSR, err := x509.ParseCertificateRequest(emptyCSRDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseCertificateRequest empty failed: %v\n", err)
		os.Exit(1)
	}

	_, emptyErr := acmez.OrderParametersFromCSR(account, emptyCSR)
	if emptyErr == nil || !strings.Contains(emptyErr.Error(), "no subjects") {
		fmt.Fprintf(os.Stderr, "FAIL: expected 'no subjects' error for empty CSR, got: %v\n", emptyErr)
		os.Exit(1)
	}

	fmt.Println("PASS: github.com/mholt/acmez/v3.OrderParametersFromCSR contract passed")
}