github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: CertRep

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep.CertRep in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep.CertRep

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:116ec17ad60069129e5f721205f52ebcdda9d8f0893491afac58f4ba66e5444f","contract":["scep.CertRep is a MessageType constant with string value '3' representing SCEP certificate response PKI messages.","PKIMessage.Success creates a SCEP CertRep response message with MessageType CertRep, PKIStatus SUCCESS, and recipient nonce matching sender nonce.","ParsePKIMessage parses DER-encoded CertRep response messages recovering MessageType CertRep and PKIStatus SUCCESS.","PKIMessage.DecryptPKIEnvelope recovers the issued X.509 certificate from an enveloped SCEP CertRep response.","PKIMessage.Fail creates a SCEP CertRep response message with MessageType CertRep, PKIStatus FAILURE, and the specified FailInfo attribute.","ParsePKIMessage parses DER-encoded failure CertRep messages preserving MessageType CertRep, PKIStatus FAILURE, and FailInfo attributes."],"goal":"verify github.com/smallstep/scep.CertRep in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep.CertRep"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep.CertRep"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require (
	github.com/go-kit/kit v0.4.0 // indirect
	github.com/go-logfmt/logfmt v0.5.1 // indirect
	github.com/go-stack/stack v1.6.0 // indirect
	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
	github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d // indirect
)

github.com/go-kit/kit v0.4.0 h1:KeVK+Emj3c3S4eRztFuzbFYb2BAgf2jmwDwyXEri7Lo=
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/scep"
)

func generateCA() (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}
	tmpl := &x509.Certificate{
		SerialNumber:          big.NewInt(1),
		Subject:               pkix.Name{CommonName: "SCEP CA"},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}
	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, err
	}
	cert, err := x509.ParseCertificate(der)
	return cert, key, err
}

func generateClient() (*x509.Certificate, *rsa.PrivateKey, *x509.CertificateRequest, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, nil, err
	}
	tmpl := &x509.Certificate{
		SerialNumber:          big.NewInt(2),
		Subject:               pkix.Name{CommonName: "client-device"},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
	}
	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, nil, err
	}

	csrTmpl := &x509.CertificateRequest{
		Subject: pkix.Name{CommonName: "device.example.com"},
	}
	csrDER, err := x509.CreateCertificateRequest(rand.Reader, csrTmpl, key)
	if err != nil {
		return nil, nil, nil, err
	}
	csr, err := x509.ParseCertificateRequest(csrDER)
	return cert, key, csr, err
}

func main() {
	caCert, caKey, err := generateCA()
	if err != nil {
		fmt.Printf("CA error: %v\n", err)
		return
	}

	clientCert, clientKey, csr, err := generateClient()
	if err != nil {
		fmt.Printf("Client error: %v\n", err)
		return
	}

	// 1. Client creates SCEP PKCSReq
	reqTmpl := &scep.PKIMessage{
		MessageType: scep.PKCSReq,
		SignerCert:  clientCert,
		SignerKey:   clientKey,
		Recipients:  []*x509.Certificate{caCert},
	}
	reqMsg, err := scep.NewCSRRequest(csr, reqTmpl)
	if err != nil {
		fmt.Printf("NewCSRRequest error: %v\n", err)
		return
	}

	// 2. CA parses incoming SCEP request
	caReq, err := scep.ParsePKIMessage(reqMsg.Raw)
	if err != nil {
		fmt.Printf("CA ParsePKIMessage error: %v\n", err)
		return
	}
	if err := caReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
		fmt.Printf("CA DecryptPKIEnvelope error: %v\n", err)
		return
	}

	// 3. CA issues certificate and creates SCEP CertRep response
	issuedTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(3),
		Subject:      caReq.CSRReqMessage.CSR.Subject,
		NotBefore:    time.Now().Add(-1 * time.Hour),
		NotAfter:     time.Now().Add(24 * time.Hour),
		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
	}
	issuedDER, err := x509.CreateCertificate(rand.Reader, issuedTmpl, caCert, caReq.CSRReqMessage.CSR.PublicKey, caKey)
	if err != nil {
		fmt.Printf("Issue cert error: %v\n", err)
		return
	}
	issuedCert, err := x509.ParseCertificate(issuedDER)
	if err != nil {
		fmt.Printf("Parse issued cert error: %v\n", err)
		return
	}

	certRepMsg, err := caReq.Success(caCert, caKey, issuedCert)
	if err != nil {
		fmt.Printf("Success CertRep creation error: %v\n", err)
		return
	}

	fmt.Printf("Generated SCEP MessageType: %s (is CertRep: %v)\n", certRepMsg.MessageType, certRepMsg.MessageType == scep.CertRep)
	fmt.Printf("PKI Status: %s\n", certRepMsg.PKIStatus)

	// 4. Client parses and decrypts CertRep
	clientParsed, err := scep.ParsePKIMessage(certRepMsg.Raw)
	if err != nil {
		fmt.Printf("Client parse CertRep error: %v\n", err)
		return
	}
	if err := clientParsed.DecryptPKIEnvelope(clientCert, clientKey); err != nil {
		fmt.Printf("Client decrypt CertRep error: %v\n", err)
		return
	}

	fmt.Printf("Decrypted issued certificate for: %s\n", clientParsed.Certificate.Subject.CommonName)
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep.CertRep in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep.CertRep"
  ]
}

package main

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"time"

	"github.com/smallstep/scep"
)

func createCACertificate() (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, fmt.Errorf("generate CA key: %w", err)
	}

	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: "SCEP Root CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, fmt.Errorf("create CA cert: %w", err)
	}

	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, fmt.Errorf("parse CA cert: %w", err)
	}

	return cert, key, nil
}

func createClientSelfSignedCert() (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, fmt.Errorf("generate client key: %w", err)
	}

	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(2),
		Subject: pkix.Name{
			CommonName: "client-device",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  false,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, fmt.Errorf("create client cert: %w", err)
	}

	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, fmt.Errorf("parse client cert: %w", err)
	}

	return cert, key, nil
}

func createCSR(key *rsa.PrivateKey, cn string) (*x509.CertificateRequest, error) {
	tmpl := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName: cn,
		},
	}

	der, err := x509.CreateCertificateRequest(rand.Reader, tmpl, key)
	if err != nil {
		return nil, fmt.Errorf("create CSR: %w", err)
	}

	return x509.ParseCertificateRequest(der)
}

func issueCertFromCSR(caCert *x509.Certificate, caKey *rsa.PrivateKey, csr *x509.CertificateRequest) (*x509.Certificate, error) {
	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(3),
		Subject:      csr.Subject,
		NotBefore:    time.Now().Add(-1 * time.Hour),
		NotAfter:     time.Now().Add(24 * time.Hour),
		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, caCert, csr.PublicKey, caKey)
	if err != nil {
		return nil, fmt.Errorf("sign issued cert: %w", err)
	}

	return x509.ParseCertificate(der)
}

func main() {
	caCert, caKey, err := createCACertificate()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: %v\n", err)
		os.Exit(1)
	}

	clientCert, clientKey, err := createClientSelfSignedCert()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: %v\n", err)
		os.Exit(1)
	}

	csr, err := createCSR(clientKey, "enrolled-device.example.com")
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: %v\n", err)
		os.Exit(1)
	}

	reqTmpl := &scep.PKIMessage{
		MessageType: scep.PKCSReq,
		SignerCert:  clientCert,
		SignerKey:   clientKey,
		Recipients:  []*x509.Certificate{caCert},
	}
	reqMsg, err := scep.NewCSRRequest(csr, reqTmpl)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: NewCSRRequest: %v\n", err)
		os.Exit(1)
	}

	caParsedReq, err := scep.ParsePKIMessage(reqMsg.Raw)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CA ParsePKIMessage: %v\n", err)
		os.Exit(1)
	}
	if err := caParsedReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CA DecryptPKIEnvelope: %v\n", err)
		os.Exit(1)
	}

	// Assertion 1: CertRep constant value is '3' and String method returns 'CertRep (3)'
	if scep.CertRep != "3" {
		fmt.Fprintf(os.Stderr, "FAIL: scep.CertRep expected '3', got %q\n", scep.CertRep)
		os.Exit(1)
	}
	if scep.CertRep.String() != "CertRep (3)" {
		fmt.Fprintf(os.Stderr, "FAIL: scep.CertRep.String() expected 'CertRep (3)', got %q\n", scep.CertRep.String())
		os.Exit(1)
	}

	// Assertion 2: msg.Success creates a CertRep message with MessageType CertRep and SUCCESS status
	issuedCert, err := issueCertFromCSR(caCert, caKey, caParsedReq.CSRReqMessage.CSR)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: issueCertFromCSR: %v\n", err)
		os.Exit(1)
	}

	successCertRep, err := caParsedReq.Success(caCert, caKey, issuedCert)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: caParsedReq.Success: %v\n", err)
		os.Exit(1)
	}

	if successCertRep.MessageType != scep.CertRep {
		fmt.Fprintf(os.Stderr, "FAIL: expected MessageType CertRep, got %q\n", successCertRep.MessageType)
		os.Exit(1)
	}
	if successCertRep.PKIStatus != scep.SUCCESS {
		fmt.Fprintf(os.Stderr, "FAIL: expected PKIStatus SUCCESS, got %q\n", successCertRep.PKIStatus)
		os.Exit(1)
	}
	if !bytes.Equal(successCertRep.RecipientNonce, caParsedReq.SenderNonce) {
		fmt.Fprintf(os.Stderr, "FAIL: RecipientNonce does not match SenderNonce\n")
		os.Exit(1)
	}

	// Assertion 3: ParsePKIMessage parses DER-encoded CertRep response recovering MessageType CertRep and SUCCESS status
	clientParsedSuccess, err := scep.ParsePKIMessage(successCertRep.Raw)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParsePKIMessage for success CertRep: %v\n", err)
		os.Exit(1)
	}
	if clientParsedSuccess.MessageType != scep.CertRep {
		fmt.Fprintf(os.Stderr, "FAIL: parsed MessageType mismatch: got %q, want %q\n", clientParsedSuccess.MessageType, scep.CertRep)
		os.Exit(1)
	}
	if clientParsedSuccess.PKIStatus != scep.SUCCESS {
		fmt.Fprintf(os.Stderr, "FAIL: parsed PKIStatus mismatch: got %q, want %q\n", clientParsedSuccess.PKIStatus, scep.SUCCESS)
		os.Exit(1)
	}

	// Assertion 4: DecryptPKIEnvelope recovers the issued X.509 certificate from a successful CertRep response
	if err := clientParsedSuccess.DecryptPKIEnvelope(clientCert, clientKey); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: DecryptPKIEnvelope failed: %v\n", err)
		os.Exit(1)
	}
	if clientParsedSuccess.Certificate == nil {
		fmt.Fprintf(os.Stderr, "FAIL: expected decrypted Certificate to be non-nil\n")
		os.Exit(1)
	}
	if clientParsedSuccess.Certificate.Subject.CommonName != "enrolled-device.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: Certificate CN mismatch: got %q, want 'enrolled-device.example.com'\n", clientParsedSuccess.Certificate.Subject.CommonName)
		os.Exit(1)
	}

	// Assertion 5: msg.Fail creates a CertRep message with MessageType CertRep, FAILURE status, and failInfo attribute
	failCertRep, err := caParsedReq.Fail(caCert, caKey, scep.BadRequest)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: caParsedReq.Fail: %v\n", err)
		os.Exit(1)
	}
	if failCertRep.MessageType != scep.CertRep {
		fmt.Fprintf(os.Stderr, "FAIL: expected fail message MessageType CertRep, got %q\n", failCertRep.MessageType)
		os.Exit(1)
	}
	if failCertRep.PKIStatus != scep.FAILURE {
		fmt.Fprintf(os.Stderr, "FAIL: expected fail message PKIStatus FAILURE, got %q\n", failCertRep.PKIStatus)
		os.Exit(1)
	}
	if failCertRep.FailInfo != scep.BadRequest {
		fmt.Fprintf(os.Stderr, "FAIL: expected FailInfo BadRequest, got %q\n", failCertRep.FailInfo)
		os.Exit(1)
	}

	// Assertion 6: ParsePKIMessage parses DER-encoded failure CertRep preserving MessageType CertRep and failInfo attribute
	clientParsedFail, err := scep.ParsePKIMessage(failCertRep.Raw)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParsePKIMessage for failure CertRep: %v\n", err)
		os.Exit(1)
	}
	if clientParsedFail.MessageType != scep.CertRep {
		fmt.Fprintf(os.Stderr, "FAIL: parsed fail MessageType mismatch: got %q, want %q\n", clientParsedFail.MessageType, scep.CertRep)
		os.Exit(1)
	}
	if clientParsedFail.PKIStatus != scep.FAILURE {
		fmt.Fprintf(os.Stderr, "FAIL: parsed fail PKIStatus mismatch: got %q, want %q\n", clientParsedFail.PKIStatus, scep.FAILURE)
		os.Exit(1)
	}
	if clientParsedFail.FailInfo != scep.BadRequest {
		fmt.Fprintf(os.Stderr, "FAIL: parsed fail FailInfo mismatch: got %q, want %q\n", clientParsedFail.FailInfo, scep.BadRequest)
		os.Exit(1)
	}

	fmt.Println("PASS: github.com/smallstep/scep.CertRep contract passed")
}