github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: NewCSRRequest

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep.NewCSRRequest in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep.NewCSRRequest

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:cda8714527bfe7e440ed433fad8807606f0259235faf1ffe4097f6adf1420501","contract":["scep.NewCSRRequest creates a SCEP PKCSReq message encapsulating a PKCS#10 certificate request with a challenge password","scep.ParsePKIMessage verifies and unpacks the PKCS#7 envelope to extract messageType, transactionID, and senderNonce","scep.PKIMessage.DecryptPKIEnvelope decrypts the recipient-encrypted CSR payload and extracts subject and challengePassword","scep.PKIMessage.Success constructs a CertRep SUCCESS response encrypting the issued certificate in a degenerate PKCS#7 structure","scep.PKIMessage.Fail constructs a signed CertRep FAILURE response with the specified failInfo reason","scep.DegenerateCertificates and scep.CACerts encode and decode certificates in degenerate PKCS#7 format","scep.NewCSRRequest returns an error when no CA/RA recipient certificates are provided","scep.ParsePKIMessage returns an error when given invalid or malformed data"],"goal":"verify github.com/smallstep/scep.NewCSRRequest in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep.NewCSRRequest"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep.NewCSRRequest"],"verifierAdapter":"golang@1"}

module sample-scep

go 1.22

require github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d

require (
	github.com/go-kit/kit v0.4.0 // indirect
	github.com/go-logfmt/logfmt v0.5.1 // indirect
	github.com/go-stack/stack v1.6.0 // indirect
	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
)

github.com/go-kit/kit v0.4.0 h1:KeVK+Emj3c3S4eRztFuzbFYb2BAgf2jmwDwyXEri7Lo=
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/scep"
	"github.com/smallstep/scep/x509util"
)

func main() {
	caKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	caTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: "Example CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}
	caDer, _ := x509.CreateCertificate(rand.Reader, caTmpl, caTmpl, &caKey.PublicKey, caKey)
	caCert, _ := x509.ParseCertificate(caDer)

	clientKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	clientTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(2),
		Subject: pkix.Name{
			CommonName: "client.example.com",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
	}
	clientDer, _ := x509.CreateCertificate(rand.Reader, clientTmpl, clientTmpl, &clientKey.PublicKey, clientKey)
	clientCert, _ := x509.ParseCertificate(clientDer)

	csrTmpl := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName: "client.example.com",
			},
			SignatureAlgorithm: x509.SHA256WithRSA,
		},
		ChallengePassword: "sample-challenge",
	}
	csrDer, _ := x509util.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	csr, _ := x509.ParseCertificateRequest(csrDer)

	reqTmpl := &scep.PKIMessage{
		MessageType: scep.PKCSReq,
		Recipients:  []*x509.Certificate{caCert},
		SignerCert:  clientCert,
		SignerKey:   clientKey,
	}
	reqMsg, err := scep.NewCSRRequest(csr, reqTmpl)
	if err != nil {
		fmt.Printf("NewCSRRequest error: %v\n", err)
		return
	}
	fmt.Printf("Created SCEP PKCSReq with TransactionID: %s\n", reqMsg.TransactionID)

	parsedReq, err := scep.ParsePKIMessage(reqMsg.Raw)
	if err != nil {
		fmt.Printf("ParsePKIMessage error: %v\n", err)
		return
	}
	if err := parsedReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
		fmt.Printf("DecryptPKIEnvelope error: %v\n", err)
		return
	}
	fmt.Printf("Decrypted CSR CommonName: %s\n", parsedReq.CSRReqMessage.CSR.Subject.CommonName)
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep.NewCSRRequest in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep.NewCSRRequest"
  ]
}

package main

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"strings"
	"time"

	"github.com/smallstep/scep"
	"github.com/smallstep/scep/x509util"
)

func generateCA() (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	serial, _ := rand.Int(rand.Reader, big.NewInt(1000000))
	tmpl := &x509.Certificate{
		SerialNumber: serial,
		Subject: pkix.Name{
			CommonName: "Example CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, err
	}
	return cert, key, nil
}

func generateClientCert(cn string) (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	serial, _ := rand.Int(rand.Reader, big.NewInt(1000000))
	tmpl := &x509.Certificate{
		SerialNumber: serial,
		Subject: pkix.Name{
			CommonName: cn,
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, err
	}
	return cert, key, nil
}

func main() {
	caCert, caKey, err := generateCA()
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CA generation error: %v\n", err)
		os.Exit(1)
	}

	clientCert, clientKey, err := generateClientCert("client.example.com")
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: Client cert generation error: %v\n", err)
		os.Exit(1)
	}

	csrTmpl := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName: "client.example.com",
			},
			SignatureAlgorithm: x509.SHA256WithRSA,
		},
		ChallengePassword: "challenge-phrase",
	}
	csrDer, err := x509util.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CreateCertificateRequest error: %v\n", err)
		os.Exit(1)
	}
	csr, err := x509.ParseCertificateRequest(csrDer)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: ParseCertificateRequest error: %v\n", err)
		os.Exit(1)
	}

	var scepReq *scep.PKIMessage

	// Assertion 1: scep.NewCSRRequest creates a SCEP PKCSReq message encapsulating a PKCS#10 certificate request with a challenge password
	{
		reqMsgTmpl := &scep.PKIMessage{
			MessageType: scep.PKCSReq,
			Recipients:  []*x509.Certificate{caCert},
			SignerCert:  clientCert,
			SignerKey:   clientKey,
		}
		scepReq, err = scep.NewCSRRequest(csr, reqMsgTmpl)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: NewCSRRequest returned error: %v\n", err)
			os.Exit(1)
		}
		if scepReq == nil || len(scepReq.Raw) == 0 {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: empty raw PKIMessage bytes\n")
			os.Exit(1)
		}
		if scepReq.TransactionID == "" {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: empty TransactionID\n")
			os.Exit(1)
		}
		if len(scepReq.SenderNonce) == 0 {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: empty SenderNonce\n")
			os.Exit(1)
		}
	}

	var parsedReq *scep.PKIMessage

	// Assertion 2: scep.ParsePKIMessage verifies and unpacks the PKCS#7 envelope to extract messageType, transactionID, and senderNonce
	{
		parsedReq, err = scep.ParsePKIMessage(scepReq.Raw)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: ParsePKIMessage returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedReq.MessageType != scep.PKCSReq {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: expected MessageType %v, got %v\n", scep.PKCSReq, parsedReq.MessageType)
			os.Exit(1)
		}
		if parsedReq.TransactionID != scepReq.TransactionID {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: TransactionID mismatch: expected %v, got %v\n", scepReq.TransactionID, parsedReq.TransactionID)
			os.Exit(1)
		}
		if !bytes.Equal(parsedReq.SenderNonce, scepReq.SenderNonce) {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: SenderNonce mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 3: scep.PKIMessage.DecryptPKIEnvelope decrypts the recipient-encrypted CSR payload and extracts subject and challengePassword
	{
		if err := parsedReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: DecryptPKIEnvelope returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedReq.CSRReqMessage == nil || parsedReq.CSRReqMessage.CSR == nil {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: missing decrypted CSR\n")
			os.Exit(1)
		}
		if parsedReq.CSRReqMessage.CSR.Subject.CommonName != "client.example.com" {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: expected CommonName 'client.example.com', got '%s'\n", parsedReq.CSRReqMessage.CSR.Subject.CommonName)
			os.Exit(1)
		}
		if parsedReq.CSRReqMessage.ChallengePassword != "challenge-phrase" {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: expected ChallengePassword 'challenge-phrase', got '%s'\n", parsedReq.CSRReqMessage.ChallengePassword)
			os.Exit(1)
		}
	}

	// Assertion 4: scep.PKIMessage.Success constructs a CertRep SUCCESS response encrypting the issued certificate in a degenerate PKCS#7 structure
	{
		issuedTmpl := &x509.Certificate{
			SerialNumber: big.NewInt(300),
			Subject:      csr.Subject,
			NotBefore:    time.Now().Add(-1 * time.Hour),
			NotAfter:     time.Now().Add(24 * time.Hour),
			KeyUsage:     x509.KeyUsageDigitalSignature,
		}
		issuedDer, err := x509.CreateCertificate(rand.Reader, issuedTmpl, caCert, csr.PublicKey, caKey)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 setup failed: CreateCertificate error: %v\n", err)
			os.Exit(1)
		}
		issuedCert, err := x509.ParseCertificate(issuedDer)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 setup failed: ParseCertificate error: %v\n", err)
			os.Exit(1)
		}

		respMsg, err := parsedReq.Success(caCert, caKey, issuedCert)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: Success returned error: %v\n", err)
			os.Exit(1)
		}
		if respMsg.MessageType != scep.CertRep {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: expected CertRep MessageType, got %v\n", respMsg.MessageType)
			os.Exit(1)
		}

		clientParsedResp, err := scep.ParsePKIMessage(respMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: client ParsePKIMessage returned error: %v\n", err)
			os.Exit(1)
		}
		if clientParsedResp.CertRepMessage == nil || clientParsedResp.CertRepMessage.PKIStatus != scep.SUCCESS {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: expected SUCCESS status, got %v\n", clientParsedResp.CertRepMessage)
			os.Exit(1)
		}
		if err := clientParsedResp.DecryptPKIEnvelope(clientCert, clientKey); err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: client DecryptPKIEnvelope returned error: %v\n", err)
			os.Exit(1)
		}
		if clientParsedResp.CertRepMessage.Certificate.SerialNumber.Cmp(big.NewInt(300)) != 0 {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: decrypted cert serial mismatch: %v\n", clientParsedResp.CertRepMessage.Certificate.SerialNumber)
			os.Exit(1)
		}
	}

	// Assertion 5: scep.PKIMessage.Fail constructs a signed CertRep FAILURE response with the specified failInfo reason
	{
		failMsg, err := parsedReq.Fail(caCert, caKey, scep.BadRequest)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: Fail returned error: %v\n", err)
			os.Exit(1)
		}
		parsedFail, err := scep.ParsePKIMessage(failMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: ParsePKIMessage on fail message returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedFail.CertRepMessage == nil || parsedFail.CertRepMessage.PKIStatus != scep.FAILURE {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: expected FAILURE status\n")
			os.Exit(1)
		}
		if parsedFail.CertRepMessage.FailInfo != scep.BadRequest {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: expected FailInfo BadRequest, got %v\n", parsedFail.CertRepMessage.FailInfo)
			os.Exit(1)
		}
	}

	// Assertion 6: scep.DegenerateCertificates and scep.CACerts encode and decode certificates in degenerate PKCS#7 format
	{
		deg, err := scep.DegenerateCertificates([]*x509.Certificate{caCert})
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 6 failed: DegenerateCertificates returned error: %v\n", err)
			os.Exit(1)
		}
		extracted, err := scep.CACerts(deg)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 6 failed: CACerts returned error: %v\n", err)
			os.Exit(1)
		}
		if len(extracted) != 1 || !bytes.Equal(extracted[0].Raw, caCert.Raw) {
			fmt.Fprintf(os.Stderr, "Contract 6 failed: extracted certificate mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 7: scep.NewCSRRequest returns an error when no CA/RA recipient certificates are provided
	{
		emptyRecipientsTmpl := &scep.PKIMessage{
			MessageType: scep.PKCSReq,
			SignerCert:  clientCert,
			SignerKey:   clientKey,
		}
		_, err := scep.NewCSRRequest(csr, emptyRecipientsTmpl)
		if err == nil {
			fmt.Fprintf(os.Stderr, "Contract 7 failed: expected error for empty recipients, got nil\n")
			os.Exit(1)
		}
		if !strings.Contains(err.Error(), "no CA/RA recipients") {
			fmt.Fprintf(os.Stderr, "Contract 7 failed: unexpected error message: %v\n", err)
			os.Exit(1)
		}
	}

	// Assertion 8: scep.ParsePKIMessage returns an error when given invalid or malformed data
	{
		_, err := scep.ParsePKIMessage([]byte("invalid pki message data"))
		if err == nil {
			fmt.Fprintf(os.Stderr, "Contract 8 failed: expected error for invalid bytes, got nil\n")
			os.Exit(1)
		}
	}

	fmt.Println("All contract assertions passed.")
}