github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: x509util.CertificateRequest

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep/x509util.CertificateRequest in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep/x509util.CertificateRequest

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:07c0ce249b84ed1d3c0a1627a2ef2bbc9052f7b46906268650299b9792a2f3ea","contract":["x509util.CertificateRequest defines a CSR template containing embedded x509.CertificateRequest fields and ChallengePassword attribute","x509util.CreateCertificateRequest generates DER-encoded PKCS#10 certificate request with challengePassword attribute","x509.ParseCertificateRequest parses the resulting DER bytes and passes signature verification","x509util.ParseChallengePassword extracts the challenge password string from DER-encoded CSR bytes","x509util.CreateCertificateRequest generates a valid CSR with ECDSA keys and SHA256 signature algorithm","x509util.ParseChallengePassword returns an empty string when the CSR has no challenge password attribute","x509util.ParseChallengePassword returns an ASN.1 unmarshaling error when given malformed DER bytes","x509util.CreateCertificateRequest returns an error when private key does not implement crypto.Signer"],"goal":"verify github.com/smallstep/scep/x509util.CertificateRequest in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep/x509util.CertificateRequest"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep/x509util.CertificateRequest"],"verifierAdapter":"golang@1"}

module sample-scep-x509util

go 1.22

require github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d

require (
	github.com/go-kit/kit v0.4.0 // indirect
	github.com/go-logfmt/logfmt v0.5.1 // indirect
	github.com/go-stack/stack v1.6.0 // indirect
	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
)

github.com/go-kit/kit v0.4.0 h1:KeVK+Emj3c3S4eRztFuzbFYb2BAgf2jmwDwyXEri7Lo=
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"

	"github.com/smallstep/scep/x509util"
)

func main() {
	// Generate RSA key for the certificate request
	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Printf("Failed to generate private key: %v\n", err)
		return
	}

	// Create CertificateRequest template with SCEP challenge password
	tmpl := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName:   "device.example.com",
				Organization: []string{"Example Org"},
			},
			SignatureAlgorithm: x509.SHA256WithRSA,
			DNSNames:           []string{"device.example.com"},
		},
		ChallengePassword: "scep-enrollment-challenge-phrase",
	}

	// Create DER-encoded certificate request
	csrDer, err := x509util.CreateCertificateRequest(rand.Reader, tmpl, privKey)
	if err != nil {
		fmt.Printf("Failed to create certificate request: %v\n", err)
		return
	}

	// Parse standard x509 CertificateRequest from DER bytes
	csr, err := x509.ParseCertificateRequest(csrDer)
	if err != nil {
		fmt.Printf("Failed to parse certificate request: %v\n", err)
		return
	}

	// Verify CSR signature
	if err := csr.CheckSignature(); err != nil {
		fmt.Printf("Invalid CSR signature: %v\n", err)
		return
	}

	// Extract challenge password using x509util
	challengePassword, err := x509util.ParseChallengePassword(csrDer)
	if err != nil {
		fmt.Printf("Failed to parse challenge password: %v\n", err)
		return
	}

	fmt.Printf("Generated CSR for Subject CN: %s\n", csr.Subject.CommonName)
	fmt.Printf("Extracted Challenge Password: %s\n", challengePassword)
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep/x509util.CertificateRequest in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep/x509util.CertificateRequest"
  ]
}

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"os"
	"strings"

	"github.com/smallstep/scep/x509util"
)

func main() {
	rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: RSA key generation error: %v\n", err)
		os.Exit(1)
	}

	ecdsaKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: ECDSA key generation error: %v\n", err)
		os.Exit(1)
	}

	var rsaDer []byte
	var rsaCsr *x509.CertificateRequest

	// Assertion 1: x509util.CertificateRequest defines a CSR template containing embedded x509.CertificateRequest fields and ChallengePassword attribute
	{
		tmpl := &x509util.CertificateRequest{
			CertificateRequest: x509.CertificateRequest{
				Subject: pkix.Name{
					CommonName: "rsa-device.example.com",
				},
				DNSNames:           []string{"rsa-device.example.com"},
				SignatureAlgorithm: x509.SHA256WithRSA,
			},
			ChallengePassword: "rsa-challenge-password-123",
		}
		if tmpl.Subject.CommonName != "rsa-device.example.com" {
			fmt.Fprintf(os.Stderr, "Assertion 1 failed: CommonName mismatch\n")
			os.Exit(1)
		}
		if tmpl.ChallengePassword != "rsa-challenge-password-123" {
			fmt.Fprintf(os.Stderr, "Assertion 1 failed: ChallengePassword mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 2: x509util.CreateCertificateRequest generates DER-encoded PKCS#10 certificate request with challengePassword attribute
	{
		tmpl := &x509util.CertificateRequest{
			CertificateRequest: x509.CertificateRequest{
				Subject: pkix.Name{
					CommonName: "rsa-device.example.com",
				},
				DNSNames:           []string{"rsa-device.example.com"},
				SignatureAlgorithm: x509.SHA256WithRSA,
			},
			ChallengePassword: "rsa-challenge-password-123",
		}
		rsaDer, err = x509util.CreateCertificateRequest(rand.Reader, tmpl, rsaKey)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 2 failed: CreateCertificateRequest error: %v\n", err)
			os.Exit(1)
		}
		if len(rsaDer) == 0 {
			fmt.Fprintf(os.Stderr, "Assertion 2 failed: empty DER output\n")
			os.Exit(1)
		}
	}

	// Assertion 3: x509.ParseCertificateRequest parses the resulting DER bytes and passes signature verification
	{
		rsaCsr, err = x509.ParseCertificateRequest(rsaDer)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: ParseCertificateRequest error: %v\n", err)
			os.Exit(1)
		}
		if rsaCsr.Subject.CommonName != "rsa-device.example.com" {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: CommonName mismatch: %s\n", rsaCsr.Subject.CommonName)
			os.Exit(1)
		}
		if len(rsaCsr.DNSNames) != 1 || rsaCsr.DNSNames[0] != "rsa-device.example.com" {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: DNSNames mismatch: %v\n", rsaCsr.DNSNames)
			os.Exit(1)
		}
		if err := rsaCsr.CheckSignature(); err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: CheckSignature failed: %v\n", err)
			os.Exit(1)
		}
	}

	// Assertion 4: x509util.ParseChallengePassword extracts the challenge password string from DER-encoded CSR bytes
	{
		pwd, err := x509util.ParseChallengePassword(rsaDer)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 4 failed: ParseChallengePassword returned error: %v\n", err)
			os.Exit(1)
		}
		if pwd != "rsa-challenge-password-123" {
			fmt.Fprintf(os.Stderr, "Assertion 4 failed: expected 'rsa-challenge-password-123', got '%s'\n", pwd)
			os.Exit(1)
		}
	}

	// Assertion 5: x509util.CreateCertificateRequest generates a valid CSR with ECDSA keys and SHA256 signature algorithm
	{
		ecdsaTmpl := &x509util.CertificateRequest{
			CertificateRequest: x509.CertificateRequest{
				Subject: pkix.Name{
					CommonName: "ecdsa-device.example.com",
				},
				SignatureAlgorithm: x509.ECDSAWithSHA256,
			},
			ChallengePassword: "ecdsa-challenge-token",
		}
		ecdsaDer, err := x509util.CreateCertificateRequest(rand.Reader, ecdsaTmpl, ecdsaKey)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: CreateCertificateRequest with ECDSA key error: %v\n", err)
			os.Exit(1)
		}
		ecdsaCsr, err := x509.ParseCertificateRequest(ecdsaDer)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: ParseCertificateRequest for ECDSA error: %v\n", err)
			os.Exit(1)
		}
		if err := ecdsaCsr.CheckSignature(); err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: CheckSignature for ECDSA failed: %v\n", err)
			os.Exit(1)
		}
		pwd, err := x509util.ParseChallengePassword(ecdsaDer)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: ParseChallengePassword on ECDSA CSR error: %v\n", err)
			os.Exit(1)
		}
		if pwd != "ecdsa-challenge-token" {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: expected 'ecdsa-challenge-token', got '%s'\n", pwd)
			os.Exit(1)
		}
	}

	// Assertion 6: x509util.ParseChallengePassword returns an empty string when the CSR has no challenge password attribute
	{
		noPwdTmpl := &x509util.CertificateRequest{
			CertificateRequest: x509.CertificateRequest{
				Subject: pkix.Name{
					CommonName: "nopassword.example.com",
				},
			},
		}
		noPwdDer, err := x509util.CreateCertificateRequest(rand.Reader, noPwdTmpl, rsaKey)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 6 failed: CreateCertificateRequest error: %v\n", err)
			os.Exit(1)
		}
		pwd, err := x509util.ParseChallengePassword(noPwdDer)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 6 failed: ParseChallengePassword returned error: %v\n", err)
			os.Exit(1)
		}
		if pwd != "" {
			fmt.Fprintf(os.Stderr, "Assertion 6 failed: expected empty password, got '%s'\n", pwd)
			os.Exit(1)
		}
	}

	// Assertion 7: x509util.ParseChallengePassword returns an ASN.1 unmarshaling error when given malformed DER bytes
	{
		_, err := x509util.ParseChallengePassword([]byte{0x30, 0x01, 0x00})
		if err == nil {
			fmt.Fprintf(os.Stderr, "Assertion 7 failed: expected error for malformed DER bytes, got nil\n")
			os.Exit(1)
		}
	}

	// Assertion 8: x509util.CreateCertificateRequest returns an error when private key does not implement crypto.Signer
	{
		invalidKeyTmpl := &x509util.CertificateRequest{
			CertificateRequest: x509.CertificateRequest{
				Subject: pkix.Name{
					CommonName: "invalid-key.example.com",
				},
			},
		}
		_, err := x509util.CreateCertificateRequest(rand.Reader, invalidKeyTmpl, "not-a-crypto-signer-key")
		if err == nil {
			fmt.Fprintf(os.Stderr, "Assertion 8 failed: expected error for invalid key type, got nil\n")
			os.Exit(1)
		}
		if !strings.Contains(err.Error(), "crypto.Signer") {
			fmt.Fprintf(os.Stderr, "Assertion 8 failed: expected crypto.Signer error, got %v\n", err)
			os.Exit(1)
		}
	}

	fmt.Println("All contract assertions passed.")
}