github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: x509util.CreateCertificateRequest

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep/x509util.CreateCertificateRequest in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep/x509util.CreateCertificateRequest
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: esm
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:416a07b217801a3241e2bf762cc811605e868f10d560932c60f503028d08d11e","contract":["CreateCertificateRequest generates a DER-encoded PKCS#10 CSR with embedded challengePassword using an RSA private key","ParseCertificateRequest successfully parses the generated DER CSR and validates its signature","ParseChallengePassword extracts the embedded challengePassword from the DER-encoded CSR","CreateCertificateRequest generates and signs valid CSR with ECDSA private key","CreateCertificateRequest without ChallengePassword produces valid CSR and ParseChallengePassword returns empty string"],"goal":"verify github.com/smallstep/scep/x509util.CreateCertificateRequest in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep/x509util.CreateCertificateRequest"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","runtime":"go","runtimeVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep/x509util.CreateCertificateRequest"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d

github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
	"net"
	"os"

	"github.com/smallstep/scep/x509util"
)

func main() {
	// 1. Generate an RSA private key
	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Failed to generate RSA private key: %v\n", err)
		os.Exit(1)
	}

	// 2. Prepare a CertificateRequest template with SCEP challenge password
	csrTemplate := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName:   "device.example.com",
				Organization: []string{"Example Organization"},
			},
			DNSNames:    []string{"device.example.com"},
			IPAddresses: []net.IP{net.ParseIP("10.0.0.1")},
		},
		ChallengePassword: "scep-enrollment-challenge-phrase",
	}

	// 3. Create the DER-encoded Certificate Signing Request using x509util.CreateCertificateRequest
	csrDER, err := x509util.CreateCertificateRequest(rand.Reader, csrTemplate, privateKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Failed to create certificate request: %v\n", err)
		os.Exit(1)
	}

	// 4. Parse the CSR with standard x509 to verify validity
	parsedCSR, err := x509.ParseCertificateRequest(csrDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Failed to parse CSR: %v\n", err)
		os.Exit(1)
	}

	if err := parsedCSR.CheckSignature(); err != nil {
		fmt.Fprintf(os.Stderr, "CSR signature verification failed: %v\n", err)
		os.Exit(1)
	}

	// 5. Extract and print the challengePassword attribute
	challengePassword, err := x509util.ParseChallengePassword(csrDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Failed to extract challenge password: %v\n", err)
		os.Exit(1)
	}

	fmt.Printf("Created CSR for CommonName: %s\n", parsedCSR.Subject.CommonName)
	fmt.Printf("Extracted Challenge Password: %s\n", challengePassword)

	// 6. Encode CSR to PEM format
	pemBlock := &pem.Block{
		Type:  "CERTIFICATE REQUEST",
		Bytes: csrDER,
	}
	pemBytes := pem.EncodeToMemory(pemBlock)
	fmt.Printf("CSR PEM:\n%s", string(pemBytes))
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep/x509util.CreateCertificateRequest in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep/x509util.CreateCertificateRequest"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "esm",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"net"
	"os"

	"github.com/smallstep/scep/x509util"
)

func main() {
	// Assertion 1: CreateCertificateRequest generates a DER-encoded PKCS#10 CSR with embedded challengePassword using an RSA key
	rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: failed to generate RSA key: %v\n", err)
		os.Exit(1)
	}

	rsaTemplate := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName:   "scep-client.example.com",
				Organization: []string{"Example Corp"},
			},
			DNSNames:       []string{"client.example.com", "alt.example.com"},
			IPAddresses:    []net.IP{net.ParseIP("192.168.1.100")},
			EmailAddresses: []string{"admin@example.com"},
		},
		ChallengePassword: "secret-challenge-token-123",
	}

	csrDER, err := x509util.CreateCertificateRequest(rand.Reader, rsaTemplate, rsaKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CreateCertificateRequest with RSA key failed: %v\n", err)
		os.Exit(1)
	}

	if len(csrDER) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: CreateCertificateRequest returned empty CSR DER\n")
		os.Exit(1)
	}

	// Assertion 2: ParseCertificateRequest parses the generated DER CSR and validates the signature
	parsedCSR, err := x509.ParseCertificateRequest(csrDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: x509.ParseCertificateRequest failed: %v\n", err)
		os.Exit(1)
	}

	if err := parsedCSR.CheckSignature(); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CheckSignature failed: %v\n", err)
		os.Exit(1)
	}

	if parsedCSR.Subject.CommonName != "scep-client.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: CommonName mismatch: got %q, want %q\n", parsedCSR.Subject.CommonName, "scep-client.example.com")
		os.Exit(1)
	}

	// Assertion 3: ParseChallengePassword extracts the embedded challengePassword from the DER-encoded CSR
	extractedPassword, err := x509util.ParseChallengePassword(csrDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseChallengePassword failed: %v\n", err)
		os.Exit(1)
	}

	if extractedPassword != "secret-challenge-token-123" {
		fmt.Fprintf(os.Stderr, "FAIL: extracted password mismatch: got %q, want %q\n", extractedPassword, "secret-challenge-token-123")
		os.Exit(1)
	}

	// Assertion 4: CreateCertificateRequest supports ECDSA key pairs and signs valid CSR
	ecdsaKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: failed to generate ECDSA key: %v\n", err)
		os.Exit(1)
	}

	ecdsaTemplate := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName: "ecdsa-client.example.com",
			},
		},
		ChallengePassword: "ecdsa-challenge-pass",
	}

	ecdsaCSRDER, err := x509util.CreateCertificateRequest(rand.Reader, ecdsaTemplate, ecdsaKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CreateCertificateRequest with ECDSA key failed: %v\n", err)
		os.Exit(1)
	}

	parsedECDSA, err := x509.ParseCertificateRequest(ecdsaCSRDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseCertificateRequest for ECDSA failed: %v\n", err)
		os.Exit(1)
	}

	if err := parsedECDSA.CheckSignature(); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ECDSA CheckSignature failed: %v\n", err)
		os.Exit(1)
	}

	ecdsaExtractedPass, err := x509util.ParseChallengePassword(ecdsaCSRDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseChallengePassword for ECDSA CSR failed: %v\n", err)
		os.Exit(1)
	}
	if ecdsaExtractedPass != "ecdsa-challenge-pass" {
		fmt.Fprintf(os.Stderr, "FAIL: ECDSA extracted password mismatch: got %q\n", ecdsaExtractedPass)
		os.Exit(1)
	}

	// Assertion 5: CreateCertificateRequest without ChallengePassword produces valid CSR without challenge password attribute
	noPassTemplate := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName: "nopass-client.example.com",
			},
		},
	}

	noPassDER, err := x509util.CreateCertificateRequest(rand.Reader, noPassTemplate, rsaKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CreateCertificateRequest without password failed: %v\n", err)
		os.Exit(1)
	}

	parsedNoPass, err := x509.ParseCertificateRequest(noPassDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseCertificateRequest for no-pass failed: %v\n", err)
		os.Exit(1)
	}

	if err := parsedNoPass.CheckSignature(); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: NoPass CheckSignature failed: %v\n", err)
		os.Exit(1)
	}

	noPassExtracted, _ := x509util.ParseChallengePassword(noPassDER)
	if noPassExtracted != "" {
		fmt.Fprintf(os.Stderr, "FAIL: expected empty challenge password, got %q\n", noPassExtracted)
		os.Exit(1)
	}

	fmt.Println("PASS: smallstep/scep x509util.CreateCertificateRequest contract passed")
}