使用Go语言创建带有电子邮件地址的证书签名请求（CSR）。

huangapple
go评论114阅读模式
英文:

Create a Certificate Signing Request (CSR) with an email address in Go

问题

我尝试使用"crypto/x509"包生成CSR，但没有找到将"emailAddress"字段添加到其Subject中的方法。

根据文档CertificateRequest的结构中有一个"EmailAddresses []string"字段，但它被序列化为SAN扩展。这是我使用的测试代码：
http://play.golang.org/p/OtObaTyuTM

此外，我使用"openssl req"程序创建了一个CSR并比较了结果：

  1. % openssl req -in openssl.csr -noout -text
  2. Certificate Request:
  3.     Data:
  4.         Version: 0 (0x0)
  5.         Subject: C=AU, ST=Some-State, L=MyCity, O=Company Ltd, OU=IT, CN=domain.com/emailAddress=test@email.com
  6.         Subject Public Key Info:
  7.             Public Key Algorithm: rsaEncryption
  8.                 Public-Key: (512 bit)
  9.                 Modulus:
  10.                     00:a3:05:e3:37:63:f9:8b:d0:37:46:2d:a8:d9:26:
  11.                     4e:be:83:1d:b9:30:88:2b:80:4b:53:cc:7c:01:86:
  12.                     b0:9b:1d:3b:0a:05:c4:56:47:4e:5d:90:f9:5a:29:
  13.                     8b:9a:7f:fa:4b:5e:e4:5d:dd:c6:8b:87:33:c4:b4:
  14.                     fa:6b:b4:67:bd
  15.                 Exponent: 65537 (0x10001)
  16.         Attributes:
  17.             a0:00
  18.     Signature Algorithm: sha1WithRSAEncryption
  19.          0b:24:6e:0a:f9:bf:23:d7:41:5f:96:da:78:d1:99:18:fb:d6:
  20.          71:7e:79:f0:02:e9:8a:50:a9:00:32:df:26:14:2f:f4:3e:c4:
  21.          22:c9:5c:4e:79:c1:c2:22:1b:2a:da:79:6f:51:ba:8a:12:63:
  22.          27:02:4a:b3:22:97:59:f7:6e:d6
  23. ===============================================================
  24.  % openssl req -in golang.csr -noout -text
  25. Certificate Request:
  26.     Data:
  27.         Version: 0 (0x0)
  28.         Subject: C=AU, O=Company Ltd, OU=IT, L=MyCity, ST=Some-State, CN=domain.com
  29.         Subject Public Key Info:
  30.             Public Key Algorithm: rsaEncryption
  31.                 Public-Key: (512 bit)
  32.                 Modulus:
  33.                     00:ac:b6:51:5b:53:44:44:20:91:da:01:45:72:49:
  34.                     95:83:78:74:7c:05:f9:a7:77:88:02:3a:23:5f:04:
  35.                     c3:69:45:b9:5a:bb:fd:e7:d3:24:5f:46:14:b8:7d:
  36.                     30:ce:a0:c6:ea:e3:3b:ec:4c:75:24:cc:ce:60:1d:
  37.                     e9:33:57:ae:21
  38.                 Exponent: 65537 (0x10001)
  39.         Attributes:
  40.         Requested Extensions:
  41.             X509v3 Subject Alternative Name:
  42.                 email:test@email.com
  43.     Signature Algorithm: sha256WithRSAEncryption
  44.          a1:c1:b7:80:a0:f0:c3:b6:44:06:f4:ad:12:3a:67:19:fa:84:
  45.          34:22:2a:d9:56:d9:8b:c9:a4:d0:cf:8d:a1:36:87:fa:75:b7:
  46.          05:40:0a:15:1f:72:61:85:a8:09:bc:f4:13:e6:24:5e:2e:b7:
  47.          99:e3:93:53:4e:2d:d5:0c:22:fc

在我看来，我应该自己构建RawSubject字段，并使用emailAddress oid，但我没有找到任何代码示例。
更新：
我找到了解决方案。如我上面提到的，RawSubject字段必须手动准备：

  1. subj := pkix.Name{
  2. 				CommonName:   		cn,
  3. 				Country: 			[]string{c},
  4. 				Organization:		[]string{o},
  5. 				OrganizationalUnit:	[]string{ou},
  6. 				Locality:			[]string{l},
  7. 				Province:			[]string{s},
  8. }
  9. rawSubj := subj.ToRDNSequence()
  10. rawSubj = appendRDNs(rawSubj, []string{e}, oidEmailAddress)
  11. asn1Subj, err := asn1.Marshal(rawSubj)
  12. template := x509.CertificateRequest{
  13. 			RawSubject: asn1Subj,
  14. 			SignatureAlgorithm: x509.SHA1WithRSA,
  15. }

其中：

  • var oidEmailAddress = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 1}
  • appendRDNs()在crypto/x509/pkix中定义（因为它的名称不以大写字母开头，所以默认情况下不会导出）。你可以将其再次定义为自己的函数并进行复制粘贴。
英文:

I tried to generate a CSR using "crypto/x509" package and didn't find the way to add a "emailAddress" field into its Subject.

According to the documentation CertificateRequest structure has a "EmailAddresses []string" field but it's serialized into SAN extension.
Here is a test code i used:
http://play.golang.org/p/OtObaTyuTM

Also I created a CSR using "openssl req" program and compared results:

  1. % openssl req -in openssl.csr -noout -text
  2. Certificate Request:
  3.     Data:
  4.         Version: 0 (0x0)
  5.         Subject: C=AU, ST=Some-State, L=MyCity, O=Company Ltd, OU=IT, CN=domain.com/emailAddress=test@email.com
  6.         Subject Public Key Info:
  7.             Public Key Algorithm: rsaEncryption
  8.                 Public-Key: (512 bit)
  9.                 Modulus:
  10.                     00:a3:05:e3:37:63:f9:8b:d0:37:46:2d:a8:d9:26:
  11.                     4e:be:83:1d:b9:30:88:2b:80:4b:53:cc:7c:01:86:
  12.                     b0:9b:1d:3b:0a:05:c4:56:47:4e:5d:90:f9:5a:29:
  13.                     8b:9a:7f:fa:4b:5e:e4:5d:dd:c6:8b:87:33:c4:b4:
  14.                     fa:6b:b4:67:bd
  15.                 Exponent: 65537 (0x10001)
  16.         Attributes:
  17.             a0:00
  18.     Signature Algorithm: sha1WithRSAEncryption
  19.          0b:24:6e:0a:f9:bf:23:d7:41:5f:96:da:78:d1:99:18:fb:d6:
  20.          71:7e:79:f0:02:e9:8a:50:a9:00:32:df:26:14:2f:f4:3e:c4:
  21.          22:c9:5c:4e:79:c1:c2:22:1b:2a:da:79:6f:51:ba:8a:12:63:
  22.          27:02:4a:b3:22:97:59:f7:6e:d6
  23. ===============================================================
  24.  % openssl req -in golang.csr -noout -text
  25. Certificate Request:
  26.     Data:
  27.         Version: 0 (0x0)
  28.         Subject: C=AU, O=Company Ltd, OU=IT, L=MyCity, ST=Some-State, CN=domain.com
  29.         Subject Public Key Info:
  30.             Public Key Algorithm: rsaEncryption
  31.                 Public-Key: (512 bit)
  32.                 Modulus:
  33.                     00:ac:b6:51:5b:53:44:44:20:91:da:01:45:72:49:
  34.                     95:83:78:74:7c:05:f9:a7:77:88:02:3a:23:5f:04:
  35.                     c3:69:45:b9:5a:bb:fd:e7:d3:24:5f:46:14:b8:7d:
  36.                     30:ce:a0:c6:ea:e3:3b:ec:4c:75:24:cc:ce:60:1d:
  37.                     e9:33:57:ae:21
  38.                 Exponent: 65537 (0x10001)
  39.         Attributes:
  40.         Requested Extensions:
  41.             X509v3 Subject Alternative Name:
  42.                 email:test@email.com
  43.     Signature Algorithm: sha256WithRSAEncryption
  44.          a1:c1:b7:80:a0:f0:c3:b6:44:06:f4:ad:12:3a:67:19:fa:84:
  45.          34:22:2a:d9:56:d9:8b:c9:a4:d0:cf:8d:a1:36:87:fa:75:b7:
  46.          05:40:0a:15:1f:72:61:85:a8:09:bc:f4:13:e6:24:5e:2e:b7:
  47.          99:e3:93:53:4e:2d:d5:0c:22:fc

To my mind I should build RawSubject field myself with emainAddress oid but I didn't find any code samples.
UPD:
I've found the solution. As I mentioned above, the RawSubject field must be prepared manually:

  1. subj := pkix.Name{
  2. 				CommonName:   		cn,
  3. 				Country: 			[]string{c},
  4. 				Organization:		[]string{o},
  5. 				OrganizationalUnit:	[]string{ou},
  6. 				Locality:			[]string{l},
  7. 				Province:			[]string{s},
  8. }
  9. rawSubj := subj.ToRDNSequence()
  10. rawSubj = appendRDNs(rawSubj, []string{e}, oidEmailAddress)
  11. asn1Subj, err := asn1.Marshal(rawSubj)
  12. template := x509.CertificateRequest{
  13. 			RawSubject: asn1Subj,
  14. 			SignatureAlgorithm: x509.SHA1WithRSA,
  15. }

where:

  • var oidEmailAddress = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 1}
  • appendRDNs() is defined in crypto/x509/pkix (because its name doesn't start with an uppercase letter, it's not exported by default. You can just define it again as your own function with copy&paste).

答案1

得分: 27

这是对Jeremy的答案的一种变体，它利用了Go自他的答案以来的一些新功能，并修复了我认为存在的一个错误。（有关更多信息，请参见我在他的帖子上的评论。）

以下是下面代码的可运行的playground链接。

  1. package main
  3. import (
  4. 	"crypto/rand"
  5. 	"crypto/rsa"
  6. 	"crypto/x509"
  7. 	"crypto/x509/pkix"
  8. 	"encoding/asn1"
  9. 	"encoding/pem"
  10. 	"os"
  11. )
  13. var oidEmailAddress = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 1}
  15. func main() {
  16. 	keyBytes, _ := rsa.GenerateKey(rand.Reader, 1024)
  18. 	emailAddress := "test@example.com"
  19. 	subj := pkix.Name{
  20. 		CommonName:         "example.com",
  21. 		Country:            []string{"AU"},
  22. 		Province:           []string{"Some-State"},
  23. 		Locality:           []string{"MyCity"},
  24. 		Organization:       []string{"Company Ltd"},
  25. 		OrganizationalUnit: []string{"IT"},
  26. 		ExtraNames: []pkix.AttributeTypeAndValue{
  27. 			{
  28. 				Type:  oidEmailAddress,
  29. 				Value: asn1.RawValue{
  30. 					Tag:   asn1.TagIA5String,
  31. 					Bytes: []byte(emailAddress),
  32. 				},
  33. 			},
  34. 		},
  35. 	}
  37. 	template := x509.CertificateRequest{
  38. 		Subject:            subj,
  39. 		SignatureAlgorithm: x509.SHA256WithRSA,
  40. 	}
  42. 	csrBytes, _ := x509.CreateCertificateRequest(rand.Reader, &template, keyBytes)
  43. 	pem.Encode(os.Stdout, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrBytes})
  45. }

主要的区别是：

  • 不再序列化主题并使用RawSubject字段，而是将电子邮件地址字段添加到pkix.Name ExtraNames切片中（在Go 1.5中添加）。
  • 电子邮件地址需要编码为ASN.1的IA5String，而不是PrintableString或UTF8String。这就是为什么我们需要使用asn1.RawValue的原因。
  • 不要将电子邮件地址添加到CertificateRequest的EmailAddresses字段中，该字段设置了一个SubjectAltName（SAN）。这些更适用于签名电子邮件之类的东西。在TLS证书的上下文中，SAN应该用于替代有效的主机名和IP地址。

（更新于2018-06-14：Value已从string更改为asn1.RawValue。否则，OpenSSL会拒绝生成的CSR，因为emailAddress的ASN.1序列化编码需要是IA5String，而不是PrintableString或UTF8String。）

英文:

This is a variation on Jeremy's answer which takes advantage of some new additions in Go since his answer, and also fixes what I believe to be a bug. (For more info on that, see my comments on his post.)

Here's a runnable playground link for the code below.

  1. package main
  3. import (
  4. 	"crypto/rand"
  5. 	"crypto/rsa"
  6. 	"crypto/x509"
  7. 	"crypto/x509/pkix"
  8. 	"encoding/asn1"
  9. 	"encoding/pem"
  10. 	"os"
  11. )
  13. var oidEmailAddress = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 1}
  15. func main() {
  16. 	keyBytes, _ := rsa.GenerateKey(rand.Reader, 1024)
  18. 	emailAddress := "test@example.com"
  19. 	subj := pkix.Name{
  20. 		CommonName:         "example.com",
  21. 		Country:            []string{"AU"},
  22. 		Province:           []string{"Some-State"},
  23. 		Locality:           []string{"MyCity"},
  24. 		Organization:       []string{"Company Ltd"},
  25. 		OrganizationalUnit: []string{"IT"},
  26. 		ExtraNames: []pkix.AttributeTypeAndValue{
  27. 			{
  28.                 Type:  oidEmailAddress, 
  29.                 Value: asn1.RawValue{
  30.                     Tag:   asn1.TagIA5String, 
  31.                     Bytes: []byte(emailAddress),
  32.                 },
  33.             },
  34. 		},
  35. 	}
  37. 	template := x509.CertificateRequest{
  38. 		Subject:            subj,
  39. 		SignatureAlgorithm: x509.SHA256WithRSA,
  40. 	}
  42. 	csrBytes, _ := x509.CreateCertificateRequest(rand.Reader, &template, keyBytes)
  43. 	pem.Encode(os.Stdout, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrBytes})
  45. }

The main differences are:

  • Rather than serializing the subject and using the RawSubject field, add the email address field to the pkix.Name ExtraNames slice (added in Go 1.5).
  • The email address needs to be encoded as an ASN.1 IA5String, not as a PrintableString or UTF8String. This is why we need to use asn1.RawValue.
  • Don't add email addresses to the CertificateRequest EmailAddresses field, which sets a SubjectAltName (SAN). Those are designed more for things like signed emails. In the context of TLS certificates, SANs should be used for alternatively valid hostnames and IP addresses.

(Update 2018-06-14: The Value has been changed from a string to an asn1.RawValue. OpenSSL rejects CSRs generated otherwise because the ASN.1 serialized encoding of emailAddress needs to be IA5String rather than PrintableString or UTF8String.)

答案2

得分: 22

我知道mephist回答了他自己的问题，但他留下了一些需要拼凑在一起的东西。为了完整起见（也因为我在过去两年中已经两次降落在这里...），这是一个完整的工作示例：https://play.golang.org/p/YL_qfPe4Zz

  1. package main
  3. import (
  4. 	"crypto/rand"
  5. 	"crypto/rsa"
  6. 	"crypto/x509"
  7. 	"crypto/x509/pkix"
  8. 	"encoding/asn1"
  9. 	"encoding/pem"
  10. 	"os"
  11. )
  13. var oidEmailAddress = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 1}
  15. func main() {
  16. 	keyBytes, _ := rsa.GenerateKey(rand.Reader, 1024)
  18. 	emailAddress := "test@example.com"
  19. 	subj := pkix.Name{
  20. 		CommonName:         "example.com",
  21. 		Country:            []string{"AU"},
  22. 		Province:           []string{"Some-State"},
  23. 		Locality:           []string{"MyCity"},
  24. 		Organization:       []string{"Company Ltd"},
  25. 		OrganizationalUnit: []string{"IT"},
  26. 	}
  27. 	rawSubj := subj.ToRDNSequence()
  28. 	rawSubj = append(rawSubj, []pkix.AttributeTypeAndValue{
  29. 		{Type: oidEmailAddress, Value: emailAddress},
  30. 	})
  32. 	asn1Subj, _ := asn1.Marshal(rawSubj)
  33. 	template := x509.CertificateRequest{
  34. 		RawSubject:         asn1Subj,
  35. 		EmailAddresses:     []string{emailAddress},
  36. 		SignatureAlgorithm: x509.SHA256WithRSA,
  37. 	}
  39. 	csrBytes, _ := x509.CreateCertificateRequest(rand.Reader, &template, keyBytes)
  40. 	pem.Encode(os.Stdout, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrBytes})
  42. }
英文:

I know mephist answered his own question, but he left a few things to piece together. So, for the sake of completeness (and because I've landed here twice in the past 2 years...) Here's a complete working example: https://play.golang.org/p/YL_qfPe4Zz

  1. package main
  3. import (
  4. 	"crypto/rand"
  5. 	"crypto/rsa"
  6. 	"crypto/x509"
  7. 	"crypto/x509/pkix"
  8. 	"encoding/asn1"
  9. 	"encoding/pem"
  10. 	"os"
  11. )
  13. var oidEmailAddress = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 1}
  15. func main() {
  16. 	keyBytes, _ := rsa.GenerateKey(rand.Reader, 1024)
  18. 	emailAddress := "test@example.com"
  19. 	subj := pkix.Name{
  20. 		CommonName:         "example.com",
  21. 		Country:            []string{"AU"},
  22. 		Province:           []string{"Some-State"},
  23. 		Locality:           []string{"MyCity"},
  24. 		Organization:       []string{"Company Ltd"},
  25. 		OrganizationalUnit: []string{"IT"},
  26. 	}
  27. 	rawSubj := subj.ToRDNSequence()
  28. 	rawSubj = append(rawSubj, []pkix.AttributeTypeAndValue{
  29. 		{Type: oidEmailAddress, Value: emailAddress},
  30. 	})
  32. 	asn1Subj, _ := asn1.Marshal(rawSubj)
  33. 	template := x509.CertificateRequest{
  34. 		RawSubject:         asn1Subj,
  35. 		EmailAddresses:     []string{emailAddress},
  36. 		SignatureAlgorithm: x509.SHA256WithRSA,
  37. 	}
  39. 	csrBytes, _ := x509.CreateCertificateRequest(rand.Reader, &template, keyBytes)
  40. 	pem.Encode(os.Stdout, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrBytes})
  42. }

答案3

得分: 0

只需将其放在CommonName中即可。

  1. CommonName:         "domain.com/emailAddress=test@email.com",

主题：C=AU，O=Company Ltd，OU=IT，L=MyCity，ST=Some-State，CN=domain.com/emailAddress=test@email.com

英文:

Just put it in the CommonName?

  1. CommonName:         "domain.com/emailAddress=test@email.com",

>Subject: C=AU, O=Company Ltd, OU=IT, L=MyCity, ST=Some-State, CN=domain.com/emailAddress=test@email.com

huangapple
  • 本文由 发表于 2014年9月26日 00:13:53
  • 转载请务必保留本文链接：https://go.coder-hub.com/26043321.html
  • csr
  • go
  • ssl
  • x509
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定