Geek Answers Handbook

Is there a specification for CSR 'BEGIN' headers?

I noticed a slight difference in how OpenSSL and certreq generate PKCS10 CSRs:

OpenSSL:

-----BEGIN CERTIFICATE REQUEST-----

Certreq

-----BEGIN NEW CERTIFICATE REQUEST-----

(and footer with the same except for END)

The PKCS10 specification does not contain any information about these footers, so I suspect that they are not part of the specification. I would like to be able to handle as many CSR formats as possible, therefore:

Is there a specification for BEGIN CSR headers?

Also: are there other forms of the CSR header? What do CSR generation tools that are not used by openssl or certreq do?

+4
source share
2

RFC7468 CSR.

+2

BEGIN CSR?

, , .

@jariq, RFC 7468 .

xkcd: .

, OpenSSL...

PEM, OpenSSL, <openssl dir>/crypto/pem/pem.h>. NEW - , -, .

:

# define PEM_STRING_X509_OLD     "X509 CERTIFICATE"
# define PEM_STRING_X509         "CERTIFICATE"
# define PEM_STRING_X509_PAIR    "CERTIFICATE PAIR"
# define PEM_STRING_X509_TRUSTED "TRUSTED CERTIFICATE"
# define PEM_STRING_X509_REQ_OLD "NEW CERTIFICATE REQUEST"
# define PEM_STRING_X509_REQ     "CERTIFICATE REQUEST"
# define PEM_STRING_X509_CRL     "X509 CRL"
# define PEM_STRING_EVP_PKEY     "ANY PRIVATE KEY"
# define PEM_STRING_PUBLIC       "PUBLIC KEY"
# define PEM_STRING_RSA          "RSA PRIVATE KEY"
# define PEM_STRING_RSA_PUBLIC   "RSA PUBLIC KEY"
# define PEM_STRING_DSA          "DSA PRIVATE KEY"
# define PEM_STRING_DSA_PUBLIC   "DSA PUBLIC KEY"
# define PEM_STRING_PKCS7        "PKCS7"
# define PEM_STRING_PKCS7_SIGNED "PKCS #7 SIGNED DATA"
# define PEM_STRING_PKCS8        "ENCRYPTED PRIVATE KEY"
# define PEM_STRING_PKCS8INF     "PRIVATE KEY"
# define PEM_STRING_DHPARAMS     "DH PARAMETERS"
# define PEM_STRING_DHXPARAMS    "X9.42 DH PARAMETERS"
# define PEM_STRING_SSL_SESSION  "SSL SESSION PARAMETERS"
# define PEM_STRING_DSAPARAMS    "DSA PARAMETERS"
# define PEM_STRING_ECDSA_PUBLIC "ECDSA PUBLIC KEY"
# define PEM_STRING_ECPARAMETERS "EC PARAMETERS"
# define PEM_STRING_ECPRIVATEKEY "EC PRIVATE KEY"
# define PEM_STRING_PARAMETERS   "PARAMETERS"
# define PEM_STRING_CMS          "CMS"

grep :

$ grep -R -B 3 PEM_STRING_X509_OLD *
...
--
crypto/pem/pem_lib.c-
crypto/pem/pem_lib.c-    /* Permit older strings */
crypto/pem/pem_lib.c-
crypto/pem/pem_lib.c:    if (!strcmp(nm, PEM_STRING_X509_OLD) && !strcmp(name, PEM_STRING_X509))
--
...

CSR

, " " ( ) " " ( ) .

- PEM ( pre-and post-encapsulation , IIRC). IETF PKIX . . PF- rfc .

+4

More articles:


All Articles