0

I am new to openssl. I am trying to implement the program to generate CSR using openssl and c++. I need to implement the following commands using C++.

openssl req -new -newkey rsa:1024 -nodes -keyout key.pem -out x509Req.pem.

I have tried a sample code from the tutorial http://www.codepool.biz/how-to-use-openssl-to-generate-x-509-certificate-request.html

bool gen_X509Req()
{
int             ret = 0;
RSA             *r = NULL;
BIGNUM          *bne = NULL;

int             nVersion = 1;
int             bits = 2048;
unsigned long   e = RSA_F4;

X509_REQ        *x509_req = NULL;
X509_NAME       *x509_name = NULL;
EVP_PKEY        *pKey = NULL;
RSA             *tem = NULL;
BIO             *out = NULL, *bio_err = NULL;

const char      *szCountry = "CA";
const char      *szProvince = "BC";
const char      *szCity = "Vancouver";
const char      *szOrganization = "Dynamsoft";
const char      *szCommon = "localhost";

const char      *szPath = "x509Req.pem";

// 1. generate rsa key
bne = BN_new();
ret = BN_set_word(bne,e);
if(ret != 1){
    goto free_all;
}

r = RSA_new();
ret = RSA_generate_key_ex(r, bits, bne, NULL);
if(ret != 1){
    goto free_all;
}

// 2. set version of x509 req
x509_req = X509_REQ_new();
ret = X509_REQ_set_version(x509_req, nVersion);
if (ret != 1){
    goto free_all;
}

// 3. set subject of x509 req
x509_name = X509_REQ_get_subject_name(x509_req);

ret = X509_NAME_add_entry_by_txt(x509_name,"C", MBSTRING_ASC, (const unsigned char*)szCountry, -1, -1, 0);
if (ret != 1){
    goto free_all;
}

ret = X509_NAME_add_entry_by_txt(x509_name,"ST", MBSTRING_ASC, (const unsigned char*)szProvince, -1, -1, 0);
if (ret != 1){
    goto free_all;
}

ret = X509_NAME_add_entry_by_txt(x509_name,"L", MBSTRING_ASC, (const unsigned char*)szCity, -1, -1, 0);
if (ret != 1){
    goto free_all;
}   

ret = X509_NAME_add_entry_by_txt(x509_name,"O", MBSTRING_ASC, (const unsigned char*)szOrganization, -1, -1, 0);
if (ret != 1){
    goto free_all;
}

ret = X509_NAME_add_entry_by_txt(x509_name,"CN", MBSTRING_ASC, (const unsigned char*)szCommon, -1, -1, 0);
if (ret != 1){
    goto free_all;
}

// 4. set public key of x509 req
pKey = EVP_PKEY_new();
EVP_PKEY_assign_RSA(pKey, r);
r = NULL;   // will be free rsa when EVP_PKEY_free(pKey)

ret = X509_REQ_set_pubkey(x509_req, pKey);
if (ret != 1){
    goto free_all;
}

// 5. set sign key of x509 req
ret = X509_REQ_sign(x509_req, pKey, EVP_sha1());    // return x509_req->signature->length
if (ret <= 0){
    goto free_all;
}

out = BIO_new_file(szPath,"w");
ret = PEM_write_bio_X509_REQ(out, x509_req);

// 6. free
 free_all:
X509_REQ_free(x509_req);
BIO_free_all(out);

EVP_PKEY_free(pKey);
BN_free(bne);

return (ret == 1); 
 }

It is able to create the x509Req.pem file, but when I open it in the linux with file open, it is showing the error "Could not display 'x509Req.pem' Reason: Unrecognized or unsupported data." Could you any one please tell me how to solve this error or any other tutorials to generate CSR using c++ and openssl.

enter image description here

Thanks in advance.

closed as off-topic by Tobi Nary, forest, schroeder May 1 '18 at 14:26

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    This probably belongs on stackoverflow. – Peter Harmann Apr 29 '18 at 13:15
  • Thanks for the suggestion, but I already posted in there, but nobody gave me the reply. I was hoping that I could get one here. – Kumar Apr 29 '18 at 13:20
  • @Kumar: I also agree that this is off-topic. A reason why you might get no answer is that the information you provide are not sufficient for somebody to reproduce your problem since the code is not complete to compile it (but still minimal) and the error description is unclear ("...but it is showing the error..." - where this is shown?). – Steffen Ullrich Apr 29 '18 at 13:41
  • Sorry for the unclear description, I have edited a bit. The code is from a tutorial from the Tutorial link . It can generate CSR file but, when I open the csr ile (x509Req.pem) in linux. It shows the error "Could not display 'x509Req.pem' Reason: Unrecognized or unsupported data." . I hope this is helpful to understand my problem. – Kumar Apr 29 '18 at 13:56
  • @Kumar: The code works as intended. The only problem is probably that you don't know what to actually do with the created CSR and instead expect some magic to occur when doing your unspecific "...when I open the csr file". Use for example openssl req -in x509Req.pem -text to get the contents of the certificate request. – Steffen Ullrich Apr 29 '18 at 14:06
1

If you compare the output from openssl req -in yourcsr.pem -text with CSR created by the usual openssl commands you will find, that the version is shown as 1 in your CSR while 0 in the usual CSR:

Certificate Request:
    Data:
        Version: 1 (0x1)

This is due to the following code:

int             nVersion = 1;
...
ret = X509_REQ_set_version(x509_req, nVersion);

Looking at the Wikipedia page for CSR you will find that:

The first part, ASN.1 type CertificationRequestInfo, consists of a version number (which is 0 for all known versions, 1.0, 1.5, and 1.7 of the specifications)

Modifying your code to set nVersion=0 will result in a proper CSR which also can be successfully opened by the viewer you use. It looks like the viewer is an application which tries to adhere to the specification while other CSR reading programs simply ignore the version number since it does not provide any necessary information (should be 0 in all cases).

  • @Ullrich. Thank you so much for your help. It works fine. Still I need to learn a lot about. – Kumar Apr 29 '18 at 20:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.