Nabble - GnuPG - Gnutls - Dev

[generate-request.c]
/* This example code is placed in the public domain. */

#ifdef HAVE_CONFIG_H

# include <config.h>

#endif

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <gnutls/gnutls.h>

#include <gnutls/x509.h>

#include <time.h>

/* This example will generate a private key and a certificate

 * request.

 */

int

main (void)

{

  gnutls_x509_crq_t crq;

  gnutls_x509_privkey_t key;

  unsigned char buffer[10 * 1024];

  size_t buffer_size = sizeof (buffer);

  gnutls_global_init ();

  /* Initialize an empty certificate request, and

   * an empty private key.

   */

  gnutls_x509_crq_init (&crq);

  gnutls_x509_privkey_init (&key);

  /* Generate a 1024 bit RSA private key.

   */

  gnutls_x509_privkey_generate (key, GNUTLS_PK_DSA, 2048, 0);

  /* Add stuff to the distinguished name

   */

  gnutls_x509_crq_set_dn_by_oid (crq, GNUTLS_OID_X520_COUNTRY_NAME,

                                 0, "GB", 2);

  gnutls_x509_crq_set_dn_by_oid (crq, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME,

                                 0, "HelloWorld", strlen ("HelloWorld"));

  gnutls_x509_crq_set_dn_by_oid (crq, GNUTLS_OID_X520_LOCALITY_NAME,

                                 0, "HelloWorld", strlen ("HelloWorld"));

  gnutls_x509_crq_set_dn_by_oid (crq, GNUTLS_OID_X520_ORGANIZATION_NAME,

                                 0, "HelloWorld", strlen ("HelloWorld"));

  gnutls_x509_crq_set_dn_by_oid (crq, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME,

                                 0, "HelloWorld", strlen ("HelloWorld"));

  gnutls_x509_crq_set_dn_by_oid (crq, GNUTLS_OID_X520_COMMON_NAME,

                                 0, "HelloWorld", strlen ("HelloWorld"));

  gnutls_x509_crq_set_dn_by_oid (crq, GNUTLS_OID_PKCS9_EMAIL,

                                 0, "HelloWorld", strlen ("HelloWorld"));

  /* Set the request version.

   */

  gnutls_x509_crq_set_version (crq, 1);

  /* Set a challenge password.

   */

  gnutls_x509_crq_set_challenge_password (crq, "123456");

  /* Associate the request with the private key

   */

  gnutls_x509_crq_set_key (crq, key);

  /* Self sign the certificate request.

   */

  gnutls_x509_crq_sign (crq, key);

  /* Export the PEM encoded certificate request, and

   * display it.

   */

  gnutls_x509_crq_export (crq, GNUTLS_X509_FMT_PEM, buffer, &buffer_size);

  printf ("Certificate Request: \n%s", buffer);

  /* Export the PEM encoded private key, and

   * display it.

   */

  buffer_size = sizeof (buffer);

  gnutls_x509_privkey_export (key, GNUTLS_X509_FMT_PEM, buffer, &buffer_size);

  printf ("\n\nPrivate key: \n%s", buffer);

  gnutls_x509_crq_deinit (crq);

  gnutls_x509_privkey_deinit (key);

  return 0;

}

The output from OpenSSL asn1parse for CSR generated by OpenSSL (with similar DN attributes):

$ openssl asn1parse -in openssl.req
    0:d=0  hl=4 l= 452 cons: SEQUENCE
    4:d=1  hl=4 l= 301 cons: SEQUENCE
    8:d=2  hl=2 l=   1 prim: INTEGER           :00
   11:d=2  hl=3 l= 131 cons: SEQUENCE
   14:d=3  hl=2 l=  11 cons: SET
   16:d=4  hl=2 l=   9 cons: SEQUENCE
   18:d=5  hl=2 l=   3 prim: OBJECT            :countryName
   23:d=5  hl=2 l=   2 prim: PRINTABLESTRING   :IN
   27:d=3  hl=2 l=  20 cons: SET
   29:d=4  hl=2 l=  18 cons: SEQUENCE
   31:d=5  hl=2 l=   3 prim: OBJECT            :stateOrProvinceName
   36:d=5  hl=2 l=  11 prim: PRINTABLESTRING   :Maharashtra
   49:d=3  hl=2 l=  15 cons: SET
   51:d=4  hl=2 l=  13 cons: SEQUENCE
   53:d=5  hl=2 l=   3 prim: OBJECT            :localityName
   58:d=5  hl=2 l=   6 prim: PRINTABLESTRING   :Mumbai
   66:d=3  hl=2 l=  34 cons: SET
   68:d=4  hl=2 l=  32 cons: SEQUENCE
   70:d=5  hl=2 l=   3 prim: OBJECT            :organizationName
   75:d=5  hl=2 l=  25 prim: PRINTABLESTRING   :Tata Consultancy Services
  102:d=3  hl=2 l=  15 cons: SET
  104:d=4  hl=2 l=  13 cons: SEQUENCE
  106:d=5  hl=2 l=   3 prim: OBJECT            :organizationalUnitName
  111:d=5  hl=2 l=   6 prim: PRINTABLESTRING   :HP NED
  119:d=3  hl=2 l=  24 cons: SET
  121:d=4  hl=2 l=  22 cons: SEQUENCE
  123:d=5  hl=2 l=   3 prim: OBJECT            :commonName
  128:d=5  hl=2 l=  15 prim: PRINTABLESTRING   :www.scarlet.com
  145:d=2  hl=3 l= 159 cons: SEQUENCE
  148:d=3  hl=2 l=  13 cons: SEQUENCE
  150:d=4  hl=2 l=   9 prim: OBJECT            :rsaEncryption
  161:d=4  hl=2 l=   0 prim: NULL                                    <==========
  163:d=3  hl=3 l= 141 prim: BIT STRING
  307:d=2  hl=2 l=   0 cons: cont [ 0 ]
  309:d=1  hl=2 l=  13 cons: SEQUENCE
  311:d=2  hl=2 l=   9 prim: OBJECT            :md5WithRSAEncryption
  322:d=2  hl=2 l=   0 prim: NULL                                    <==========
  324:d=1  hl=3 l= 129 prim: BIT STRING

The output from OpenSSL asn1parse for CSR generated by GnuTLS:

$ openssl asn1parse -in gnu.req
    0:d=0  hl=4 l= 447 cons: SEQUENCE
    4:d=1  hl=4 l= 298 cons: SEQUENCE
    8:d=2  hl=2 l=   1 prim: INTEGER           :00
   11:d=2  hl=3 l= 131 cons: SEQUENCE
   14:d=3  hl=2 l=  11 cons: SET
   16:d=4  hl=2 l=   9 cons: SEQUENCE
   18:d=5  hl=2 l=   3 prim: OBJECT            :countryName
   23:d=5  hl=2 l=   2 prim: PRINTABLESTRING   :IN
   27:d=3  hl=2 l=  15 cons: SET
   29:d=4  hl=2 l=  13 cons: SEQUENCE
   31:d=5  hl=2 l=   3 prim: OBJECT            :localityName
   36:d=5  hl=2 l=   6 prim: PRINTABLESTRING   :Mumbai
   44:d=3  hl=2 l=  20 cons: SET
   46:d=4  hl=2 l=  18 cons: SEQUENCE
   48:d=5  hl=2 l=   3 prim: OBJECT            :stateOrProvinceName
   53:d=5  hl=2 l=  11 prim: PRINTABLESTRING   :Maharashtra
   66:d=3  hl=2 l=  24 cons: SET
   68:d=4  hl=2 l=  22 cons: SEQUENCE
   70:d=5  hl=2 l=   3 prim: OBJECT            :commonName
   75:d=5  hl=2 l=  15 prim: PRINTABLESTRING   :www.scarlet.com
   92:d=3  hl=2 l=  15 cons: SET
   94:d=4  hl=2 l=  13 cons: SEQUENCE
   96:d=5  hl=2 l=   3 prim: OBJECT            :organizationalUnitName
  101:d=5  hl=2 l=   6 prim: PRINTABLESTRING   :HP NED
  109:d=3  hl=2 l=  34 cons: SET
  111:d=4  hl=2 l=  32 cons: SEQUENCE
  113:d=5  hl=2 l=   3 prim: OBJECT            :organizationName
  118:d=5  hl=2 l=  25 prim: PRINTABLESTRING   :Tata Consultancy Services
  145:d=2  hl=3 l= 156 cons: SEQUENCE
  148:d=3  hl=2 l=  11 cons: SEQUENCE
  150:d=4  hl=2 l=   9 prim: OBJECT            :rsaEncryption
                                              --> NULL field missing
  161:d=3  hl=3 l= 140 prim: BIT STRING
  304:d=2  hl=2 l=   0 cons: cont [ 0 ]
  306:d=1  hl=2 l=  11 cons: SEQUENCE
  308:d=2  hl=2 l=   9 prim: OBJECT            :sha1WithRSAEncryption
                                              --> NULL field missing
  319:d=1  hl=3 l= 129 prim: BIT STRING

Is it possible that the CAs are unable to generate a valid certificate due to these NULL paddings or is there another reason why these CAs fail to parse the CSR.

Nabble - GnuPG - Gnutls - Dev

gnutls-2.8.5 failure on OpenSolaris

Re: gnutls-2.2.1 fails to build on HP-UX

gnutls failure on Solaris 10 update 7 gcc 4.4.1

Re: Help required for CSR validation

Re: Help required for CSR validation

Re: gnutls-2.2.1 fails to build on HP-UX

RE: Help required for CSR validation

Build error on 64-bit machine

Invitation to connect on LinkedIn

LinkedIn

gnutls-2.2.1 fails to build on HP-UX

Re: Help required for CSR validation

Re: Help required for CSR validation

Re: Help required for CSR validation

Re: Help required for CSR validation

Re: Help required for CSR validation

RE: Help required for CSR validation

Re: Help required for CSR validation

Re: GnuTLS 2.9.9 - uses non-portable option to grep.

RE: Help required for CSR validation

Re: GnuTLS 2.9.9 - uses non-portable option to grep.

Re: Help required for CSR validation

RE: Help required for CSR validation

Re: Help required for CSR validation

RE: Help required for CSR validation

Re: TLS Renegotiation problem

Re: Help required for CSR validation

Re: TLS Renegotiation problem

Help required for CSR validation

Re: TLS Renegotiation problem

Re: TLS Renegotiation problem

Re: TLS Renegotiation problem

Re: TLS Renegotiation problem

Re: TLS Renegotiation problem

Re: TLS Renegotiation problem

Re: TLS Renegotiation problem