gpt4 book ai didi

go - 如何在 GO 中创建带有扩展名和属性值的证书签名请求?

转载 作者:行者123 更新时间:2023-12-05 07:25:28 24 4
gpt4 key购买 nike

我正在尝试使用 crypto/x509 包来创建证书请求 (csr),但我不知道如何添加扩展和属性参数。

CertificateRequest struct我们可以看到扩展是 pkix.Extension 类型。这是 pki.Extension 的结构:

type Extension struct {
Id asn1.ObjectIdentifier
Critical bool `asn1:"optional"`
Value []byte
}

在代码中搜索,我在 https://golang.org/src/crypto/x509/x509.go 中找到了以下常量:

var (
oidExtKeyUsageAny = asn1.ObjectIdentifier{2, 5, 29, 37, 0}
oidExtKeyUsageServerAuth = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 1}
oidExtKeyUsageClientAuth = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 2}
oidExtKeyUsageCodeSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 3}
oidExtKeyUsageEmailProtection = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 4}
oidExtKeyUsageIPSECEndSystem = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 5}
oidExtKeyUsageIPSECTunnel = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 6}
oidExtKeyUsageIPSECUser = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 7}
oidExtKeyUsageTimeStamping = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 8}
oidExtKeyUsageOCSPSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 9}
oidExtKeyUsageMicrosoftServerGatedCrypto = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 10, 3, 3}
oidExtKeyUsageNetscapeServerGatedCrypto = asn1.ObjectIdentifier{2, 16, 840, 1, 113730, 4, 1}
oidExtKeyUsageMicrosoftCommercialCodeSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 2, 1, 22}
oidExtKeyUsageMicrosoftKernelCodeSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 61, 1, 1}
)

好的,现在我有了参数的Id。就我而言,我想将 KeyUsage 扩展设置为 serverAuth。我有 ID,但值是多少?

不知道我的做法对不对。有人可以帮我解决这个问题吗?

最佳答案

Attributes 字段被认为已弃用,无法正常工作。

当我必须向 csr 添加属性时,我将 x509.CreateCertificateRequest 所需的功能复制到内部文件并修复了 CreateCertificateRequest,在编码 certificateRequest 的 tbsCSR 字段之前以原始格式添加我的属性。注意:certificateRequest 结构不是 x509.CertifiacteRequest,该结构用于编码。以下是 passwordChallengeAttribute 的代码示例:

var oidChallengePassword = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 7}

type passwordChallengeAttribute struct {
Type asn1.ObjectIdentifier
Value []string `asn1:"set"`
}

passwordAttribute := passwordChallengeAttribute{
Type: oidChallengePassword,
Value: []string{challenge},
}

b, err := asn1.Marshal(passwordAttribute)
if err != nil {
//
}

var rawAttribute asn1.RawValue
asn1.Unmarshal(b, &rawAttribute)
tbsCSR.RawAttributes = append(tbsCSR.RawAttributes, rawAttribute)

但是使用扩展更好,也更受支持,所以你只需要实现代表所需扩展的数据结构,编码它并添加到扩展列表中。例如,添加 BasicConstraints 扩展:

type basicConstraints struct {
IsCA bool `asn1:"optional"`
MaxPathLen int `asn1:"optional,default:-1"`
}
var extensions []pkix.Extension
basicCon := basicConstraints{IsCA: true, MaxPathLen: -1}
bitstr, err := asn1.Marshal(basicCon)
if err != nil {
//
}
var oidExtensionBasicConstraints = []int{2, 5, 29, 19} //export from x509 package
bcExt := pkix.Extension{Id: oidExtensionBasicConstraints, Value: bitstr}
extensions = append(extensions, bcExt)
csrTmpl := &x509.CertificateRequest{
Extensions: extensions,
}

关于go - 如何在 GO 中创建带有扩展名和属性值的证书签名请求?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/54791135/

24 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com