<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Usually I reserve C# for Windows servers. I use PHP on Ubuntu other Linux Distros. Most web servers that need OpenSSL are Linux. Glad you got it working. <br>
<br>
<br>
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Piotr Lobacz <piotr.lobacz@softgent.com> <br>
<b>Sent:</b> Monday, May 24, 2021 8:10 AM<br>
<b>To:</b> Michael McKenney <mike.mckenney@scsiraidguru.com>; openssl-users@openssl.org<br>
<b>Subject:</b> ODP: CSR generation using pkcs11 token engine from C# code<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Hi Michael,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">thx for your quick reply. Unfortunately i can't use your script because i need to use native code not bash implementation.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">For the first question about loading token module i have found a solution on github <a href="https://github.com/tkil/openssl-pkcs11-samples">https://github.com/tkil/openssl-pkcs11-samples</a> .
This code is a C/C++ code but i can fairly port it to C#, and i was right about different load of engine for pkcs11 engine. So this can be closed.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Another thing is to generate CSR with the usage of token and openssl. This will be more complicated and i don't know yet how to do that.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">BR<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Piotr<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">Od:</span></b><span style="color:black"> Michael McKenney <<a href="mailto:mike.mckenney@scsiraidguru.com">mike.mckenney@scsiraidguru.com</a>><br>
<b>Wysłane:</b> poniedziałek, 24 maja 2021 13:28<br>
<b>Do:</b> Piotr Lobacz <<a href="mailto:piotr.lobacz@softgent.com">piotr.lobacz@softgent.com</a>>;
<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a> <<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>><br>
<b>Temat:</b> RE: CSR generation using pkcs11 token engine from C# code</span> <o:p>
</o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">I wrote this script years ago when I switched to Godaddy 10 site certificates. I don't use it from C# You could easily put it into C# or PHP. < > would be variables at the top. I have it filled in so I just modify the alt_names.
I just cut and paste the all of it into Ubuntu and run it in the directory /etc/apache2/ssl. If you don't need all 10, you can delete the extra ones in alt_names.
<br>
<br>
<br>
openssl req -new -sha256 -nodes -out \<crs_name.csr> -newkey rsa:2048 -keyout \<your key name.key> -config <(<br>
cat <<-EOF<br>
[req]<br>
default_bits = 2048<br>
prompt = no<br>
default_md = sha256<br>
req_extensions = req_ext<br>
distinguished_name = dn<br>
<br>
[ dn ]<br>
C= < country ><br>
ST= < Your States ><br>
L= < City or location ><br>
O= < Organization ><br>
OU= <Organizational Unit ><br>
emailAddress= <your email><br>
CN = <The common name of the cert><br>
<br>
[ req_ext ]<br>
subjectAltName = @alt_names<br>
<br>
[ alt_names ]<br>
DNS.1 = < domain #1 ><br>
DNS.2 = < domain #2 ><br>
DNS.3 = < domain #3 ><br>
DNS.4 = < domain #4 ><br>
DNS.5 = < domain #5 ><br>
DNS.6 = < domain #6 ><br>
DNS.7 = < domain #7 ><br>
DNS.8 = < domain #8 ><br>
DNS.9 = < domain #9 ><br>
EOF<br>
)<br>
<br>
<br>
<br>
<br>
<br>
<br>
-----Original Message-----<br>
From: openssl-users <<a href="mailto:openssl-users-bounces@openssl.org">openssl-users-bounces@openssl.org</a>> On Behalf Of Piotr Lobacz<br>
Sent: Monday, May 24, 2021 5:54 AM<br>
To: <a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br>
Subject: CSR generation using pkcs11 token engine from C# code<br>
<br>
Hi all,<br>
i am currently trying to generate CSR with the usage of tpm2-pkcs11 module together with pkcs11 engine from opensc and the whole thing running with openssl api from C# code.<br>
<br>
I have checked that my solution works from command line. I have added these lines:<br>
<br>
openssl_conf = openssl_init<br>
<br>
[openssl_init]<br>
engines = engine_section<br>
<br>
[engine_section]<br>
pkcs11 = pkcs11_section<br>
<br>
[pkcs11_section]<br>
engine_id = pkcs11<br>
dynamic_path = /usr/lib/engines-1.1/libpkcs11.so MODULE_PATH = /usr/lib/libtpm2_pkcs11.so init = 0<br>
<br>
to the /etc/ssl/openssl.cnf configuration file and than this command:<br>
<br>
openssl req -new -subj '/C=PL/ST=Gdansk/L=Gdansk/CN=softgent.com/' -sha256 -engine pkcs11 -keyform engine -key "pkcs11:token=foo;object=tls;type=private;pin-value=1234567890"<br>
<br>
produces CSR for me.<br>
<br>
Now i want to do all this, from C# code. I have found a C# library <a href="https://github.com/andyhopp/OpenSsl.DynamicEngine">
https://github.com/andyhopp/OpenSsl.DynamicEngine</a> which will load the engine, but i think that this won't be sufficient in a matter of pkcs11 engine, because i also need to load pkcs11 module. The question is what should i add to this library for propper
work in means of pkcs11 api? What i mean is to use all this data from cnf file to configure openssl. Another question is how to execute this command above for csr from C#? I suspect that because on linux C# sdk uses openssl api for all cryptographic operations
than it should be somehow similar to the C solution. I would be gratefull if someone could point me at least for a C solution of this issue.<br>
<br>
Best regards<br>
Piotr Lobacz<br>
[<a href="https://softgent.com/wp-content/uploads/2020/01/Zasob-14.png%5d%3chttps:/www.softgent.com">https://softgent.com/wp-content/uploads/2020/01/Zasob-14.png]<https://www.softgent.com</a>><br>
<br>
Softgent Sp. z o.o., Budowlanych 31d, 80-298 Gdansk, POLAND<br>
<br>
KRS: 0000674406, NIP: 9581679801, REGON: 367090912<br>
<br>
<a href="http://www.softgent.com">www.softgent.com</a><br>
<br>
Sąd Rejonowy Gdańsk-Północ w Gdańsku, VII Wydział Gospodarczy Krajowego Rejestru Sądowego<br>
<br>
KRS 0000674406, Kapitał zakładowy: 25 000,00 zł wpłacony w całości.<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>