<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Michael,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
thx for your quick reply. Unfortunately i can't use your script because i need to use native code not bash implementation.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
For the first question about loading token module i have found a solution on github <a href="https://github.com/tkil/openssl-pkcs11-samples" id="LPlnk">https://github.com/tkil/openssl-pkcs11-samples</a> . This code is a C/C++ code but i can fairly port it to
C#, and i was right about different load of engine for pkcs11 engine. So this can be closed.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Another thing is to generate CSR with the usage of token and openssl. This will be more complicated and i don't know yet how to do that.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
BR</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Piotr</div>
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1"></div>
<br>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Od:</b> Michael McKenney <mike.mckenney@scsiraidguru.com><br>
<b>Wysłane:</b> poniedziałek, 24 maja 2021 13:28<br>
<b>Do:</b> Piotr Lobacz <piotr.lobacz@softgent.com>; openssl-users@openssl.org <openssl-users@openssl.org><br>
<b>Temat:</b> RE: CSR generation using pkcs11 token engine from C# code</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">I wrote this script years ago when I switched to Godaddy 10 site certificates. I don't use it from C# You could easily put it into C# or PHP. < > would be variables at the top. I have it filled in so I just modify the alt_names.
I just cut and paste the all of it into Ubuntu and run it in the directory /etc/apache2/ssl. If you don't need all 10, you can delete the extra ones in alt_names.
<br>
<br>
<br>
openssl req -new -sha256 -nodes -out \<crs_name.csr> -newkey rsa:2048 -keyout \<your key name.key> -config <(<br>
cat <<-EOF<br>
[req]<br>
default_bits = 2048<br>
prompt = no<br>
default_md = sha256<br>
req_extensions = req_ext<br>
distinguished_name = dn<br>
<br>
[ dn ]<br>
C= < country ><br>
ST= < Your States ><br>
L= < City or location ><br>
O= < Organization ><br>
OU= <Organizational Unit ><br>
emailAddress= <your email><br>
CN = <The common name of the cert><br>
<br>
[ req_ext ]<br>
subjectAltName = @alt_names<br>
<br>
[ alt_names ]<br>
DNS.1 = < domain #1 ><br>
DNS.2 = < domain #2 ><br>
DNS.3 = < domain #3 ><br>
DNS.4 = < domain #4 ><br>
DNS.5 = < domain #5 ><br>
DNS.6 = < domain #6 ><br>
DNS.7 = < domain #7 ><br>
DNS.8 = < domain #8 ><br>
DNS.9 = < domain #9 ><br>
EOF<br>
)<br>
<br>
<br>
<br>
<br>
<br>
<br>
-----Original Message-----<br>
From: openssl-users <openssl-users-bounces@openssl.org> On Behalf Of Piotr Lobacz<br>
Sent: Monday, May 24, 2021 5:54 AM<br>
To: openssl-users@openssl.org<br>
Subject: CSR generation using pkcs11 token engine from C# code<br>
<br>
Hi all,<br>
i am currently trying to generate CSR with the usage of tpm2-pkcs11 module together with pkcs11 engine from opensc and the whole thing running with openssl api from C# code.<br>
<br>
I have checked that my solution works from command line. I have added these lines:<br>
<br>
openssl_conf = openssl_init<br>
<br>
[openssl_init]<br>
engines = engine_section<br>
<br>
[engine_section]<br>
pkcs11 = pkcs11_section<br>
<br>
[pkcs11_section]<br>
engine_id = pkcs11<br>
dynamic_path = /usr/lib/engines-1.1/libpkcs11.so MODULE_PATH = /usr/lib/libtpm2_pkcs11.so init = 0<br>
<br>
to the /etc/ssl/openssl.cnf configuration file and than this command:<br>
<br>
openssl req -new -subj '/C=PL/ST=Gdansk/L=Gdansk/CN=softgent.com/' -sha256 -engine pkcs11 -keyform engine -key "pkcs11:token=foo;object=tls;type=private;pin-value=1234567890"<br>
<br>
produces CSR for me.<br>
<br>
Now i want to do all this, from C# code. I have found a C# library <a href="https://github.com/andyhopp/OpenSsl.DynamicEngine">
https://github.com/andyhopp/OpenSsl.DynamicEngine</a> which will load the engine, but i think that this won't be sufficient in a matter of pkcs11 engine, because i also need to load pkcs11 module. The question is what should i add to this library for propper
work in means of pkcs11 api? What i mean is to use all this data from cnf file to configure openssl. Another question is how to execute this command above for csr from C#? I suspect that because on linux C# sdk uses openssl api for all cryptographic operations
than it should be somehow similar to the C solution. I would be gratefull if someone could point me at least for a C solution of this issue.<br>
<br>
Best regards<br>
Piotr Lobacz<br>
[<a href="https://softgent.com/wp-content/uploads/2020/01/Zasob-14.png]<https://www.softgent.com">https://softgent.com/wp-content/uploads/2020/01/Zasob-14.png]<https://www.softgent.com</a>><br>
<br>
Softgent Sp. z o.o., Budowlanych 31d, 80-298 Gdansk, POLAND<br>
<br>
KRS: 0000674406, NIP: 9581679801, REGON: 367090912<br>
<br>
<a href="http://www.softgent.com">www.softgent.com</a><br>
<br>
Sąd Rejonowy Gdańsk-Północ w Gdańsku, VII Wydział Gospodarczy Krajowego Rejestru Sądowego<br>
<br>
KRS 0000674406, Kapitał zakładowy: 25 000,00 zł wpłacony w całości.<br>
</div>
</span></font></div>
</body>
</html>