Function md_cert_req_create

modules/md/md_crypt.c:1851–1945

}

apr_status_t md_cert_req_create(const char **pcsr_der_64, const char *name,
                                apr_array_header_t *domains, int must_staple, 
                                md_pkey_t *pkey, apr_pool_t *p)
{
    const char *s, *csr_der_64 = NULL;
    const unsigned char *domain;
    X509_REQ *csr;
    X509_NAME *n = NULL;
    STACK_OF(X509_EXTENSION) *exts = NULL;
    apr_status_t rv;
    md_data_t csr_der;
    int csr_der_len;
    
    assert(domains->nelts > 0);
    md_data_null(&csr_der);

    if (NULL == (csr = X509_REQ_new()) 
        || NULL == (exts = sk_X509_EXTENSION_new_null())
        || NULL == (n = X509_NAME_new())) {
        rv = APR_ENOMEM;
        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: openssl alloc X509 things", name);
        goto out; 
    }

    /* subject name == first domain */
    domain = APR_ARRAY_IDX(domains, 0, const unsigned char *);
    /* Do not set the domain in the CN if it is longer than 64 octets.
     * Instead, let the CA choose a 'proper' name. At the moment (2021-01), LE will
     * inspect all SAN names and use one < 64 chars if it can be found. It will fail
     * otherwise.
     * The reason we do not check this beforehand is that the restrictions on CNs
     * are in flux. They used to be authoritative, now browsers no longer do that, but
     * no one wants to hand out a cert with "google.com" as CN either. So, we leave
     * it for the CA to decide if and how it hands out a cert for this or fails.
     * This solves issue where the name is too long, see #227 */
    if (strlen((const char*)domain) < 64
        && (!X509_NAME_add_entry_by_txt(n, "CN", MBSTRING_ASC, domain, -1, -1, 0)
            || !X509_REQ_set_subject_name(csr, n))) {
        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, p, "%s: REQ name add entry", name);
        rv = APR_EGENERAL; goto out;
    }
    /* collect extensions, such as alt names and must staple */
    if (APR_SUCCESS != (rv = sk_add_alt_names(exts, domains, p))) {
        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: collecting alt names", name);
        rv = APR_EGENERAL; goto out;
    }
    if (must_staple && APR_SUCCESS != (rv = add_must_staple(exts, name, p))) {
        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: you requested that a certificate "
            "is created with the 'must-staple' extension, however the SSL library was "
            "unable to initialized that extension. Please file a bug report on which platform "
            "and with which library this happens. To continue before this problem is resolved, "
            "configure 'MDMustStaple off' for your domains", name);
        rv = APR_EGENERAL; goto out;
    }
    /* add extensions to csr */
    if (sk_X509_EXTENSION_num(exts) > 0 && !X509_REQ_add_extensions(csr, exts)) {
        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: adding exts", name);
        rv = APR_EGENERAL; goto out;