Certificate Signing Requests

To get a cert from a CA, you generate a CSR (Certificate Signing Request, PKCS#10):

struct CertificationRequest {
    certificationRequestInfo {
        version (0)
        subject (DN)
        subjectPublicKeyInfo
        attributes (e.g. SAN extension request)
    }
    signatureAlgorithm
    signatureValue (over certificationRequestInfo, with subject's private key)
}

The CSR proves you possess the private key (because you signed the CSR with it).

Generation:

CA workflow:

1. Receive CSR.
2. Verify the CSR signature (proves possession of private key).
3. Apply identity validation (DV: domain validation; OV: organization; EV: extended).
4. Issue cert: build a tbsCertificate with the same subject pubkey, sign with CA's private key.

Domain validation methods (DV):

• HTTP-01: place a token at http://yoursite/.well-known/acme-challenge/....
• DNS-01: put a token in TXT record _acme-challenge.yoursite.
• TLS-ALPN-01: respond on TLS with a special ALPN value containing the token.

ACME (RFC 8555) is the protocol Let's Encrypt uses. We'll simulate one.