I have generated a certificate request with SANs using an inf file like this:
[Version] Signature="$Windows NT$" [NewRequest] Subject = "CN=someone,DC=acme,DC=com" KeyLength = 2048 [Extensions] 2.5.29.17 = "{text}" _continue_ = "dn=CN=someoneelse,DC=acme,DC=com"
If I submit the request, the certificate includes the SAN correctly.
My problem is that I need to read the request file programmatically:
using CERTENROLLLib; using System; class Program { const string RequestString = @"-----BEGIN NEW CERTIFICATE REQUEST-----..."; static void Main(string[] args) { CX509CertificateRequestPkcs10 request = new CX509CertificateRequestPkcs10(); request.InitializeDecode(RequestString, EncodingType.XCN_CRYPT_STRING_BASE64_ANY); Console.WriteLine("Subject: {0}", request.Subject.Name); foreach (IX509Extension ext in request.X509Extensions) { if (ext.ObjectId.Name == CERTENROLL_OBJECTID.XCN_OID_SUBJECT_ALT_NAME2) { CX509ExtensionAlternativeNames extensionAlternativeNames = new CX509ExtensionAlternativeNames(); // Following line fails with this COMException: // The requested property value is empty. (Exception from HRESULT: 0x80094004) string rawData = ext.RawData[EncodingType.XCN_CRYPT_STRING_BASE64]; extensionAlternativeNames.InitializeDecode(EncodingType.XCN_CRYPT_STRING_BASE64, rawData); foreach (CAlternativeName alternativeName in extensionAlternativeNames.AlternativeNames) { Console.WriteLine("SAN: {0}", alternativeName.strValue); } } } } }
The same code works perfectly if I generate a request with SANs using openssl, for example.
Any hints?
Thanks,
Paolo
Paolo Tedesco - http://cern.ch/idm