X509v3 extensions from certificate not transferred to CSR
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 505
- Forks
- 157
- Avg merge
- 39m
- Merged PRs (30d)
- 1
Description
Hi,
After creating a certificate with several X509v3 extensions (e.g. X509v3 Extended Key Usage: TLS Web Client Authentication), I create a certificate signing request using e.g.
certificate.serialize_request_der()
However, the certificate signing request does not contain the extensions. This is in line with an earlier issue in OpenSSL, where extensions from the certificate were not transferred to the CSR and vice versa. This appears to have been fixed by now: https://github.com/openssl/openssl/issues/10458
Do you plan to add a feature to copy X509v3 extensions from the certificate into the CSR?
Thanks.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the serialize_request_der() entry point and trace how the certificate and CSR extensions are handled. Compare the current behavior with the linked OpenSSL issue; done means X509v3 extensions such as Extended Key Usage are present in the generated CSR.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100