nx_acme_csr.nx
buildroot/runtime/nx_acme_csr.nx
about
nx_acme_csr.nx -- PKCS#10 CertificationRequest (CSR) for ECDSA P-256,
ECDSA-with-SHA256 self-signed. The ACME finalize step (RFC 8555 ยง7.4)
POSTs a DER CSR; Let's Encrypt issues ECDSA certs, so the in-tree
Ed25519 CSR path (nx_x509_csr_emit) is unusable -- this is its ECDSA
sibling. REUSABLE for any ECDSA P-256 CSR (not just ACME).
PKCS#10 (RFC 2986):
CertificationRequest ::= SEQUENCE {
certificationRequestInfo CertificationRequestInfo,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
CertificationRequestInfo ::= SEQUENCE {
version INTEGER (0),
subject Name,
subjectPKInfo SubjectPublicKeyInfo,
attributes [0] IMPLICIT SET OF Attribute }
Attribute (extensionRequest, OID 1.2.840.113549.1.9.14) ::= SEQUENCE {
type OID,
values SET OF { Extensions } } -- Extensions = SEQUENCE OF Extension
The signature is ECDSA over SHA-256(CertificationRequestInfo DER bytes),
emitted as DER SEQUENCE{INTEGER r, INTEGER s} inside the BIT STRING.
Composes the shipped nx_x509_build hub (nx_aw_* writers, name_cn, SPKI,
SAN, alg-ecdsa, sig-to-der) + nx_ecdsa_p256_sign + nx_sha256. Single
import of the hub pulls the whole closure (path-deduped).
license_tier: ORIGINAL (composes RFC 2986 + RFC 5280 SAN + the P-256 stack)
dependencies 1 imports · 1 importers
imports: nx_x509_build.nx
imported by: nx_acme_es256.nx
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 31 | const NX_MAGIC_1024: i64 = 1024 |
| 32 | const NX_MAGIC_2048: i64 = 2048 |
| 34 | const NX_ACME_CSR_OK: i64 = 0 |
| 35 | const NX_ACME_CSR_BAD_ARG: i64 = 1 |
| 36 | const NX_ACME_CSR_BUILD_ERR: i64 = 2 |
| 37 | const NX_ACME_CSR_SIGN_ERR: i64 = 3 |
| 40 | const NX_ACME_OID_EXT_REQUEST: *u8 = "\x2A\x86\x48\x86\xF7\x0D\x01\x09\x0E" as *u8 |
| 41 | const NX_ACME_OID_EXT_REQUEST_N: i64 = 9 |
functions
| 46 | func acme_csr_attributes(out: *u8, cap: i64, off: i64, |
| 86 | func nx_acme_build_csr_ecdsa_p256(cn: *u8, cn_n: i64, |
| 145 | func main() -> i64 |