Crypt:...PKCS10(3pm)

💖 Crypt::OpenSSL::PKCS10 — the manual, but make it cute 💖

perl v5.42.3 · 2026-08-21 · User Contributed Perl Documentation · and yes bestie, we're in Crypt:...PKCS10(3pm) territory 🎀

---

✨ NAME ✨

Crypt::OpenSSL::PKCS10 — a Perl extension to OpenSSL's PKCS10 API. That's it, that's the name, she's serving exactly what she says on the tin 🫶

---

✨ SYNOPSIS ✨

okay so here's the whole vibe in one go, no notes:

use Crypt::OpenSSL::PKCS10 qw( :const );

my $req = Crypt::OpenSSL::PKCS10->new;
$req->set_subject("/C=RO/O=UTI/OU=ssi");
$req->add_ext(Crypt::OpenSSL::PKCS10::NID_key_usage,"critical,digitalSignature,keyEncipherment");
$req->add_ext(Crypt::OpenSSL::PKCS10::NID_ext_key_usage,"serverAuth, nsSGC, msSGC, 1.3.4");
$req->add_ext(Crypt::OpenSSL::PKCS10::NID_subject_alt_name,"email:steve@openssl.org");
$req->add_custom_ext('1.2.3.3',"My new extension");
$req->add_ext_final();
$req->sign();
$req->write_pem_req('request.pem');
$req->write_pem_pk('pk.pem');
print $req->get_pem_pubkey();
print $req->pubkey_type();
print $req->get_pem_req();

Crypt::OpenSSL::PKCS10->new()     # Defaults to a 1024-bit RSA private key

Crypt::OpenSSL::PKCS10->new(2048) # Specify a 2048-bit RSA private key

# With 2 arguements the keysize must be first
Crypt::OpenSSL::PKCS10->new(
                              2048,   # 2048-bit RSA keysize
                              {
                                  type    => 'rsa',      # Private key type ('rsa' or 'ec')
                                  hash    => 'SHA256',   # Hash Algorithm name
                              });

Crypt::OpenSSL::PKCS10->new(
                              {
                                  type    => 'ec',        # Private key type ('rsa' or 'ec')
                                  curve   => 'secp384r1', # Eliptic Curve type (secp384r1 default)
                                  hash    => 'SHA256',    # Hash Algorithm name
                              });

---

✨ ABSTRACT ✨

Crypt::OpenSSL::PKCS10 — Perl extension to OpenSSL's PKCS10 API. (She said it twice bc she means it 💅)

---

✨ DESCRIPTION ✨

Crypt::OpenSSL::PKCS10 gives you the power to create PKCS10 certificate requests using RSA key pairs. lowkey iconic, highkey essential 🌸

---

🦋 Class Methods 🦋

• new — creates a brand new shiny Crypt::OpenSSL::PKCS10 object by generating a fresh key pair ✨. There are two optional arguments: the key size, which defaults to 1024, and a hash of options you can use to customize things. Obsessed with options, truly.

Crypt::OpenSSL::PKCS10->new()     # Defaults to a 1024-bit RSA private key

Crypt::OpenSSL::PKCS10->new(2048) # Specify a 2048-bit RSA private key

# With 2 arguements the keysize must be first
Crypt::OpenSSL::PKCS10->new(
                              2048,   # 2048-bit RSA keysize
                              {
                                  type    => 'rsa',      # Private key type ('rsa' or 'ec')
                                  hash    => 'SHA256',   # Hash Algorithm name
                              });

Crypt::OpenSSL::PKCS10->new(
                              {
                                  type    => 'ec',        # Private key type ('rsa' or 'ec')
                                  curve   => 'secp384r1', # Eliptic Curve type (secp384r1 default)
                                  hash    => 'SHA256',    # Hash Algorithm name
                              });

• new_from_rsa( $rsa_object ) — makes a new Crypt::OpenSSL::PKCS10 object, but this time it pulls the key info from a Crypt::OpenSSL::RSA object instead of generating one from scratch. Here's the tea:

my $rsa = Crypt::OpenSSL::RSA->generate_key(512);
my $req = Crypt::OpenSSL::PKCS10->new_from_rsa($rsa);

my $rsa = Crypt::OpenSSL::RSA->generate_key(1024);
my $req = Crypt::OpenSSL::PKCS10->new_from_rsa($rsa, {type => 'rsa', hash => 'SHA384'});

⚠️ Heads up bestie: OpenSSL 3.0 has deprecated the RSA object which Crypt::OpenSSL::RSA creates. So new_from_rsa() is now a perl sub which obtains the private key as a string that is also passed to the _new_from_rsa() XS function. It's giving "we adapted, we slayed" 💅

• new_from_file( $filename ) — creates a new Crypt::OpenSSL::PKCS10 object by reading the request and key information from a PEM formatted file. Example time:

my $req = Crypt::OpenSSL::PKCS10->new_from_file("CSR.csr");

You can also specify the format of the PKCS10 file — either DER or PEM format. Cases:

my $req = Crypt::OpenSSL::PKCS10->new_from_file("CSR.csr", Crypt::OpenSSL::PKCS10::FORMAT_PEM());

my $req = Crypt::OpenSSL::PKCS10->new_from_file("CSR.der", Crypt::OpenSSL::PKCS10::FORMAT_ASN1());

---

💜 Instance Methods 💜

• set_subject($subject, [ $utf8 ])

Sets the subject DN of the request. Note: $subject is expected to be in the format /type0=value0/type1=value1/type2=... where characters may be escaped by \. If $utf8 is a non-zero integer, $subject is interpreted as a UTF-8 string. yes queen, escape responsibly 🎀

• add_ext($nid, $extension)

Adds a new extension to the request. The first argument $nid is one of the exported constants (scroll down, they're listed 💖). The second one, $extension, is a string (for more info read openssl(3)).

$req->add_ext(Crypt::OpenSSL::PKCS10::NID_key_usage,"critical,digitalSignature,keyEncipherment");
$req->add_ext(Crypt::OpenSSL::PKCS10::NID_ext_key_usage,"serverAuth, nsSGC, msSGC, 1.3.4");
$req->add_ext(Crypt::OpenSSL::PKCS10::NID_subject_alt_name,"email:steve@openssl.org");

• add_custom_ext($oid, $desc)

Adds a new custom extension to the request. The value is added as a text string, using ASN.1 encoding rules inherited from the Netscape Comment OID.

$req->add_custom_ext('1.2.3.3',"My new extension");

• add_custom_ext_raw($oid, $bytes)

Adds a new custom extension to the request. The value is added as a raw DER octet string. Use this if you are packing your own ASN.1 structures and need to set the extension value directly.

$req->add_custom_ext_raw($oid, pack('H*','1E06006100620063')) # BMPString 'abc'

• add_ext_final()

This must be called after all extensions has been added. It actually copies the extension stack to request structure. No skipping this step, bestie, it's the moment everything comes together ✨

$req->add_ext(Crypt::OpenSSL::PKCS10::NID_subject_alt_name,"email:my@email.org");
$req->add_ext_final();

• sign()

This adds the signature to the PKCS10 request. the way that a request just isn't a request until she signs 🔥

$req->sign();

$req->sign("SHA256");     # Set the hash to use for the signature

• pubkey_type()

Returns the type of the PKCS10 public key — one of (rsa|dsa|ec).

$req->pubkey_type();

• get_pubkey()

Returns the PEM encoding of the PKCS10 public key.

$req->get_pubkey();

• get_pem_req()

Returns the PEM encoding of the PKCS10 request.

$req->get_pem_req();

• write_pem_req($filename)

Writes the PEM encoding of the PKCS10 request to a given file.

$req->write_pem_req('request.pem');

• get_pem_pk()

Returns the PEM encoding of the private key. 🤫 keep this one safe

$req->get_pem_pk();

• write_pem_pk($filename)

Writes the PEM encoding of the private key to a given file.

$req->write_pem_pk('request.pem');

• subject()

returns the subject of the PKCS10 request

$subject = $req->subject();

• keyinfo()

returns the human readable info about the key of the PKCS10 request

$keyinfo = $req->keyinfo();

---

✨ EXPORT ✨

None by default. as she should, no unsolicited exports in this house 🙈

On request:

NID_key_usage NID_subject_alt_name NID_netscape_cert_type NID_netscape_comment
NID_ext_key_usage

---

💀 BUGS 💀

okay so listen closely because this one bites:

If you destroy $req object that is linked to a Crypt::OpenSSL::RSA object, the RSA private key is also freed, thus you can't use latter object anymore. Avoid this:

my $rsa = Crypt::OpenSSL::RSA->generate_key(512);
my $req = Crypt::OpenSSL::PKCS10->new_from_rsa($rsa);
undef $req;
print $rsa->get_private_key_string();

🚨 Not me warning you: vibe check your object lifetimes or your $rsa is gone gone, fr fr.

---

✨ SEE ALSO ✨

"Crypt::OpenSSL::RSA", "Crypt::OpenSSL::X509". the whole friend group 🫶 iykyk

---

🎀 AUTHOR 🎀

JoNO, <jonozzz@yahoo.com>

---

👑 COPYRIGHT AND LICENSE 👑

Copyright (C) 2006 by JoNO

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.2 or, at your option, any later version of Perl 5 you may have available.

---

and that's the whole page, bestie 💖 this was Crypt:...PKCS10(3pm) from perl v5.42.3, dated 2026-08-21, living in User Contributed Perl Documentation — go forth and sign those requests, you main character 🦋✨