Quick Navigator

Search Site

Unix VPS
A - Starter
B - Basic
C - Preferred
D - Commercial
MPS - Dedicated
Previous VPSs
* Sign Up! *

Contact Us
Online Help
Domain Status
Man Pages

Virtual Servers

Topology Map

Server Agreement
Year 2038

USA Flag



Man Pages

Manual Reference Pages  -  CRYPT::PKCS10 (3)

.ds Aq ’


Crypt::PKCS10 - parse PKCS #10 certificate requests



version 1.5


    use Crypt::PKCS10;

    Crypt::PKCS10->setAPIversion( 1 );
    my $decoded = Crypt::PKCS10->new( $csr ) or die Crypt::PKCS10->error;

    print $decoded;

    @names = $decoded->extensionValue(subjectAltName );
    @names = $decoded->subject unless( @names );

    %extensions = map { $_ => $decoded->extensionValue( $_ ) } $decoded->extensions


Crypt::PKCS10 parses PKCS #10 certificate requests (CSRs) and provides accessor methods to extract the data in usable form.

Common object identifiers will be translated to their corresponding names. Additionally, accessor methods allow extraction of single data fields. Bit Strings like signatures will be returned in their hexadecimal representation.

The access methods return the value corresponding to their name. If called in scalar context, they return the first value (or an empty string). If called in array context, they return all values.


Crypt::PKCS10 - parse PKCS #10 certificate requests


Access methods may exist for subject name components that are not listed here. To test for these, use code of the form:

  $locality = $decoded->localityName if( $decoded->can(localityName) );

If a name component exists in a CSR, the method will be present. The converse is not (always) true.

class method setAPIversion( CW$version )

Selects the API version (0 or 1) expected.

Must be called before calling any other method.
Version 0 - <B>DEPRECATEDB> Some OID names have spaces and descriptions

This is the format used for Crypt::PKCS10 version 1.3 and lower. The attributes method returns legacy data.

Version 1 OID names from RFCs - or at least compatible with OpenSSL and ASN.1 notation. The attributes method conforms to version 1.
If not called, a warning will be generated and the API will default to version 0.

In a future release, the warning will be changed to a fatal exception.

To ease migration, both old and new names are accepted by the API.

Every program should call setAPIversion(1).

class method new( CW$csr, CW%options )

Constructor, creates a new object containing the parsed PKCS #10 certificate request.

$csr may be a scalar containing the request, or a file handle from which to read it.

If a file handle is supplied, the caller should specify acceptPEM => 0 if the contents are DER.

The request may be PEM or binary DER encoded. Only one request is processed.

If PEM, other data (such as mail headers) may precede or follow the CSR.

    my $decoded = Crypt::PKCS10->new( $csr ) or die Crypt::PKCS10->error;

Returns undef if there is an I/O error or the request can not be parsed successfully.

Call error() to obtain more detail.

acceptPEM If <B>falseB>, the input must be in DER format. binmode will be called on a file handle.

If <B>trueB>, the input is checked for a PEM certificate request. If not found, the csr is assumed to be in DER format.

Default is <B>trueB>.

escapeStrings If <B>trueB>, strings returned for extension and attribute values are ’\’-escaped when formatted. This is compatible with OpenSSL configuration files.

The special characters are: ’\’, ’$’, and ’"’

If <B>falseB>, these strings are not ’\’-escaped. This is useful when they are being displayed to a human.

The default is <B>trueB>.

No exceptions are generated.

The object will stringify to a human-readable representation of the CSR. This is useful for debugging and perhaps for displaying a request. However, the format is not part of the API and may change. It should not be parsed by automated tools.

Exception: The public key and extracted request are PEM blocks, which other tools can extract.

    class method error

Returns a string describing the last error encountered;

class method name2oid( CW$oid )

Returns the OID corresponding to a name returned by an access method.

Not in API v0;

csrRequest( CW$format )

Returns the binary (ASN.1) request (after conversion from PEM and removal of any data beyond the length of the ASN.1 structure.

If $format is <B>trueB>, the request is returned as a PEM CSR. Otherwise as a binary string.

    Access methods for the subject’s distinguished name

Note that <B>subjectAltNameB> is prefered, and that modern certificate users will ignore the subject if <B>subjectAltNameB> is present.

subject( $format )

Returns the entire subject of the CSR.

In scalar context, returns the subject as a string in the form /componentName=value,value.
If format is <B>trueB>, long component names are used. By default, abbreviations are used when they exist.

  e.g. /countryName=AU/organizationalUnitName=Big org/organizationalUnitName=Smaller org
  or     /C=AU/OU=Big org/OU=Smaller org

In array context, returns an array of (componentName, [values]) pairs. Abbreviations are not used.

Note that the order of components in a name is significant.


Returns the common name(s) from the subject.

    my $cn = $decoded->commonName();


Returns the organizational unit name(s) from the subject


Returns the organization name(s) from the subject.


Returns the email address from the subject.


Returns the state or province name(s) from the subject.


Returns the country name(s) from the subject.

subjectAltName( CW$type )

Convenience method.

When $type is specified: returns the subject alternate name values of the specified type in list context, or the first value of the specified type in scalar context.

Returns undefined/empty list if no values of the specified type are present, or if the <B>subjectAltNameB> extension is not present.

Types can be any of:

 * rfc822Name
 * dNSName
 * uniformResourceIdentifier
 * iPAddress
 * registeredID

The types marked with ’*’ are the most common.

If $type is not specified:
In list context returns the types present in the subjectAlternate name.
In scalar context, returns the SAN as a string.


Returns the structure version as a string, e.g. v1 v2, or v3


Returns the public key algorithm according to its object identifier.

subjectPublicKey( CW$format )

If $format is <B>trueB>, the public key will be returned in PEM format.

Otherwise, the public key will be returned in its hexadecimal representation


Returns the signature algorithm according to its object identifier.


The signature will be returned in its hexadecimal representation

attributes( CW$name )

A request may contain a set of attributes. The attributes are OIDs with values. The most common is a list of requested extensions, but other OIDs can also occur. Of those, <B>challengePasswordB> is typical.

For API version 0, this method returns a hash consisting of all attributes in an internal format. This usage is <B>deprecatedB>.

For API version 1:

If $name is not specified, a list of attribute names is returned. The list does not include the requestedExtensions attribute. For that, use extensions();

If no attributes are present, the empty list (undef in scalar context) is returned.

If $name is specified, the value of the extension is returned. $name can be specified as a numeric OID.

In scalar context, a single string is returned, which may include lists and labels.

  cspName="Microsoft Strong Cryptographic Provider",keySpec=2,signature=("",0)

Special characters are escaped as described in options.

In array context, the value(s) are returned as a list of items, which may be references.

 print( " $_: ", scalar $decoded->attributes($_), "\n" )
                                   foreach ($decoded->attributes);

See the Table of known OID names below for a list of names.


Returns an array containing the names of all extensions present in the CSR. If no extensions are present, the empty list is returned.

The names vary depending on the API version; however, the returned names are acceptable to extensionValue, extensionPresent, and name2oid.

The values of extensions vary, however the following code fragment will dump most extensions and their value(s).

 print( "$_: ", $decoded->extensionValue($_,1), "\n" ) foreach ($decoded->extensions);

The sample code fragment is not guaranteed to handle all cases. Production code needs to select the extensions that it understands and should respect the <B>criticalB> boolean. <B>criticalB> can be obtained with extensionPresent.

extensionValue( CW$name, CW$format )

Returns the value of an extension by name, e.g. extensionValue( keyUsage ). The name SHOULD be an API v1 name, but API v0 names are accepted for compatibility. The name can also be specified as a numeric OID.

If $format is 1, the value is a formatted string, which may include lists and labels. Special characters are escaped as described in options;

If $format is 0 or not defined, a string, or an array reference may be returned. The array many contain any Perl variable type.

To interpret the value(s), you need to know the structure of the OID.

See the Table of known OID names below for a list of names.

extensionPresent( CW$name )

Returns <B>trueB> if a named extension is present:
If the extension is <B>criticalB>, returns 2.
Otherwise, returns 1, indicating <B>not criticalB>, but present.

If the extension is not present, returns undef.

The name can also be specified as a numeric OID.

See the Table of known OID names below for a list of names.

    registerOID( )

Class method.

Register a custom OID, or a public OID that has not been added to Crypt::PKCS10 yet.

The OID may be an extension identifier or an RDN component.

The oid is specified as a string in numeric form, e.g.

registerOID( $oid )

Returns <B>trueB> if the specified OID is registered, <B>falseB> otherwise.

registerOID( $oid, $longname, $shortname )

Registers the specified OID with the associated long name. This enables the OID to be translated to a name in output.

The long name should be Hungarian case (<B>commonNameB>), but this is not currently enforced.

Optionally, specify the short name used for extracting the subject. The short name should be upper-case (and will be upcased).

E.g. built-in are $oid =>, $longname => commonName, $shortname => CN

Generates an exception if any argument is not valid, or is in use.

Returns <B>trueB> otherwise.


CertificateTemplate returns the <B>certificateTemplateB> attribute.

Equivalent to extensionValue( certificateTemplate ), which is prefered.

    Table of known OID names

The following OID names are known. They are used in returned strings and structures, and as names by methods such as <B>extensionValueB>.

Unknown OIDs are returned in numeric form, or can be registered with <B>registerOIDB>.

 OID                        Name (API v1)              Old Name (API v0)
 -------------------------- -------------------------- ---------------------------
 0.9.2342.19200300.100.1.1  userID
 0.9.2342.19200300.100.1.25 domainComponent
 1.2.840.10040.4.1          dsa                        (DSA)
 1.2.840.10040.4.3          dsaWithSha1                (DSA with SHA1)
 1.2.840.113549.1.1.1       rsaEncryption              (RSA encryption)
 1.2.840.113549.1.1.2       md2WithRSAEncryption       (MD2 with RSA encryption)
 1.2.840.113549.1.1.3       md4WithRSAEncryption
 1.2.840.113549.1.1.4       md5WithRSAEncryption       (MD5 with RSA encryption)
 1.2.840.113549.1.1.5       sha1WithRSAEncryption      (SHA1 with RSA encryption)
 1.2.840.113549.1.1.6       rsaOAEPEncryptionSET
 1.2.840.113549.1.1.7       RSAES-OAEP
 1.2.840.113549.1.1.11      sha256WithRSAEncryption    (SHA-256 with RSA encryption)
 1.2.840.113549.1.1.12      sha384WithRSAEncryption
 1.2.840.113549.1.1.13      sha512WithRSAEncryption    (SHA-512 with RSA encryption)
 1.2.840.113549.1.1.14      sha224WithRSAEncryption
 1.2.840.113549.1.9.1       emailAddress
 1.2.840.113549.1.9.2       unstructuredName
 1.2.840.113549.1.9.7       challengePassword
 1.2.840.113549.1.9.14      extensionRequest
 1.2.840.113549.1.9.15      smimeCapabilities          (SMIMECapabilities)     CERT_EXTENSIONS     msCodeInd     msCodeCom     msCTLSign     msTimeStamping     msSGC     msEFS   msEFSRecovery     msWHQLCrypto     msNT5Crypto     msOEMWHQLCrypto     msEmbeddedNTCrypto     msRootListSigner    msQualifiedSubordination    msKeyRecovery    msDocumentSigning    msLifetimeSigning    msMobileDeviceSoftware       RENEWAL_CERTIFICATE     ENROLLMENT_NAME_VALUE_PAIR     ENROLLMENT_CSP_PROVIDER     OS_Version       certificateTemplateName     msSmartCardLogon       certificateTemplate      ApplicationCertPolicies      ClientInformation            keyPurposeKdc              (KDC Authentication)          CPS          userNotice          serverAuth          clientAuth          codeSigning          emailProtection          timeStamping          OCSPSigning         sshClient         sshServer          countryOfResidence              sha1WithRSAEncryption      (SHA1 with RSA signature)                    commonName                    surname                    (Surname)                    serialNumber                    countryName                    localityName                    stateOrProvinceName                    streetAddress                   organizationName                   organizationalUnitName                   title                      (Title)                   description                (Description)                   searchGuide                   businessCategory                   postalAddress                   postalCode                   postOfficeBox                   physicalDeliveryOfficeName                   telephoneNumber                   facsimileTelephoneNumber                   name                       (Name)                   givenName                   initials                   generationQualifier                   uniqueIdentifier                   dnQualifier                   houseIdentifier                   pseudonym                  subjectKeyIdentifier       (SubjectKeyIdentifier)                  keyUsage                   (KeyUsage)                  subjectAltName                  basicConstraints           (Basic Constraints)                  certificatePolicies                anyPolicy                  extKeyUsage                (EnhancedKeyUsage)
 2.16.840.     sha256                     (SHA-256)
 2.16.840.1.113730.1.1      netscapeCertType
 2.16.840.1.113730.1.2      netscapeBaseUrl
 2.16.840.1.113730.1.4      netscapeCaRevocationUrl
 2.16.840.1.113730.1.7      netscapeCertRenewalUrl
 2.16.840.1.113730.1.8      netscapeCaPolicyUrl
 2.16.840.1.113730.1.12     netscapeSSLServerName
 2.16.840.1.113730.1.13     netscapeComment
 2.16.840.1.113730.4.1      nsSGC


In addition to the code snippets contained in this document, the t/ directory of the distribution contains a number of tests that exercise the API. Although artificial, they are a good source of examples.

Note that the type of data returned when extracting attributes and extensions is dependent on the specific OID used.

Also note that some functions not listed in this document are tested. The fact that they are tested does not imply that they are stable, or that they will be present in any future release.

The test data was selected to exercise the API; the CSR contents are not representative of realistic certificate requests.


Gideon Knocke

Timothe Litt made most of the changes for V1.4

Crypt::PKCS10 is based on the generic ASN.1 module by Graham Barr and on the
x509decode example by Norbert Klasen. It is also based upon the works of Duncan Segrest’s Crypt-X509-CRL module.


This software is copyright (c) 2014 by Gideon Knocke.

Changes in V1.4 are copyright (C) 2016, Timothe Litt

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.

Terms of the Perl programming language system itself

a) the GNU General Public License as published by the Free
Software Foundation; either version 1, or (at your option) any
later version, or

b) the Artistic License


o Gideon Knocke <>
o Timothe Litt <>


This software is copyright (c) 2014 by Gideon Knocke.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.

Search for    or go to Top of page |  Section 3 |  Main Index

perl v5.20.3 CRYPT::PKCS10 (3) 2016-02-19

Powered by GSP Visit the GSP FreeBSD Man Page Interface.
Output converted with manServer 1.07.