Using C++ CryptAPI:CNG Create CSR

Question

Trying to create a CSR and using the enrollment APIs. Successfully created private key, and add extensions to it. but could not get it to generate CSR text from it. I get error as Invalid parameters/arguments or File already Exists (HRESULT)

I do not want to use OPENSSL, depending on WIN32 Crypto APIs for generating csr and storing the certificate.

I had looked at most of the sample which are in C#. I need it in C++. Here is my Sample Code WIN32 C++

    CComPtr<IX509CertificateRequestPkcs10> _csrquestpkcs10;
    CComPtr<IX509PrivateKey> _privateKey;
    CComPtr<ICspInformation> _cspInformation;
    CComPtr<ICspInformations> _cspInformations;
    CComPtr<IX500DistinguishedName> _distinguishName;
    CComPtr<IX509Enrollment> _enroll;
    CComPtr<IX509ExtensionKeyUsage> _extensionKeyUsage;
    CComPtr<IX509ExtensionEnhancedKeyUsage> _enhancedKeyUsageExtension;


    HRESULT hr = _cspInformation.CoCreateInstance(__uuidof(CCspInformation), NULL, CLSCTX_INPROC_SERVER);
    if (FAILED(hr)){
        return -1;
    }

    CComBSTR _proividerName(L"Microsoft Enhanced Cryptographic Provider v1.0");
    hr = _cspInformation->InitializeFromName(_proividerName);
    if (FAILED(hr)){
        return -1;
    }
    hr = _cspInformations.CoCreateInstance(__uuidof(CCspInformations), NULL, CLSCTX_INPROC_SERVER);
    if (FAILED(hr)){
        return -1;
    }
    hr = _cspInformations->Add(_cspInformation);
    if (FAILED(hr)){
        return -1;
    }

    hr = _privateKey.CoCreateInstance(__uuidof(CX509PrivateKey), NULL, CLSCTX_INPROC_SERVER);
    if (FAILED(hr)){
        return -1;
    }
    CComBSTR friendlyName("Certificate");
    _privateKey->put_FriendlyName(friendlyName);
    CComBSTR description("Certificate for my Server");
    _privateKey->put_Description(description);
    _privateKey->put_Length(2048);
    _privateKey->put_KeySpec(X509KeySpec::XCN_AT_SIGNATURE);
    _privateKey->put_KeyUsage(X509PrivateKeyUsageFlags::XCN_NCRYPT_ALLOW_ALL_USAGES);
    CComVariant _isMachineContext(true);
    _privateKey->put_MachineContext(_isMachineContext.boolVal);
    _privateKey->put_CspInformations(_cspInformations);

    hr = _privateKey->Create();
    _privateKey->Verify(X509PrivateKeyVerify::VerifyAllowUI);
    if (FAILED(hr)){
        return -1;
    }
    hr = _csrquestpkcs10.CoCreateInstance(__uuidof(CX509CertificateRequestPkcs10), NULL, CLSCTX_INPROC_SERVER);
    CComBSTR _template("");
    hr = _csrquestpkcs10->InitializeFromPrivateKey(X509CertificateEnrollmentContext::ContextMachine, _privateKey, _template);

    if (FAILED(hr)){
        return -1;
    }
    hr = _extensionKeyUsage.CoCreateInstance(__uuidof(CX509ExtensionKeyUsage), NULL, CLSCTX_INPROC_SERVER);


    hr = _extensionKeyUsage->InitializeEncode((X509KeyUsageFlags)(X509KeyUsageFlags::XCN_CERT_DIGITAL_SIGNATURE_KEY_USAGE
        |
        X509KeyUsageFlags::XCN_CERT_NON_REPUDIATION_KEY_USAGE |
        X509KeyUsageFlags::XCN_CERT_KEY_ENCIPHERMENT_KEY_USAGE |
        X509KeyUsageFlags::XCN_CERT_DATA_ENCIPHERMENT_KEY_USAGE)
        );
    CComPtr<IX509Extensions> _extensions;

    hr = _csrquestpkcs10->get_X509Extensions(&_extensions);
    if (FAILED(hr)){
        return -1;
    }
    hr = _extensions->Add(_extensionKeyUsage);

    CComPtr<IObjectId > _objectId;
    CComPtr<IObjectIds > _objectIds;

    hr = _objectId.CoCreateInstance(__uuidof(CObjectId), NULL, CLSCTX_INPROC_SERVER);
    CComBSTR _objId("1.3.6.1.5.5.7.3.2");
    _objectId->InitializeFromValue(_objId);

    _objectIds.CoCreateInstance(__uuidof(CObjectIds), NULL, CLSCTX_INPROC_SERVER);
    _objectIds->Add(_objectId);

    hr = _enhancedKeyUsageExtension.CoCreateInstance(__uuidof(CX509ExtensionEnhancedKeyUsage), NULL, CLSCTX_INPROC_SERVER);
    _enhancedKeyUsageExtension->InitializeEncode(_objectIds);
    _extensions->Add(_enhancedKeyUsageExtension);


    hr = _distinguishName.CoCreateInstance(__uuidof(CX500DistinguishedName), NULL, CLSCTX_INPROC_SERVER);
    std::string sdn = "CN=AKDEVELOPEMNT,OU=D,O=P,L=PUNE,S=HY,C=IN";
    CComBSTR _dn(sdn.c_str());
    hr = _distinguishName->Encode(_dn, X500NameFlags::XCN_CERT_X500_NAME_STR);
    if (FAILED(hr)){
        return -1;
    }
    hr = _csrquestpkcs10->put_Subject(_distinguishName);
    if (FAILED(hr)){
        return -1;
    }


    hr = _enroll.CoCreateInstance(__uuidof(CX509Enrollment), NULL, CLSCTX_INPROC_SERVER);

    if (FAILED(hr)){
        //PLog::instance()->Log(PLDEBUG, "[%s:%d] Encoding csr failed. %d, %d", __FUNCTION__, __LINE__, GetLastError(), hr);
        return -1;
    }

    hr = _enroll->InitializeFromRequest(_csrquestpkcs10);
    if (FAILED(hr)){
        return -1;
    }
    CComBSTR _request;
    hr = _enroll->CreateRequest(EncodingType::XCN_CRYPT_STRING_BASE64_ANY, &_request);      // NEVER RETURNED S_OK, 
    if (FAILED(hr)){
        _com_error er(hr);
        std::wstring error = er.ErrorMessage();
        wprintf("%s", error.c_str());                   // NEVER 
        return -1;
    }

SOLVED:

For Some Reason the XCN_CRYPT_STRING_BASE64_ANY is not a valid argument to IX509Enrollment::CreateRequest. I changed it to XCN_CRYPT_STRING_BASE64 and ALL Work OK

Answer 1

For Some Reason the XCN_CRYPT_STRING_BASE64_ANY is not a valid argument to IX509Enrollment::CreateRequest. I changed it to XCN_CRYPT_STRING_BASE64 and ALL Work OK

Though the MSDN does not provide the documentation for why XCN_CRYPT_STRING_BASE64_ANY is invalid argument, I guess the XCN_CRYPT_STRING_BASE64_ANY is meant to use for installing the response as it is combination of flags

and

while creating the CSR It needs specific output type ie. XCN_CRYPT_STRING_BASE64 or XCN_CRYPT_STRING_BASE64_HEADER