x509-cert: adds a CertReq builder

[baloo]

Fixes #1031

Generates CSR like:

---- certificate_request stdout ----
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: CN = service.domination.world
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:1c:ac:ff:b5:5f:2f:2c:ef:d8:9d:89:eb:37:4b:
                    26:81:15:24:52:80:2d:ee:a0:99:16:06:81:37:d8:
                    39:cf:7f:c4:81:a4:44:92:30:4d:7e:f6:6a:c1:17:
                    be:fe:83:a8:d0:8f:15:5f:2b:52:f9:f6:18:dd:44:
                    70:29:04:8e:0f
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        Attributes:
            Requested Extensions:
                X509v3 Subject Alternative Name:
                    IP Address:192.0.2.0
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        73:29:74:17:23:a1:12:f4:94:82:3e:b8:8b:eb:f4:21:f4:80:
        7e:ba:1a:0e:63:b4:ea:03:5e:6c:87:43:f1:01:6d:19:34:3c:
        1c:f8:e7:0f:d0:1b:c4:5b:20:b5:80:46:dd:73:0a:84:b4:94:
        00:5e:a3:31:81:21:70:3b:57:a5
-----BEGIN CERTIFICATE REQUEST-----
MIH5MIGnAgEAMCMxITAfBgNVBAMMGHNlcnZpY2UuZG9taW5hdGlvbi53b3JsZDBZ
MBMGByqGSM49AgEGCCqGSM49AwEHA0IABBys/7VfLyzv2J2J6zdLJoEVJFKALe6g
mRYGgTfYOc9/xIGkRJIwTX72asEXvv6DqNCPFV8rUvn2GN1EcCkEjg+gIjAgBgkq
hkiG9w0BCQ4xEzARMA8GA1UdEQQIMAaHBMAAAgAwCgYIKoZIzj0EAwIDQQBzKXQX
I6ES9JSCPriL6/Qh9IB+uhoOY7TqA15sh0PxAW0ZNDwc+OcP0BvEWyC1gEbdcwqE
tJQAXqMxgSFwO1el
-----END CERTIFICATE REQUEST-----

[baloo]

cc @lumag

[lumag]

@baloo maybe I miss something, why do you have to pass extensions to the to_extension()?

[baloo]

@baloo maybe I miss something, why do you have to pass extensions to the to_extension()?

Because some extensions may require that, like Basic Constraints (https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.9):

Conforming CAs MUST include this extension in all CA certificates
   that contain public keys used to validate digital signatures on
   certificates and MUST mark the extension as critical in such
   certificates.  This extension MAY appear as a critical or non-
   critical extension in CA certificates that contain public keys used
   exclusively for purposes other than validating digital signatures on
   certificates.  Such CA certificates include ones that contain public
   keys used exclusively for validating digital signatures on CRLs and
   ones that contain key management public keys used with certificate
   enrollment protocols.  This extension MAY appear as a critical or
   non-critical extension in end entity certificates.

for now, the behavior of the crate is to mark BasicConstraints as critical, but I prefer to leave the door open if we need to revisit that.

[lumag]

I think we should check/fix that at the build time. For now I'd suggest skipping that (and it definitely isn't a part of CSR builder patchset).

[baloo]

Not a fan of breaking the API in the future if we ever need to have the other extensions to make a decision :/

[lumag]

Anyway, it should be a separate change (separate PR or patch inside the PR). Having everything spliced into a single patch makes review very hard. I'd suggest landing the RequestBuilder first and then taking a glance on the to_extension in a separate PR.

Regarding the quoted part. I think we should check that at the build time, depending on the profile/whatsoever, rather than enforcing it at the add_extensions time.

[baloo]

@lumag split that in its own commit.

[baloo]

🤦 and I did push to origin not my fork

[baloo]

@lumag last commit is what I meant with the trait Builder

[lumag]

@baloo the request builder an the trait looks good. As for the fist commit, I'd leave that up to you and @tarcieri .