Feature: Certificate policies

rcgen/Cargo.toml

@@ -31,6 +31,10 @@ zeroize = { workspace = true, optional = true }
 [target."cfg(unix)".dev-dependencies]
 openssl = { workspace = true }
 
+[[example]]
+name = "certificate_policies"
+required-features = ["pem"]
+
 [[example]]
 name = "rsa-irc-openssl"
 required-features = ["pem"]

rcgen/examples/certificate_policies.rs

@@ -0,0 +1,56 @@
+// This example is a copy from `simple.rs` with the addition of the CertificatePolicies extension
+
+use std::fs;
+
+use rcgen::string::Ia5String;
+use rcgen::{
+	date_time_ymd, CertificateParams, CertificatePolicies, DistinguishedName, DnType,
+	InhibitAnyPolicy, KeyPair, PolicyInformation, SanType, UserNotice,
+};
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+	let mut params: CertificateParams = Default::default();
+	params.not_before = date_time_ymd(1975, 1, 1);
+	params.not_after = date_time_ymd(4096, 1, 1);
+	params.distinguished_name = DistinguishedName::new();
+	params
+		.distinguished_name
+		.push(DnType::OrganizationName, "Crab widgits SE");
+	params
+		.distinguished_name
+		.push(DnType::CommonName, "Master Cert");
+	params.subject_alt_names = vec![
+		SanType::DnsName("crabs.crabs".try_into()?),
+		SanType::DnsName("localhost".try_into()?),
+	];
+	params.certificate_policies = Some(
+		CertificatePolicies::new(false, PolicyInformation::any_policy())
+			.add_policy_unchecked(PolicyInformation::domain_validated())
+			.add_policy_unchecked(PolicyInformation::cps_uri(vec![
+				Ia5String::try_from("https://cps.example.com")?,
+				Ia5String::try_from("https://cps.example.org")?,
+			]))
+			.add_policy_unchecked(PolicyInformation::user_notice(&UserNotice::new_full(
+				"Example Org".into(),
+				vec![0, 1, 2, 3],
+				"Test message".into(),
+			))),
+	);
+
+	params.inhibit_any_policy = Some(InhibitAnyPolicy::new(2));
+
+	let key_pair = KeyPair::generate()?;
+	let cert = params.self_signed(&key_pair)?;
+
+	let pem_serialized = cert.pem();
+	let pem = pem::parse(&pem_serialized)?;
+	let der_serialized = pem.contents();
+	println!("{pem_serialized}");
+	println!("{}", key_pair.serialize_pem());
+	fs::create_dir_all("certs/")?;
+	fs::write("certs/cert.pem", pem_serialized.as_bytes())?;
+	fs::write("certs/cert.der", der_serialized)?;
+	fs::write("certs/key.pem", key_pair.serialize_pem().as_bytes())?;
+	fs::write("certs/key.der", key_pair.serialize_der())?;
+	Ok(())
+}