Pkcs10CertificationRequest adding in repated '/' when converted to base64 string

[mattsetaro]

Trying to create a PKCS#10 with BC, here is my code to do so:

           // fields
            var fields = new Dictionary<DerObjectIdentifier, string>
            {
                { X509Name.C, "US" },
                { X509Name.O, "mycompany" },
                { X509Name.CN, "ABC" },
                { X509Name.OU, "DEF" }
            };

            var subject = new X509Name(fields.Keys.ToList(), fields.Values.ToList());
            
            // keys
            var publicKey = PublicKeyFactory.CreateKey(key.PublicKeyBytes);
            var privateKey = PrivateKeyFactory.CreateKey(key.PrivateKeyBytes);
            
    
            // csr
            var algID = new DefaultSignatureAlgorithmIdentifierFinder().Find("SHA256withECDSA");
            var req = new Pkcs10CertificationRequest(algID.Algorithm.Id, subject, publicKey, null, privateKey);

            var csr = Convert.ToBase64String(req.GetEncoded());`

And here is the CSR that BC spits out:
MIIB7DCCAZECAQAwPTELMAkGA1UEBhMCVVMxEjAQBgNVBAoMCW15Y29tcGFueTEMMAoGA1UEAwwDQUJDMQwwCgYDVQQLDANERUYwggFLMIIBAwYHKoZIzj0CATCB9wIBATAsBgcqhkjOPQEBAiEA/////wAAAAEAAAAAAAAAAAAAAAD///////////////8wWwQg/////wAAAAEAAAAAAAAAAAAAAAD///////////////wEIFrGNdiqOpPns+u9VXaYhrxlHQawzFOw9jvOPD4n0mBLAxUAxJ02CIbnBJNqZnjhE50mt4GffpAEQQRrF9Hy4SxCR/i85uVjpEDydwN9gS3rM6D0oTlF2JjClk/jQuL+Gn+bjufrSnwPnhYrzjNXazFezsu2QGg3v1H1AiEA/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVECAQEDQgAE82RbFL64Kk1u0BI1OYrXvTfNk18Y4x3tW7+TDZM50Y0L6nPGpviuhAgWTtaxgbt/tXXd5n5H7be+xxSdSrMnxDAKBggqhkjOPQQDAgNJADBGAiEA9gF02pSZXvhpyF6tRw4Cmr/Oi9+q5V9YmIWrBTW62xICIQDDfwoXxKt39raR2xglQgWFaOzEbpbZNTdtydTkL3pnug==

Any ideas as to why the CSR has a bunch of '/'s in there?

[peterdettman]

'/' is a valid character in Base64, so what is the issue?

[mattsetaro]

if I used openssl to generate the CSR I get the following...
MIH3MIGdAgEAMDsxCzAJBgNVBAYTAlVTMRAwDgYDVQQKDAdlbWJlY3RhMQwwCgYD VQQDDANBQkMxDDAKBgNVBAsMA0RFRjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA BONjRta0TFgs5tcq4HDEBHkG9vWpnUxxqEx2vvq7uX/45wTzah+BiS1YgpLUvHd8 n4KtdzVZ1ru/I9IJrOyoYA2gADAKBggqhkjOPQQDAgNJADBGAiEArBBhe5G6T2WE VFmcfXGtKMV1EMCtbfLClCezD8HrSfACIQDNt+zMTE3x4zi6Aszyc3IncydsnUh3

Looks very different no?

The endpoint I am using accepts this CSR created by openssl (which has the same subject IDs) but not the one BC is creating.

[mattsetaro]

Even comparing the ASN1 objects with openssl they look different with the same data:

BC:

▶ openssl asn1parse -in csr.pem
0:d=0 hl=4 l= 491 cons: SEQUENCE
4:d=1 hl=4 l= 401 cons: SEQUENCE
8:d=2 hl=2 l= 1 prim: INTEGER :00
11:d=2 hl=2 l= 61 cons: SEQUENCE
13:d=3 hl=2 l= 11 cons: SET
15:d=4 hl=2 l= 9 cons: SEQUENCE
17:d=5 hl=2 l= 3 prim: OBJECT :countryName
22:d=5 hl=2 l= 2 prim: PRINTABLESTRING :US
26:d=3 hl=2 l= 18 cons: SET
28:d=4 hl=2 l= 16 cons: SEQUENCE
30:d=5 hl=2 l= 3 prim: OBJECT :organizationName
35:d=5 hl=2 l= 9 prim: UTF8STRING :mycompany
46:d=3 hl=2 l= 12 cons: SET
48:d=4 hl=2 l= 10 cons: SEQUENCE
50:d=5 hl=2 l= 3 prim: OBJECT :commonName
55:d=5 hl=2 l= 3 prim: UTF8STRING :ABC
60:d=3 hl=2 l= 12 cons: SET
62:d=4 hl=2 l= 10 cons: SEQUENCE
64:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName
69:d=5 hl=2 l= 3 prim: UTF8STRING :DEF
74:d=2 hl=4 l= 331 cons: SEQUENCE
78:d=3 hl=4 l= 259 cons: SEQUENCE
82:d=4 hl=2 l= 7 prim: OBJECT :id-ecPublicKey
91:d=4 hl=3 l= 247 cons: SEQUENCE
94:d=5 hl=2 l= 1 prim: INTEGER :01
97:d=5 hl=2 l= 44 cons: SEQUENCE
99:d=6 hl=2 l= 7 prim: OBJECT :prime-field
108:d=6 hl=2 l= 33 prim: INTEGER :FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF
143:d=5 hl=2 l= 91 cons: SEQUENCE
145:d=6 hl=2 l= 32 prim: OCTET STRING [HEX DUMP]:FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC
179:d=6 hl=2 l= 32 prim: OCTET STRING [HEX DUMP]:5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B
213:d=6 hl=2 l= 21 prim: BIT STRING
236:d=5 hl=2 l= 65 prim: OCTET STRING [HEX DUMP]:046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5
303:d=5 hl=2 l= 33 prim: INTEGER :FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551
338:d=5 hl=2 l= 1 prim: INTEGER :01
341:d=3 hl=2 l= 66 prim: BIT STRING
409:d=1 hl=2 l= 10 cons: SEQUENCE
411:d=2 hl=2 l= 8 prim: OBJECT :ecdsa-with-SHA256
421:d=1 hl=2 l= 72 prim: BIT STRING

OpenSSL:

▶ openssl asn1parse -in csr_os.pem
0:d=0 hl=3 l= 247 cons: SEQUENCE
3:d=1 hl=3 l= 157 cons: SEQUENCE
6:d=2 hl=2 l= 1 prim: INTEGER :00
9:d=2 hl=2 l= 59 cons: SEQUENCE
11:d=3 hl=2 l= 11 cons: SET
13:d=4 hl=2 l= 9 cons: SEQUENCE
15:d=5 hl=2 l= 3 prim: OBJECT :countryName
20:d=5 hl=2 l= 2 prim: PRINTABLESTRING :US
24:d=3 hl=2 l= 16 cons: SET
26:d=4 hl=2 l= 14 cons: SEQUENCE
28:d=5 hl=2 l= 3 prim: OBJECT :organizationName
33:d=5 hl=2 l= 7 prim: UTF8STRING :mycompany
42:d=3 hl=2 l= 12 cons: SET
44:d=4 hl=2 l= 10 cons: SEQUENCE
46:d=5 hl=2 l= 3 prim: OBJECT :commonName
51:d=5 hl=2 l= 3 prim: UTF8STRING :ABC
56:d=3 hl=2 l= 12 cons: SET
58:d=4 hl=2 l= 10 cons: SEQUENCE
60:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName
65:d=5 hl=2 l= 3 prim: UTF8STRING :DEF
70:d=2 hl=2 l= 89 cons: SEQUENCE
72:d=3 hl=2 l= 19 cons: SEQUENCE
74:d=4 hl=2 l= 7 prim: OBJECT :id-ecPublicKey
83:d=4 hl=2 l= 8 prim: OBJECT :prime256v1
93:d=3 hl=2 l= 66 prim: BIT STRING
161:d=2 hl=2 l= 0 cons: cont [ 0 ]
163:d=1 hl=2 l= 10 cons: SEQUENCE
165:d=2 hl=2 l= 8 prim: OBJECT :ecdsa-with-SHA256
175:d=1 hl=2 l= 73 prim: BIT STRING

[mattsetaro]

Was able to figure out the solution, it had to do with the keys that were being generated and used in the CSR.

Here is what the code to generate the keys looked like:

        X9ECParameters x9ec = ECNamedCurveTable.GetByName("P-256");
        ECDomainParameters ecDomain = new ECDomainParameters(x9ec.Curve, x9ec.G, x9ec.N, x9ec.H, x9ec.GetSeed());

        ECKeyPairGenerator generator = (ECKeyPairGenerator)GeneratorUtilities.GetKeyPairGenerator("ECDH");
        generator.Init(new ECKeyGenerationParameters(ecDomain, new SecureRandom()));

        // return our generated keys
        return generator.GenerateKeyPair();

And what I changed it to:

        ECKeyPairGenerator generator = (ECKeyPairGenerator)GeneratorUtilities.GetKeyPairGenerator("ECDH");
        generator.Init(new ECKeyGenerationParameters(SecObjectIdentifiers.SecP256r1, new SecureRandom()));

        // return our generated keys
        return generator.GenerateKeyPair();