---
product: Chilkat
product_version: 11.7.0
language: vbnet
language_label: VB.NET
class: Csr
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/vbnetCsrRef.html
---
# Chilkat Csr — VB.NET — v11.7.0

> Chilkat 11.7.0 · language=vbnet · class=Csr
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/Csr.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/vbnet/guide.md`.

## Purpose

**Create, load, inspect, and verify Certificate Signing Requests.**

`Chilkat.Csr` is the Chilkat class for working with Certificate Signing Requests. It can create CSRs from RSA or ECDSA private keys, set common certificate subject fields, add custom subject fields by OID, include Subject Alternative Names, request certificate extensions, export CSRs in PEM or DER format, load existing CSRs, extract the public key, inspect SAN values, and verify the CSR signature.

**Create CSRs**

Generate certificate signing requests using RSA or ECDSA private keys and the subject fields required by the certificate authority.

**Subject fields**

Set common X.509 subject fields such as common name, organization, organizational unit, locality, state, country, and email address.

**Custom OID fields**

Add custom subject attributes by object identifier when a certificate authority or application profile requires nonstandard fields.

**Subject Alternative Names**

Include DNS names, IP addresses, email addresses, URIs, or other SAN entries needed for modern TLS and identity certificates.

**Extension requests**

Request certificate extensions that the issuing CA may include in the final certificate.

**Inspect and verify**

Load an existing CSR, extract its public key, inspect requested names and fields, and verify that the CSR signature is valid.

**Common pattern:** Create or load a private key, populate the subject and SAN values required by the certificate authority, generate the CSR in PEM or DER format, submit it to the CA, and keep the private key secure because it will be needed when using the issued certificate.

For an extended overview, see [Csr Class Overview](https://www.chilkatsoft.com/csr_class_overview.asp).

## Object creation, unlocking and error handling

**Object Creation**

```vbnet
Dim obj As New Chilkat.Csr()
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in VB.NET.

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `DebugLogFilePath As String` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `LastErrorHtml As String (ReadOnly)` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `LastErrorText As String (ReadOnly)` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `LastErrorXml As String (ReadOnly)` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `LastMethodSuccess As Boolean` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `VerboseLogging As Boolean` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `Version As String (ReadOnly)` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `CommonName` | property, read/write | `CommonName As String` |
| `Company` | property, read/write | `Company As String` |
| `CompanyDivision` | property, read/write | `CompanyDivision As String` |
| `Country` | property, read/write | `Country As String` |
| `EmailAddress` | property, read/write | `EmailAddress As String` |
| `HashAlgorithm` | property, read/write | `HashAlgorithm As String` |
| `Locality` | property, read/write | `Locality As String` |
| `MgfHashAlg` | property, read/write | `MgfHashAlg As String` |
| `PssPadding` | property, read/write | `PssPadding As Boolean` |
| `State` | property, read/write | `State As String` |
| `AddSan` | method | `Function AddSan(ByVal sanType As String, ByVal sanValue As String) As Boolean` |
| `GenCsrBd` | method | `Function GenCsrBd(ByVal privKey As PrivateKey, ByVal csrData As BinData) As Boolean` |
| `GenCsrPem` | method | `Function GenCsrPem(ByVal privKey As PrivateKey) As String` |
| `GetExtensionRequest` | method | `Function GetExtensionRequest(ByVal extensionReqXml As Xml) As Boolean` |
| `GetPublicKey` | method | `Function GetPublicKey(ByVal pubkey As PublicKey) As Boolean` |
| `GetSans` | method | `Function GetSans(ByVal sans As StringTable) As Boolean` |
| `GetSubjectField` | method | `Function GetSubjectField(ByVal oid As String) As String` |
| `LoadCsrPem` | method | `Function LoadCsrPem(ByVal csrPemStr As String) As Boolean` |
| `SetExtensionRequest` | method | `Function SetExtensionRequest(ByVal extensionReqXml As Xml) As Boolean` |
| `SetSubjectField` | method | `Function SetSubjectField(ByVal oid As String, ByVal value As String, ByVal asnType As String) As Boolean` |
| `VerifyCsr` | method | `Function VerifyCsr() As Boolean` |

## Properties

### Csr.CommonName

`Chilkat 11.7.0 · vbnet · Csr · CommonName · property · read/write · since 9.5.0.65`

```vbnet
CommonName As String
```

Gets or sets the subject common name (`CN`), OID `2.5.4.3`, for the CSR. For a TLS server request this has traditionally been a DNS hostname; for other certificate profiles it may identify a person, device, service, or organization.

Chilkat requires this property when generating a CSR. The exact value and validation rules are determined by the certificate authority and certificate profile.

**Do not use CN as a substitute for SAN:** For modern TLS certificates, add every DNS hostname or IP address through `AddSan`. Current TLS identity verification uses Subject Alternative Name entries, and the common name is retained primarily for compatibility and display.

### Csr.Company

`Chilkat 11.7.0 · vbnet · Csr · Company · property · read/write · since 9.5.0.65`

```vbnet
Company As String
```

Gets or sets the subject organization name (`O`), OID `2.5.4.10`. For organization-validated certificate profiles, this is typically the legal or verified organization name.

This property is optional at the PKCS #10 level, but a certificate authority may require it or replace it with a value established during identity validation.

### Csr.CompanyDivision

`Chilkat 11.7.0 · vbnet · Csr · CompanyDivision · property · read/write · since 9.5.0.65`

```vbnet
CompanyDivision As String
```

Gets or sets the subject organizational unit name (`OU`), OID `2.5.4.11`. It may identify a department, division, team, or other unit within the organization.

This property is optional. Some public certificate profiles restrict or omit organizational-unit values, so follow the requirements of the receiving CA.

### Csr.Country

`Chilkat 11.7.0 · vbnet · Csr · Country · property · read/write · since 9.5.0.65`

```vbnet
Country As String
```

Gets or sets the subject country name (`C`), OID `2.5.4.6`. The value is normally a two-letter uppercase ISO 3166-1 country code, such as `US`, `CA`, or `DE`.

This property is optional unless required by the certificate authority's enrollment profile.

**X.520 encoding:** The country-name attribute is defined as a two-character `PrintableString`. Do not place a full country name such as `United States` in this field.

### Csr.EmailAddress

`Chilkat 11.7.0 · vbnet · Csr · EmailAddress · property · read/write · since 9.5.0.65`

```vbnet
EmailAddress As String
```

Gets or sets the legacy PKCS #9 `emailAddress` subject attribute, OID `1.2.840.113549.1.9.1`. This property is optional.

**Prefer an email SAN for email identity:** The subject-DN `emailAddress` attribute is permitted for legacy compatibility but is deprecated in the Internet X.509 profile. When the certificate must identify an email address, also use `AddSan` with `rfc822Name`, as required by the target certificate profile.

### Csr.HashAlgorithm

`Chilkat 11.7.0 · vbnet · Csr · HashAlgorithm · property · read/write · since 9.5.0.82`

```vbnet
HashAlgorithm As String
```

Gets or sets the message-digest algorithm used when signing a generated CSR. Supported values are `sha1`, `sha256`, `sha384`, and `sha512`. The default is `sha256`.

This property selects the digest for the CSR's proof-of-possession signature. It does not select the signature algorithm that the certificate authority will use on the issued certificate.

**Avoid SHA-1 for new requests:** Use `sha256` or stronger unless a legacy enrollment system explicitly requires SHA-1. The digest must also be compatible with the supplied key type and the receiving CA.

### Csr.Locality

`Chilkat 11.7.0 · vbnet · Csr · Locality · property · read/write · since 9.5.0.65`

```vbnet
Locality As String
```

Gets or sets the subject locality name (`L`), OID `2.5.4.7`. This usually identifies a city, town, or other local jurisdiction.

This property is optional unless required by the certificate authority's enrollment profile.

### Csr.MgfHashAlg

`Chilkat 11.7.0 · vbnet · Csr · MgfHashAlg · property · read/write · since 9.5.0.83`

```vbnet
MgfHashAlg As String
```

Gets or sets the hash algorithm used by MGF1 in an RSASSA-PSS CSR signature. This property applies only when the private key is RSA and `PssPadding` is `True`.

Supported values are `sha256`, `sha384`, and `sha512`. The default is `sha256`.

**Common choice:** For straightforward interoperability, set this to the same digest selected by `HashAlgorithm` unless the receiving profile explicitly specifies different RSASSA-PSS parameters.

### Csr.PssPadding

`Chilkat 11.7.0 · vbnet · Csr · PssPadding · property · read/write · since 9.5.0.83`

```vbnet
PssPadding As Boolean
```

Controls the RSA signature scheme used when generating a CSR with an RSA private key. When `True`, Chilkat signs using RSASSA-PSS. When `False`, the RSA signature uses the traditional RSASSA-PKCS1-v1_5 scheme. This property has no effect for elliptic-curve keys.

**Related settings:** `HashAlgorithm` selects the digest of the certification-request information. When PSS is enabled, `MgfHashAlg` selects the digest used by MGF1.

**Interoperability:** RSASSA-PSS is a modern RSA signature scheme, but the receiving CA or enrollment protocol must support PSS algorithm parameters in PKCS #10 requests.

### Csr.State

`Chilkat 11.7.0 · vbnet · Csr · State · property · read/write · since 9.5.0.65`

```vbnet
State As String
```

Gets or sets the subject state or province name (`ST`, sometimes displayed as `S`), OID `2.5.4.8`.

This property is optional unless required by the certificate authority. Use the full jurisdiction name expected by the CA, such as `Illinois`, rather than assuming an abbreviation is accepted.

## Methods

### Csr.AddSan

`Chilkat 11.7.0 · vbnet · Csr · AddSan · method · since 9.5.0.84`

```vbnet
Function AddSan(ByVal sanType As String, ByVal sanValue As String) As Boolean
```

Adds one Subject Alternative Name to the CSR that will be generated. Call this method once for each name to request. The SAN values are carried as requested certificate extensions; the issuing certificate authority decides whether to validate and include them in the final certificate.

| `sanType` | Meaning and example |
| :--- | :--- |
| `dnsName` | A DNS hostname, such as `www.example.com` or an allowed wildcard such as `*.example.com`. |
| `IPAddress` | An IPv4 or IPv6 address, such as `192.0.2.10` or `2001:db8::10`. |
| `rfc822Name` | An Internet email address, such as `user@example.com`. |
| `uniformResourceIndicator` | A URI. This is Chilkat's accepted keyword; the X.509 `GeneralName` field is formally named `uniformResourceIdentifier`. |
| `directoryName` | An X.500 distinguished name. |
| `registeredID` | A registered object identifier. |
| `otherName`, `x400Address`, `ediPartyName` | Less common X.509 `GeneralName` forms used by specialized profiles. |

**TLS server certificates:** Put every DNS name and IP address that clients must validate in the SAN extension. Modern TLS identity checking uses `dNSName` and `iPAddress` SAN entries rather than relying on the subject common name.

Returns True for success, False for failure.

### Csr.GenCsrBd

`Chilkat 11.7.0 · vbnet · Csr · GenCsrBd · method · since 9.5.0.65`

```vbnet
Function GenCsrBd(ByVal privKey As PrivateKey, ByVal csrData As BinData) As Boolean
```

Generates a PKCS #10 Certificate Signing Request using the supplied RSA or elliptic-curve private key and writes the binary DER representation to `csrData`.

The generated request uses the subject fields, Subject Alternative Names, extension request, and signature settings currently configured on this object. The DER bytes are the same request data that would appear as the Base64 body returned by `GenCsrPem`.

**DER versus PEM:** DER is the binary ASN.1 encoding of the CSR. PEM is that DER data encoded as Base64 with certificate-request header and footer lines. Use DER for binary protocols such as EST when required by the receiving system.

Returns True for success, False for failure.

### Csr.GenCsrPem

`Chilkat 11.7.0 · vbnet · Csr · GenCsrPem · method · since 9.5.0.65`

```vbnet
Function GenCsrPem(ByVal privKey As PrivateKey) As String
```

Generates a PKCS #10 Certificate Signing Request using the supplied `PrivateKey` and the subject fields, Subject Alternative Names, extension request, and signature settings currently configured on this object. The private key may be RSA or elliptic-curve (ECDSA).

On success, returns the CSR in PEM form, normally enclosed by `-----BEGIN CERTIFICATE REQUEST-----` and `-----END CERTIFICATE REQUEST-----` lines. The Base64 body is the DER-encoded PKCS #10 request.

**What a CSR contains:** A CSR contains the subject name, the public key derived from `privKey`, optional attributes such as requested extensions, and a signature made with the corresponding private key. The private key itself is never included.

**Signature settings:** `HashAlgorithm` selects the digest. For RSA keys, `PssPadding` and `MgfHashAlg` control whether RSASSA-PSS is used and which MGF1 digest is encoded in its parameters.

Returns `Nothing` on failure

### Csr.GetExtensionRequest

`Chilkat 11.7.0 · vbnet · Csr · GetExtensionRequest · method · since 9.5.0.91`

```vbnet
Function GetExtensionRequest(ByVal extensionReqXml As Xml) As Boolean
```

Retrieves the PKCS #9 `extensionRequest` attribute, OID `1.2.840.113549.1.9.14`, from the currently loaded CSR. When present, the requested extensions are loaded into `extensionReqXml` as Chilkat ASN.1 XML.

**CSR contents only:** The returned XML describes extensions requested by the applicant. It does not show which extensions a certificate authority ultimately accepted or placed in an issued certificate.

Returns True for success, False for failure.

### Csr.GetPublicKey

`Chilkat 11.7.0 · vbnet · Csr · GetPublicKey · method · since 9.5.0.76`

```vbnet
Function GetPublicKey(ByVal pubkey As PublicKey) As Boolean
```

Copies the public key contained in the currently loaded CSR into `pubkey`. The resulting `PublicKey` object is independent of the CSR and contains no private-key material.

**Proof of possession:** A PKCS #10 request is signed with the private key corresponding to this public key. Use `VerifyCsr` to check that relationship; merely extracting the public key does not verify the CSR signature.

Returns True for success, False for failure.

### Csr.GetSans

`Chilkat 11.7.0 · vbnet · Csr · GetSans · method · since 9.5.0.91`

```vbnet
Function GetSans(ByVal sans As StringTable) As Boolean
```

Retrieves the Subject Alternative Names requested by the currently loaded CSR and writes them to the supplied `StringTable`.

**Requested, not issued:** These values are taken from the CSR's extension-request data. They describe what the applicant asked the CA to place in the certificate, not what a CA has validated or will necessarily issue.

Returns True for success, False for failure.

### Csr.GetSubjectField

`Chilkat 11.7.0 · vbnet · Csr · GetSubjectField · method · since 9.5.0.65`

```vbnet
Function GetSubjectField(ByVal oid As String) As String
```

Returns the value of a subject distinguished-name attribute from the currently loaded or configured CSR, identified by its object identifier. For example, OID `2.5.4.9` identifies *streetAddress*.

**OID-based lookup:** The short names commonly displayed in certificate tools, such as `CN`, `O`, `OU`, and `C`, are labels for specific OIDs. This method uses the numeric OID so uncommon or application-specific attributes can also be retrieved.

Returns `Nothing` on failure

### Csr.LoadCsrPem

`Chilkat 11.7.0 · vbnet · Csr · LoadCsrPem · method · since 9.5.0.65`

```vbnet
Function LoadCsrPem(ByVal csrPemStr As String) As Boolean
```

Loads a PEM-encoded PKCS #10 Certificate Signing Request. On success, the subject properties and retrieval methods on this object reflect the values contained in the loaded request, including its public key, Subject Alternative Names, and extension-request attribute when present.

**Loading is not verification:** Parsing a CSR does not prove that its signature is valid. Call `VerifyCsr` to verify that the request was signed by the private key corresponding to the public key carried in the CSR.

**No private key is loaded:** A PKCS #10 request contains only the public key and signature. The applicant must retain the original private key separately for use with the certificate issued by the CA.

Returns True for success, False for failure.

### Csr.SetExtensionRequest

`Chilkat 11.7.0 · vbnet · Csr · SetExtensionRequest · method · since 9.5.0.91`

```vbnet
Function SetExtensionRequest(ByVal extensionReqXml As Xml) As Boolean
```

Sets the PKCS #9 `extensionRequest` attribute, OID `1.2.840.113549.1.9.14`, for the CSR to be generated. `extensionReqXml` supplies the requested X.509 extensions as ASN.1 represented in Chilkat XML form.

**Purpose of extensionRequest:** PKCS #10 has no certificate-extension field of its own. Requested X.509 extensions, such as Subject Alternative Name, key usage, or extended key usage, are commonly carried in this signed attribute.

**A request is not a command:** The certificate authority may ignore, modify, reject, or independently validate any requested extension according to its enrollment profile and security policy.

Returns True for success, False for failure.

### Csr.SetSubjectField

`Chilkat 11.7.0 · vbnet · Csr · SetSubjectField · method · since 9.5.0.65`

```vbnet
Function SetSubjectField(ByVal oid As String, ByVal value As String, ByVal asnType As String) As Boolean
```

Sets a subject distinguished-name attribute identified by `oid`. For example, OID `2.5.4.9` identifies *streetAddress*. Use the dedicated properties such as `CommonName`, `Company`, and `Country` for the commonly used subject attributes.

`asnType` specifies the ASN.1 string type used to encode the value and may be `UTF8String`, `IA5String`, or `PrintableString`. Use `UTF8String` unless the attribute definition or certificate-authority profile requires another type.

| ASN.1 type | Typical use |
| :--- | :--- |
| `UTF8String` | General Unicode text and the preferred default for most modern directory attributes. |
| `IA5String` | ASCII-based attributes whose schema specifically requires IA5String, such as the legacy PKCS #9 `emailAddress` attribute. |
| `PrintableString` | Attributes constrained to the limited PrintableString character set, such as the X.520 country name. |

**Schema matters:** The OID determines the attribute's meaning and permitted syntax. A value can be valid text yet still be rejected by a CA if the selected ASN.1 type, length, or format does not match that attribute's schema or the CA's enrollment policy.

Returns True for success, False for failure.

### Csr.VerifyCsr

`Chilkat 11.7.0 · vbnet · Csr · VerifyCsr · method · since 9.5.0.83`

```vbnet
Function VerifyCsr() As Boolean
```

Verifies the digital signature on the currently loaded CSR using the public key embedded in that request. Returns `True` when the signature is cryptographically valid; otherwise returns `False`.

**What this proves:** Successful verification shows that the request was signed using the private key corresponding to the included public key and that the signed request data has not been altered.

**What this does not prove:** Signature verification does not validate the applicant's identity, confirm control of a DNS name or email address, approve requested extensions, establish trust, or issue a certificate. Those checks and policy decisions belong to the certificate authority.

Returns True for success, False for failure.

## Related classes

[`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/vbnet/classes/BinData.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/vbnet/classes/PrivateKey.md), [`PublicKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/vbnet/classes/PublicKey.md), [`StringTable`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/vbnet/classes/StringTable.md), [`Xml`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/vbnet/classes/Xml.md)