X509Req removed in pyopenssl 26.4.0

Verified example for pyopenssl 26.4.0

#!/usr/bin/env python3
import warnings

from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.x509.oid import NameOID
from OpenSSL import crypto

# X509Req APIs are deprecated in recent pyOpenSSL releases; silence the warnings.
warnings.filterwarnings("ignore", category=DeprecationWarning)

CSR_PATH = "/tmp/request.csr"


def generate_csr_file(path):
    # Generate a 2048-bit RSA key
    key = crypto.PKey()
    key.generate_key(crypto.TYPE_RSA, 2048)
    crypto_key = key.to_cryptography_key()

    # Build the CSR
    req = (
        x509.CertificateSigningRequestBuilder()
        .subject_name(
            x509.Name(
                [
                    x509.NameAttribute(NameOID.COMMON_NAME, "example.internal"),
                    x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Acme Corp"),
                ]
            )
        )
        .sign(crypto_key, hashes.SHA256())
    )

    # Save as PEM
    pem = req.public_bytes(serialization.Encoding.PEM)
    with open(path, "wb") as f:
        f.write(pem)


def read_and_inspect_csr(path):
    with open(path, "rb") as f:
        pem_data = f.read()

    req = x509.load_pem_x509_csr(pem_data)

    subject = req.subject
    cn = subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value
    org = subject.get_attributes_for_oid(NameOID.ORGANIZATION_NAME)[0].value

    pubkey = req.public_key()
    key_bits = pubkey.key_size

    try:
        sig_ok = bool(req.is_signature_valid)
    except crypto.Error:
        sig_ok = False

    print(f"Subject CN: {cn}")
    print(f"Subject O: {org}")
    print(f"Public key size: {key_bits} bits")
    print(f"Signature verifies: {sig_ok}")


def main():
    generate_csr_file(CSR_PATH)
    read_and_inspect_csr(CSR_PATH)


if __name__ == "__main__":
    main()