PKCS10

PKCS #10, or Certification Request Syntax Standard, is a PKCS specification that defines the format of a certificate signing request (CSR). A CSR is sent by an entity to a certificate authority when applying for an X.509 digital certificate. The CSR contains the subject's identity information, the subject's public key, and optional attributes that may include constraints or extensions.

The PKCS #10 data structure is a signed object. At a high level, a CertificationRequest consists of certificationRequestInfo, the algorithm used to sign, and a signature over certificationRequestInfo. certificationRequestInfo itself includes a version, the subject name, the subjectPublicKeyInfo (the public key and its algorithm), and an attributes field, which is a set of attribute type/value pairs. PKCS #9 defines common attribute types used in CSRs, such as challengePassword and extensionRequest; the latter allows a requester to ask a CA to include extensions in the issued certificate, for example subject alternative names.

CSRs are typically encoded in DER and may be transported in PEM encoding with the header "BEGIN CERTIFICATE REQUEST." The CSR is signed with the requester’s private key; the CA validates the signature and the request contents before issuing a certificate, which binds the subject to the public key.

PKCS #10 is widely supported by PKI infrastructures and remains a commonly used standard for initial certificate enrollment, though modern tooling often also supports alternative enrollment mechanisms.