EXERCISE 1 — Generating and inspecting a CSR
=============================================

Generate a key and a CSR with CN + SAN:
  openssl genpkey -algorithm RSA -out example.key

  openssl req -new -key example.key -out example.csr \
    -subj "/CN=example.com" \
    -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Inspect it:
  openssl req -in example.csr -text -noout

Example output (trimmed):
  Certificate Request:
      Data:
          Version: 1 (0x0)
          Subject: CN=example.com
          Subject Public Key Info:
              Public Key Algorithm: rsaEncryption
                  Public-Key: (2048 bit)
                  Modulus: ...
          Attributes:
              Requested Extensions:
                  X509v3 Subject Alternative Name:
                      DNS:example.com, DNS:www.example.com
      Signature Algorithm: sha256WithRSAEncryption   <- self-signature
      Signature Value: ...

WHAT IT CONTAINS:
  - Your PUBLIC key (the Public Key Info block).
  - The requested identity: Subject CN=example.com and the SAN list.
  - A self-signature (signed with example.key's PRIVATE key) proving you
    actually hold the private key matching the public key — without
    revealing the private key.

WHAT IT DOES *NOT* CONTAIN, AND WHY:
  - The PRIVATE key: it never leaves your server. The CA doesn't need it
    and must never have it — only you can prove ownership, and only you can
    use the eventual certificate. Sending it would destroy all security.
  - The ISSUER: there's no issuer yet because no CA has signed it. The
    issuer field is added when the CA produces the certificate.
  - The VALIDITY dates (Not Before / Not After): the CA decides the
    lifetime at issuance (e.g. 90 days for Let's Encrypt), so a request
    can't dictate them — they're absent until the cert is signed.

KEY IDEA: a CSR is "a certificate minus the parts only a CA can fill in"
(issuer + validity + CA signature). Compare this output to a real cert
from Chapter 4: same Subject/SAN/public key, but a cert ALSO has issuer,
validity, and the CA's signature.