title: How is the CSR signature constructed?
body: <p>I am trying to generate a CSR (Certificate Signing Request) in an embedded device. I have implemented some OpenSSL functions in one embedded device. Unfortunately I only have a few functions available. So far I've been able to generate an RSA private key and now I need to generate the CSR.</p>
  
  <p>My library does NOT have any of the functions such as <code>X509_REQ_new()</code>, <code>X509_REQ_get_subject_name()</code> etc. Therefore I'm building the CSR by means of creating a DER file directly.</p>
  
  <p>The CSR in DER format is decoded as follows:</p>
  
  <ol>
  <li>ASN1 Sequence</li>
  <li>Version</li>
  <li>Subject(s) name(s)</li>
  <li>Type of encryption</li>
  <li>Modulus &amp; Exponent (from my RSA Key)</li>
  <li>Attributes</li>
  <li>Signature (here is where my problem lies)</li>
  </ol>
  
  <p>If I had all the OpenSSL functions available I would use <code>X509_REQ_sign(x509_req, pKey, EVP_sha1())</code>, but as I said before I don't have any of the X509 objects available.</p>
  
  <p>What do I need to sign in order to build that part?</p>