CMC 证书管理协议详解：RFC 4210 与 RFC 4211 的 PKI 自动化工具箱

# 伪代码：国密 CMC IssueRequest 构造
def build_cmcissue_request():
    # 1. 生成 SM2 密钥对
    private_key, public_key = sm2.generate_keypair()
    
    # 2. 构造 CSR（国密扩展）
    csr = build_sm2_csr(
        subject=build_rdn([
            ("CN", "client.example.com"),
            ("O", "Example Corp"),
            ("OU", "IT Department")
        ]),
        public_key=public_key,
        attributes={"challengePassword": "secureshare123"}
    )
    
    # 3. 封装 CMC 消息
    cmc_msg = {
        "cmcInfo": {
            "requestType": "issueRequest",
            "txnId": generate_transaction_id()
        },
        "messageBody": {
            "certRequest": csr,
            "keyEncrypted": encrypt_with_ca_pubkey(private_key)
        }
    }
    
    # 4. CMS 签名（SM2 + SM3）
    signed_cmc = cms_sign(cmc_msg, client_cert)
    
    return signed_cmc

class CMCTransactionManager:
    def __init__(self):
        self.pending = {}  # txnId -> RequestInfo
    
    def send_request(self, request):
        txn_id = self._generate_txn_id()
        self.pending[txn_id] = {
            "request": request,
            "timestamp": time.time(),
            "retries": 0
        }
        return txn_id
    
    def poll_status(self, txn_id):
        if txn_id not in self.pending:
            raise ValueError(f"Unknown transaction: {txn_id}")
        
        # 构造轮询请求
        poll_req = CMCMessage(
            cmcInfo={"requestType": "certPollRequest"},
            txnId=txn_id
        )
        
        response = self._send(poll_req)
        self.pending[txn_id]["status"] = response.status
        return response