def create_cert(self, profile):
before = datetime.utcnow()
after = before + timedelta(days=Config().config.getint("cert", "validity"))
pkey = SSL.create_key(Config().config.getint("cert", "key_size"))
ca = SSL.get_ca()
cert = SSL.create_cert(pkey)
if Config().config.get("ldap", "enable") and "false" not in Config().config.get("profile_" + profile, "ldap"):
print "Search in LDAP"
l = LDAP()
filter = Config().config.get("profile_" + profile, "ldap")
res = l.get_dn(l.get_basedn(), filter, ['cn', 'mail', 'uid'])
listSearch = {}
users = {}
for elt in res:
key = elt[0]
val = elt[1]['cn'][0]
mail = None
if 'mail' in elt[1].keys():
mail = elt[1]['mail'][0]
val = val + " (mail : " + elt[1]['mail'][0] + ")"
listSearch.update({key: val})
users.update({key: {'mail': mail, 'cn': elt[1]['cn'][0]}})
nbr_select = 0
while nbr_select != 1:
userList = Render.print_selector(listSearch)
nbr_select = len(userList)
email = users[userList[0]]['mail']
cn = users[userList[0]]['cn']
subject_array = userList[0].split(',')
subject_array.reverse()
subject_array.pop()
subject = '/'.join(subject_array) + "/CN=" + cn
else:
cn = raw_input("Common Name : ")
email = raw_input("Mail address : ")
subject = Config().config.get("ca", "base_cn") + "/CN=" + cn
subject_x509 = SSL.parse_str_to_x509Name(subject, cert.get_subject())
issuer_x509 = ca.get_subject()
if email:
subject_x509.emailAddress = email
cert.set_subject(subject_x509)
cert.set_issuer(issuer_x509)
cert.set_notBefore(before.strftime("%Y%m%d%H%M%S%Z")+"Z")
cert.set_notAfter(after.strftime("%Y%m%d%H%M%S%Z")+"Z")
cert.set_serial_number(int(time() * 1000000))
cert.set_version(2)
bsConst = "CA:FALSE"
cert.add_extensions([
crypto.X509Extension("basicConstraints", True, bsConst),
crypto.X509Extension("keyUsage", True, SSL.get_key_usage_from_profile(profile)),
crypto.X509Extension("subjectKeyIdentifier", False, "hash", subject=cert),
])
cert.add_extensions([
crypto.X509Extension("authorityKeyIdentifier", False, "keyid:always", issuer=ca)
])
cert.add_extensions([
crypto.X509Extension("extendedKeyUsage", False, SSL.get_extended_key_usage_from_profile(profile))
])
if Config().config.getboolean("crl", "enable"):
crlUri = "URI:" + Config().config.get("crl", "uri")
cert.add_extensions([
crypto.X509Extension("crlDistributionPoints", False, crlUri)
])
if Config().config.getboolean("ocsp", "enable"):
ocspUri = "OCSP;URI:" + Config().config.get("ocsp", "uri")
cert.add_extensions([
crypto.X509Extension("authorityInfoAccess", False, ocspUri)
])
cert_signed = SSL.sign(cert, SSL.get_ca_privatekey(), Config().config.get("cert", "digest"))
SSL.set_cert(cert_signed)
SSL.set_cert_privatekey(cert_signed, pkey)
if Config().config.getboolean("ldap", "enable"):
LDAP.add_queue(cert_signed)
def create_ca(self, force=False):
if Config().config.get("ca", "type") == "subca":
api = API(Config().config.get("ca", "parentca"))
before = datetime.utcnow()
after = before + timedelta(days=Config().config.getint("ca", "validity"))
pkey = SSL.create_key(Config().config.getint("ca", "key_size"))
ca = SSL.create_cert(pkey)
subject = Config().config.get("ca", "base_cn") + "/CN=" + Config().config.get("ca", "name")
subject_x509 = SSL.parse_str_to_x509Name(subject, ca.get_subject())
if Config().config.get("ca", "type") == "rootca":
issuer_x509 = SSL.parse_str_to_x509Name(subject, ca.get_issuer())
if Config().config.get("ca", "email"):
subject_x509.emailAddress = Config().config.get("ca", "email")
if Config().config.get("ca", "type") == "rootca":
issuer_x509.emailAddress = Config().config.get("ca", "email")
ca.set_subject(subject_x509)
if Config().config.get("ca", "type") == "rootca":
ca.set_issuer(issuer_x509)
ca.set_notBefore(before.strftime("%Y%m%d%H%M%S%Z")+"Z")
ca.set_notAfter(after.strftime("%Y%m%d%H%M%S%Z")+"Z")
ca.set_serial_number(int(time() * 1000000))
ca.set_version(2)
bsConst = "CA:TRUE"
if Config().config.getboolean("ca", "isfinal"):
bsConst += ", pathlen:0"
ca.add_extensions([
crypto.X509Extension("basicConstraints", True, bsConst),
crypto.X509Extension("keyUsage", True, "keyCertSign, cRLSign"),
crypto.X509Extension("subjectKeyIdentifier", False, "hash", subject=ca),
])
if Config().config.get("ca", "type") == "rootca":
ca.add_extensions([
crypto.X509Extension("authorityKeyIdentifier", False, "keyid:always", issuer=ca)
])
# if EventManager.hasEvent("new_cert"):
# ca = EventManager.new_cert(ca)
if Config().config.getboolean("crl", "enable"):
crlUri = "URI:" + Config().config.get("crl", "uri")
ca.add_extensions([
crypto.X509Extension("crlDistributionPoints", False, crlUri)
])
if Config().config.getboolean("ocsp", "enable"):
ocspUri = "OCSP;URI:" + Config().config.get("ocsp", "uri")
ca.add_extensions([
crypto.X509Extension("authorityInfoAccess", False, ocspUri)
])
if Config().config.get("ca", "type") == "subca":
data = api.push("ca_sign", {
"digest": Config().config.get("ca", "digest"),
"cert": api.encode_cert(ca)
})
if data['state'] == 'OK':
ca_signed = api.decode_cert(data['response'])
else:
print "Error during sign from remote API of Parent CA"
return False
else:
ca_signed = SSL.sign(ca, pkey, Config().config.get("ca", "digest"))
SSL.set_ca(ca_signed)
SSL.set_ca_privatekey(pkey)
if Config().config.getboolean("ldap", "enable"):
LDAP.add_queue(ca_signed)
if force:
self.resigned_all_cert()
