def generate_push_certificate_csr():
"""Generate a signed push certificate for upload to the Apple Push Certificate Portal.
:resheader Content-Type: application/x-pem-file
:resheader Content-Type: application/x-x509-user-cert
:resheader Content-Type: application/x-x509-ca-cert
"""
private_key, csr = ssl.generate_signing_request('commandment')
private_key_model = RSAPrivateKey.from_crypto(private_key)
db.session.add(private_key_model)
csr_model = CertificateSigningRequest.from_crypto(csr)
db.session.add(csr_model)
encrypt_with = db.session.query(CACertificate).filter_by(
x509_cn='COMMANDMENT-CA').one()
base64_csr = b64encode(csr_model.pem_data)
base64_recipient = b64encode(encrypt_with.pem_data)
mdmcert_dict = {
'csr': base64_csr.decode('utf8'),
'email': '*****@*****.**',
'key': MDMCERT_API_KEY,
'encrypt': base64_recipient.decode('utf8'),
}
def mdmcert_request(email: str):
"""Ask the mdmcert.download service to generate a new Certificate Signing Request for the given e-mail address.
If an encryption certificate does not exist on the system, one will be generated to process the resulting encrypted
and signed CSR. The common name of the certificate will be the e-mail address that is registered with the
mdmcert.download service, and the type will be an EncryptionCertificate.
:reqheader Accept: application/json
:resheader Content-Type: application/json
"""
try:
apns_csr_model = db.session.query(CertificateSigningRequest).\
filter(CertificateSigningRequest.x509_cn == "commandment-apns").one()
except NoResultFound:
private_key, csr = cmdssl.generate_signing_request('commandment-apns')
private_key_model = RSAPrivateKey.from_crypto(private_key)
db.session.add(private_key_model)
apns_csr_model = CertificateSigningRequest.from_crypto(csr)
apns_csr_model.rsa_private_key = private_key_model
db.session.add(apns_csr_model)
db.session.commit()
try:
encrypt_cert_model = db.session.query(EncryptionCertificate).\
filter(EncryptionCertificate.x509_cn == email).one()
except NoResultFound:
encrypt_key, encrypt_with_cert = cmdssl.generate_self_signed_certificate(
email)
encrypt_key_model = RSAPrivateKey.from_crypto(encrypt_key)
db.session.add(encrypt_key_model)
encrypt_cert_model = EncryptionCertificate.from_crypto(
encrypt_with_cert)
encrypt_cert_model.rsa_private_key = encrypt_key_model
db.session.add(encrypt_cert_model)
db.session.commit()
current_app.logger.info("Submitting request to mdmcert.download for %s",
email)
mdmcert_result = submit_mdmcert_request(
email=email,
csr_pem=apns_csr_model.pem_data,
encrypt_with_pem=encrypt_cert_model.pem_data,
)
return jsonify(mdmcert_result)