def sign(csr): """Generate an X.509 certificate and sign it. :param csr: X509 certificate signing request """ try: ca = certificate.X509Certificate() ca.from_file(jsonloader.conf.ca["cert_path"]) except Exception as e: logger.exception("Cannot load the signing CA: %s", e) pecan.abort(500, "certificate signing error") try: key_data = None with open(jsonloader.conf.ca["key_path"]) as f: key_data = f.read() key = X509_utils.load_pem_private_key(key_data) except Exception as e: logger.exception("Cannot load the signing CA key: %s", e) pecan.abort(500, "certificate signing error") new_cert = certificate.X509Certificate() new_cert.set_version(2) start_time = int(time.time()) end_time = start_time + (jsonloader.conf.ca['valid_hours'] * 60 * 60) new_cert.set_not_before(start_time) new_cert.set_not_after(end_time) new_cert.set_pubkey(pkey=csr.get_pubkey()) new_cert.set_subject(csr.get_subject()) new_cert.set_issuer(ca.get_subject()) # NOTE(tkelsey): this needs to be in the range of an int serial = int(int(uuid.uuid4().hex, 16) % sys.maxsize) new_cert.set_serial_number(serial) exts = csr.get_extensions() for i, ext in enumerate(exts): logger.info("Adding certificate extension: %i %s", i, str(ext)) new_cert.add_extension(ext, i) logger.info("Signing certificate for <%s> with serial <%s>", csr.get_subject(), serial) new_cert.sign(key, jsonloader.conf.ca['signing_hash']) path = os.path.join( jsonloader.conf.ca['output_path'], '%s.crt' % new_cert.get_fingerprint(jsonloader.conf.ca['signing_hash'])) logger.info("Saving certificate to: %s", path) cert_pem = new_cert.as_pem() with open(path, "w") as f: f.write(cert_pem) return cert_pem
def test_bad_data_throws(self): bad_data = ( "some bad data is " "EHRlc3RAYW5jaG9yLnRlc3QwTDANBgkqhkiG9w0BAQEFAAM7ADA4AjEA6m") cert = certificate.X509Certificate() self.assertRaises(x509_errors.X509Error, cert.from_buffer, bad_data)
def test_read_from_file(self): open_name = 'anchor.X509.certificate.open' with mock.patch(open_name, create=True) as mock_open: mock_open.return_value = mock.MagicMock(spec=file_class) m_file = mock_open.return_value.__enter__.return_value m_file.read.return_value = TestX509Cert.cert_data cert = certificate.X509Certificate() cert.from_file("some_path") name = cert.get_subject() entries = name.get_entries_by_nid(x509_name.NID_countryName) self.assertEqual(entries[0].get_value(), "UK")
def sign(csr, ca_conf): """Generate an X.509 certificate and sign it. :param csr: X509 certificate signing request :param ca_conf: signing CA configuration :return: signed certificate in PEM format """ try: ca = certificate.X509Certificate.from_file( ca_conf['cert_path']) except Exception as e: raise SigningError("Cannot load the signing CA: %s" % (e,)) try: key = utils.get_private_key_from_file(ca_conf['key_path']) except Exception as e: raise SigningError("Cannot load the signing CA key: %s" % (e,)) new_cert = certificate.X509Certificate() new_cert.set_version(2) start_time = int(time.time()) end_time = start_time + (ca_conf['valid_hours'] * 60 * 60) new_cert.set_not_before(start_time) new_cert.set_not_after(end_time) new_cert.set_pubkey(pkey=csr.get_pubkey()) new_cert.set_subject(csr.get_subject()) new_cert.set_issuer(ca.get_subject()) # NOTE(tkelsey): this needs to be in the range of an int serial = int(int(uuid.uuid4().hex, 16) % sys.maxsize) new_cert.set_serial_number(serial) exts = csr.get_extensions() for i, ext in enumerate(exts): logger.info("Adding certificate extension: %i %s", i, str(ext)) new_cert.add_extension(ext, i) logger.info("Signing certificate for <%s> with serial <%s>", csr.get_subject(), serial) new_cert.sign(key, ca_conf['signing_hash']) cert_pem = new_cert.as_pem() return cert_pem
def test_check_good_csr(self): data = { 'user': '******', 'secret': 'simplepassword', 'encoding': 'pem', 'csr': TestFunctional.csr_good } resp = self.app.post('/sign', data, expect_errors=False) self.assertEqual(200, resp.status_int) cert = X509_cert.X509Certificate() cert.from_buffer(resp.text) # make sure the cert is what we asked for self.assertEqual(("/C=GB/ST=California/L=San Francsico/O=OSSG" "/OU=OSSG/CN=master.test.com"), str(cert.get_subject())) # make sure the cert was issued by anchor self.assertEqual("/C=UK/ST=Some-State/O=OSSG/CN=anchor.example.com", str(cert.get_issuer()))
def sign_generic(csr, ca_conf, encryption, signer): """Generate an X.509 certificate and sign it. :param csr: X509 certificate signing request :param ca_conf: signing CA configuration :return: signed certificate in PEM format """ try: ca = certificate.X509Certificate.from_file( ca_conf['cert_path']) except Exception as e: raise SigningError("Cannot load the signing CA: %s" % (e,)) new_cert = certificate.X509Certificate() new_cert.set_version(2) start_time = int(time.time()) end_time = start_time + (ca_conf['valid_hours'] * 60 * 60) new_cert.set_not_before(start_time) new_cert.set_not_after(end_time) new_cert.set_pubkey(pkey=csr.get_pubkey()) new_cert.set_subject(csr.get_subject()) new_cert.set_issuer(ca.get_subject()) serial = int(uuid.uuid4().hex, 16) new_cert.set_serial_number(serial) exts = csr.get_extensions() ext_i = 0 for ext in exts: # this check is separate from standards validator - the signing backend # may know about more/fewer extensions than we do if ext.get_oid() not in extension.EXTENSION_CLASSES.keys(): if ext.get_critical(): logger.warning("CSR submitted with unknown extension oid %s, " "refusing to sign", ext.get_oid()) raise SigningError("Unknown critical extension %s" % ( ext.get_oid(),)) else: logger.info("CSR submitted with non-critical unknown oid %s, " "not including extension", (ext.get_oid(),)) else: logger.info("Adding certificate extension: %i %s", ext_i, str(ext)) # authority id will be replaced with current signer # this cannot be a fixup, because they don't get access to the CA if isinstance(ext, extension.X509ExtensionAuthorityKeyId): continue new_cert.add_extension(ext, ext_i) ext_i += 1 ca_exts = ca.get_extensions(extension.X509ExtensionSubjectKeyId) auth_key_id = extension.X509ExtensionAuthorityKeyId() if ca_exts: auth_key_id.set_key_id(ca_exts[0].get_key_id()) else: auth_key_id.set_key_id(ca.get_key_id()) new_cert.add_extension(auth_key_id, ext_i) logger.info("Signing certificate for <%s> with serial <%s>", csr.get_subject(), serial) new_cert.sign(encryption, ca_conf['signing_hash'], signer) cert_pem = new_cert.as_pem() return cert_pem
def setUp(self): super(TestX509Cert, self).setUp() self.cert = certificate.X509Certificate() self.cert.from_buffer(TestX509Cert.cert_data)
def sign(csr, ca_conf): """Generate an X.509 certificate and sign it. :param csr: X509 certificate signing request :param ca_conf: signing CA configuration :return: signed certificate in PEM format """ try: ca = certificate.X509Certificate.from_file(ca_conf['cert_path']) except Exception as e: raise SigningError("Cannot load the signing CA: %s" % (e, )) try: key = x509_utils.get_private_key_from_file(ca_conf['key_path']) except Exception as e: raise SigningError("Cannot load the signing CA key: %s" % (e, )) new_cert = certificate.X509Certificate() new_cert.set_version(2) start_time = int(time.time()) end_time = start_time + (ca_conf['valid_hours'] * 60 * 60) new_cert.set_not_before(start_time) new_cert.set_not_after(end_time) new_cert.set_pubkey(pkey=csr.get_pubkey()) new_cert.set_subject(csr.get_subject()) new_cert.set_issuer(ca.get_subject()) serial = int(uuid.uuid4().hex, 16) new_cert.set_serial_number(serial) exts = csr.get_extensions() ext_i = 0 for ext in exts: # this check is separate from standards validator - the signing backend # may know about more/fewer extensions than we do if ext.get_oid() not in extension.EXTENSION_CLASSES.keys(): if ext.get_critical(): logger.warning( "CSR submitted with unknown extension oid %s, " "refusing to sign", ext.get_oid()) raise SigningError("Unknown critical extension %s" % (ext.get_oid(), )) else: logger.info( "CSR submitted with non-critical unknown oid %s, " "not including extension", (ext.get_oid(), )) else: logger.info("Adding certificate extension: %i %s", ext_i, str(ext)) new_cert.add_extension(ext, ext_i) ext_i += 1 logger.info("Signing certificate for <%s> with serial <%s>", csr.get_subject(), serial) new_cert.sign(key, ca_conf['signing_hash']) cert_pem = new_cert.as_pem() return cert_pem