def check_csr(csr: x509.CertificateSigningRequest, template: Template) -> str: """ find all differences (errors) between info in csr and template, return empty string if no errors""" extensions = { OID_NAMES.get(extension.oid, extension.oid): extension.value for extension in csr.extensions } # noinspection PyProtectedMember return '\n'.join(error for error in ( # verify csr signature '' if csr. is_signature_valid else 'hmmm... csr signature is not valid!!!', # verify signature hash algorithm '' if csr.signature_hash_algorithm.name == template.hash_algorithm.lower() else 'hmmm wrong hash algorithm!!!', # verify subject matches '' if template.subject == tuple( (OID_NAMES.get(attrib.oid), attrib.value) for attrib in csr.subject) else 'subject mismatch:\n{}\n{}\n'. format(csr.subject, template.subject), # verify subjectAltName '' if template.subject_alt_names is None and 'subject_alt_names' not in extensions else '' if tuple( x.value for x in extensions['subjectAltName']) == template. subject_alt_names else 'subject_alt_names mismatch:\n{}\n{}\n'. format(extensions['subjectAltName'], template.subject_alt_names), # verify basicConstraints ca '' if extensions['basicConstraints'].ca == template.basic_constraints. ca else 'basicConstraints ca mismatch:\n{}\n{}\n'.format( extensions['basicConstraints'].ca, template.basic_constraints.ca), # verify basicConstraints path_length '' if extensions['basicConstraints'].path_length == template.basic_constraints. path_length else 'basicConstraints path_length mismatch:\n{}\n{}\n'. format(extensions['basicConstraints'].path_length, template. basic_constraints.path_length), # verify keyUsage '' if template.key_usage is None and 'keyUsage' not in extensions else '' if all(( extensions['keyUsage'].digital_signature == template.key_usage.digital_signature, extensions['keyUsage'].content_commitment == template.key_usage.content_commitment, extensions['keyUsage'].key_encipherment == template.key_usage.key_encipherment, extensions['keyUsage'].data_encipherment == template.key_usage.data_encipherment, extensions['keyUsage'].key_agreement == template.key_usage.key_agreement, extensions['keyUsage'].key_cert_sign == template.key_usage.key_cert_sign, extensions['keyUsage'].crl_sign == template.key_usage.crl_sign, extensions['keyUsage']._encipher_only == template.key_usage.encipher_only, extensions['keyUsage']._decipher_only == template.key_usage.decipher_only, )) else 'keyUsage mismatch:\n{}\n{}\n'. format(extensions['keyUsage'], template.key_usage), # verify KeySize '' if template.key_size == csr.public_key().key_size else 'KeySize mismatch:\n{}\n{}\n'. format(csr.public_key().key_size, template.key_size), # verify KeySize >= 2048 '' if csr.public_key().key_size >= 2048 else 'weak key size {}'. format(csr.public_key().key_size)) if error != '')
def _name(self): # Lazy import to avoid an import cycle from cryptography.x509.oid import _OID_NAMES return _OID_NAMES.get(self, "Unknown OID")
def _name(self): # Lazy import to avoid an import cycle from cryptography.x509.oid import _OID_NAMES return _OID_NAMES.get(self, "Unknown OID")