def create_ca_certificate(req, key):
cert = _create_certificate(req, req, 1, CA_VALIDITY_YEARS)
# Add the CA Extensions
cert.add_extensions([
OpenSSL.crypto.X509Extension("basicConstraints", True, "CA:TRUE, pathlen:0"),
OpenSSL.crypto.X509Extension("keyUsage", True, "keyCertSign,cRLSign"),
OpenSSL.crypto.X509Extension("subjectKeyIdentifier", False, "hash", subject=cert)
])
cert.sign(openssl_key(key), CERT_DIGEST)
return cert
def create_ca_certificate(req, key):
cert = _create_certificate(req, req, 1, CA_VALIDITY_YEARS)
# Add the CA Extensions
cert.add_extensions([
OpenSSL.crypto.X509Extension("basicConstraints", True,
"CA:TRUE, pathlen:0"),
OpenSSL.crypto.X509Extension("keyUsage", True, "keyCertSign,cRLSign"),
OpenSSL.crypto.X509Extension("subjectKeyIdentifier",
False,
"hash",
subject=cert)
])
cert.sign(openssl_key(key), CERT_DIGEST)
return cert
def create_ca_certificate(req, key):
cert = _create_certificate(req, req, 1, CA_VALIDITY_YEARS)
# Add the CA Extensions
cert.add_extensions([
OpenSSL.crypto.X509Extension("basicConstraints", True, "CA:TRUE, pathlen:0"),
OpenSSL.crypto.X509Extension("keyUsage", True, "keyCertSign,cRLSign"),
OpenSSL.crypto.X509Extension("subjectKeyIdentifier", False, "hash", subject=cert)
])
cert.sign(openssl_key(key), CERT_DIGEST)
return cert
def create_certificate(req, (issuerCert, issuerKey), serial):
cert = _create_certificate(req, issuerCert, serial,
CERTIFICATE_VALIDITY_YEARS)
cert.sign(openssl_key(issuerKey), CERT_DIGEST)
return cert
def encode_time(time):
"""Encode a datetime object with the ASN1 GENERALIZEDTIME format"""
return time.strftime('%Y%m%d%H%M%SZ')
if __name__ == '__main__':
cpkey= private_key()
creq = csr(cpkey, CN="EzCA", O="Ezbake", OU="Ezbake Core", C="US")
ca = create_ca_certificate(creq, cpkey)
akey = private_key()
areq = csr(akey, CN="EzApp", O="Ezbake", OU="Ezbake Apps", C="US")
app = create_certificate(areq, (ca, cpkey), 2)
OpenSSL.crypto.X509Extension("basicConstraints", True,
"CA:TRUE, pathlen:0"),
OpenSSL.crypto.X509Extension("keyUsage", True, "keyCertSign,cRLSign"),
OpenSSL.crypto.X509Extension("subjectKeyIdentifier",
False,
"hash",
subject=cert)
])
cert.sign(openssl_key(key), CERT_DIGEST)
return cert
def create_certificate(req, (issuerCert, issuerKey), serial):
cert = _create_certificate(req, issuerCert, serial,
CERTIFICATE_VALIDITY_YEARS)
cert.sign(openssl_key(issuerKey), CERT_DIGEST)
return cert
def encode_time(time):
"""Encode a datetime object with the ASN1 GENERALIZEDTIME format"""
return time.strftime('%Y%m%d%H%M%SZ')
if __name__ == '__main__':
cpkey = private_key()
creq = csr(cpkey, CN="EzCA", O="Ezbake", OU="Ezbake Core", C="US")
ca = create_ca_certificate(creq, cpkey)
akey = private_key()
areq = csr(akey, CN="EzApp", O="Ezbake", OU="Ezbake Apps", C="US")