def testUnwritableFile(self):
# Owner has only read permission before write.
os.chmod(self.cwd_path, stat.S_IRUSR)
key_file_name = './private_key.pem'
with self.assertRaises(exceptions.FileOutputError):
private_key, _ = key_generation.RSAKeyGen()
key_generation.ExportPrivateKey(key_file_name, private_key)
def testFileExport(self):
key_file_name = './private_key2.pem'
private_key, _ = key_generation.RSAKeyGen()
key_generation.ExportPrivateKey(key_file_name, private_key)
self.AssertFileExists(key_file_name)
self.AssertFileMatches(RSA_PRIVATE_RE, key_file_name)
self.AssertLogContains(
'A private key was exported to {}'.format(key_file_name))
# Check that file is 0o400 after export
st = os.stat(key_file_name)
oct_perm = oct(st.st_mode)
self.assertEqual(oct_perm, oct(0o100400))
def _GenerateCertificateConfig(self, request, args, location):
private_key, public_key = key_generation.RSAKeyGen(2048)
key_generation.ExportPrivateKey(args.key_output_file, private_key)
config = self.messages.CertificateConfig()
config.publicKey = self.messages.PublicKey()
config.publicKey.key = public_key
config.publicKey.type = self.messages.PublicKey.TypeValueValuesEnum.PEM_RSA_KEY
config.reusableConfig = flags.ParseReusableConfig(
args, location, is_ca_command=args.is_ca_cert)
config.subjectConfig = flags.ParseSubjectFlags(args,
is_ca=args.is_ca_cert)
return config
def _GenerateCertificateConfig(self, request, args):
messages = privateca_base.GetMessagesModule()
private_key, public_key = key_generation.RSAKeyGen(2048)
key_generation.ExportPrivateKey(args.key_output_file, private_key)
config = messages.CertificateConfig()
config.publicKey = messages.PublicKey()
config.publicKey.key = public_key
config.publicKey.type = messages.PublicKey.TypeValueValuesEnum.PEM_RSA_KEY
config.reusableConfig = flags.ParseReusableConfig(args)
config.subjectConfig = flags.ParseSubjectFlags(args, is_ca=False)
return config
def _GetPublicKey(self, args):
"""Fetches the public key associated with a non-CSR certificate request, as UTF-8 encoded bytes."""
kms_key_version = args.CONCEPTS.kms_key_version.Parse()
if args.generate_key:
private_key, public_key = key_generation.RSAKeyGen(2048)
key_generation.ExportPrivateKey(args.key_output_file, private_key)
return public_key
elif kms_key_version:
public_key_response = cryptokeyversions.GetPublicKey(
kms_key_version)
# bytes(..) requires an explicit encoding in PY3.
return (bytes(public_key_response.pem) if six.PY2 else bytes(
public_key_response.pem, 'utf-8'))
else:
# This should not happen because of the required arg group, but protects
# in case of future additions.
raise exceptions.OneOfArgumentsRequiredException([
'--csr', '--generate-key', '--kms-key-version'
], ('To create a certificate, please specify either a CSR, the '
'--generate-key flag to create a new key, or the --kms-key-version '
'flag to use an existing KMS key.'))