예제 #1
0
파일: ShCert.py 프로젝트: GaetanF/ManPKI
    def create_cert(self, profile):
        before = datetime.utcnow()
        after = before + timedelta(days=Config().config.getint("cert", "validity"))

        pkey = SSL.create_key(Config().config.getint("cert", "key_size"))

        ca = SSL.get_ca()
        cert = SSL.create_cert(pkey)
        if Config().config.get("ldap", "enable") and "false" not in Config().config.get("profile_" + profile, "ldap"):
            print "Search in LDAP"
            l = LDAP()
            filter = Config().config.get("profile_" + profile, "ldap")
            res = l.get_dn(l.get_basedn(), filter, ['cn', 'mail', 'uid'])
            listSearch = {}
            users = {}
            for elt in res:
                key = elt[0]
                val = elt[1]['cn'][0]
                mail = None
                if 'mail' in elt[1].keys():
                    mail = elt[1]['mail'][0]
                    val = val + " (mail : " + elt[1]['mail'][0] + ")"
                listSearch.update({key: val})
                users.update({key: {'mail': mail, 'cn': elt[1]['cn'][0]}})
            nbr_select = 0
            while nbr_select != 1:
                userList = Render.print_selector(listSearch)
                nbr_select = len(userList)
            email = users[userList[0]]['mail']
            cn = users[userList[0]]['cn']
            subject_array = userList[0].split(',')
            subject_array.reverse()
            subject_array.pop()
            subject = '/'.join(subject_array) + "/CN=" + cn
        else:
            cn = raw_input("Common Name : ")
            email = raw_input("Mail address : ")
            subject = Config().config.get("ca", "base_cn") + "/CN=" + cn
        subject_x509 = SSL.parse_str_to_x509Name(subject, cert.get_subject())

        issuer_x509 = ca.get_subject()
        if email:
            subject_x509.emailAddress = email

        cert.set_subject(subject_x509)
        cert.set_issuer(issuer_x509)
        cert.set_notBefore(before.strftime("%Y%m%d%H%M%S%Z")+"Z")
        cert.set_notAfter(after.strftime("%Y%m%d%H%M%S%Z")+"Z")
        cert.set_serial_number(int(time() * 1000000))
        cert.set_version(2)

        bsConst = "CA:FALSE"
        cert.add_extensions([
            crypto.X509Extension("basicConstraints", True, bsConst),
            crypto.X509Extension("keyUsage", True, SSL.get_key_usage_from_profile(profile)),
            crypto.X509Extension("subjectKeyIdentifier", False, "hash", subject=cert),
        ])
        cert.add_extensions([
            crypto.X509Extension("authorityKeyIdentifier", False, "keyid:always", issuer=ca)
        ])
        cert.add_extensions([
            crypto.X509Extension("extendedKeyUsage", False, SSL.get_extended_key_usage_from_profile(profile))
        ])

        if Config().config.getboolean("crl", "enable"):
            crlUri = "URI:" + Config().config.get("crl", "uri")
            cert.add_extensions([
                crypto.X509Extension("crlDistributionPoints", False, crlUri)
            ])

        if Config().config.getboolean("ocsp", "enable"):
            ocspUri = "OCSP;URI:" + Config().config.get("ocsp", "uri")
            cert.add_extensions([
                crypto.X509Extension("authorityInfoAccess", False, ocspUri)
            ])

        cert_signed = SSL.sign(cert, SSL.get_ca_privatekey(), Config().config.get("cert", "digest"))
        SSL.set_cert(cert_signed)
        SSL.set_cert_privatekey(cert_signed, pkey)

        if Config().config.getboolean("ldap", "enable"):
                LDAP.add_queue(cert_signed)
예제 #2
0
파일: ShCa.py 프로젝트: GaetanF/ManPKI
    def create_ca(self, force=False):
        if Config().config.get("ca", "type") == "subca":
            api = API(Config().config.get("ca", "parentca"))
        before = datetime.utcnow()
        after = before + timedelta(days=Config().config.getint("ca", "validity"))

        pkey = SSL.create_key(Config().config.getint("ca", "key_size"))

        ca = SSL.create_cert(pkey)
        subject = Config().config.get("ca", "base_cn") + "/CN=" + Config().config.get("ca", "name")
        subject_x509 = SSL.parse_str_to_x509Name(subject, ca.get_subject())
        if Config().config.get("ca", "type") == "rootca":
            issuer_x509 = SSL.parse_str_to_x509Name(subject, ca.get_issuer())

        if Config().config.get("ca", "email"):
            subject_x509.emailAddress = Config().config.get("ca", "email")

        if Config().config.get("ca", "type") == "rootca":
            issuer_x509.emailAddress = Config().config.get("ca", "email")

        ca.set_subject(subject_x509)
        if Config().config.get("ca", "type") == "rootca":
            ca.set_issuer(issuer_x509)
        ca.set_notBefore(before.strftime("%Y%m%d%H%M%S%Z")+"Z")
        ca.set_notAfter(after.strftime("%Y%m%d%H%M%S%Z")+"Z")
        ca.set_serial_number(int(time() * 1000000))
        ca.set_version(2)

        bsConst = "CA:TRUE"
        if Config().config.getboolean("ca", "isfinal"):
            bsConst += ", pathlen:0"
        ca.add_extensions([
            crypto.X509Extension("basicConstraints", True, bsConst),
            crypto.X509Extension("keyUsage", True, "keyCertSign, cRLSign"),
            crypto.X509Extension("subjectKeyIdentifier", False, "hash", subject=ca),
        ])
        if Config().config.get("ca", "type") == "rootca":
            ca.add_extensions([
                crypto.X509Extension("authorityKeyIdentifier", False, "keyid:always", issuer=ca)
            ])

        # if EventManager.hasEvent("new_cert"):
        #     ca = EventManager.new_cert(ca)

        if Config().config.getboolean("crl", "enable"):
            crlUri = "URI:" + Config().config.get("crl", "uri")
            ca.add_extensions([
                crypto.X509Extension("crlDistributionPoints", False, crlUri)
            ])

        if Config().config.getboolean("ocsp", "enable"):
            ocspUri = "OCSP;URI:" + Config().config.get("ocsp", "uri")
            ca.add_extensions([
                crypto.X509Extension("authorityInfoAccess", False, ocspUri)
            ])

        if Config().config.get("ca", "type") == "subca":
            data = api.push("ca_sign", {
                "digest": Config().config.get("ca", "digest"),
                "cert": api.encode_cert(ca)
            })
            if data['state'] == 'OK':
                ca_signed = api.decode_cert(data['response'])
            else:
                print "Error during sign from remote API of Parent CA"
                return False
        else:
            ca_signed = SSL.sign(ca, pkey, Config().config.get("ca", "digest"))

        SSL.set_ca(ca_signed)
        SSL.set_ca_privatekey(pkey)

        if Config().config.getboolean("ldap", "enable"):
            LDAP.add_queue(ca_signed)

        if force:
            self.resigned_all_cert()