def createCert(CN, basedir, cadir, certtarget, keytarget, log, allow_overwrite=False): if not allow_overwrite and pathutil.check_path_exists(certtarget): msg = "Certificate file present already: " + certtarget raise IncompatibleEnvironment(msg) if not allow_overwrite and pathutil.check_path_exists(keytarget): msg = "Key file present already: " + keytarget raise IncompatibleEnvironment(msg) cacert_path = findCAcert(basedir, cadir, log) cakey_path = findCAkey(basedir, cadir, log) # Create temp directory. uuid = pathutil.uuidgen() tempdir = pathutil.pathjoin(cadir, uuid) os.mkdir(tempdir) pathutil.ensure_dir_exists(tempdir, "temp certs directory") log.debug("Created %s" % tempdir) args = [tempdir, CN, "pub", "priv", cacert_path, cakey_path] (exitcode, stdout, stderr) = javautil.run(basedir, log, EXE_CREATE_NEW_CERT, args=args) runutil.generic_bailout("Problem creating certificate.", exitcode, stdout, stderr) pub_DN = stdout.strip() temp_pub_path = pathutil.pathjoin(tempdir, "pub") pathutil.ensure_file_exists(temp_pub_path, "temp cert") log.debug("temp cert exists: " + temp_pub_path) # copy that to user-cert records args = [temp_pub_path] (exitcode, stdout, stderr) = javautil.run(basedir, log, EXE_GET_HASHED_CERT_NAME, args=args) runutil.generic_bailout("Problem finding hashed cert name.", exitcode, stdout, stderr) usercertfilehash = stdout.strip() log.debug("user cert file hash is '%s'" % usercertfilehash) cert_records_path = pathutil.pathjoin(cadir, "user-certs") cert_records_path = pathutil.pathjoin(cert_records_path, usercertfilehash + ".0") shutil.copyfile(temp_pub_path, cert_records_path) pathutil.ensure_file_exists(cert_records_path, "new certificate (record)") log.debug("cert exists at target: " + cert_records_path) temp_priv_path = pathutil.pathjoin(tempdir, "priv") pathutil.ensure_file_exists(temp_priv_path, "temp key") log.debug("temp key exists: " + temp_priv_path) log.debug("Created certificate: %s" % pub_DN) # Those user-supplied targets still don't exist, right? :-) if not allow_overwrite and pathutil.check_path_exists(certtarget): msg = "Certificate file present already: " + certtarget raise IncompatibleEnvironment(msg) if not allow_overwrite and pathutil.check_path_exists(keytarget): msg = "Key file present already: " + keytarget raise IncompatibleEnvironment(msg) shutil.copyfile(temp_pub_path, certtarget) pathutil.ensure_file_exists(certtarget, "new certificate") log.debug("cert exists at target: " + certtarget) shutil.copyfile(temp_priv_path, keytarget) pathutil.ensure_file_exists(keytarget, "new key") log.debug("key exists at target: " + keytarget) pathutil.make_path_rw_private(keytarget) pathutil.ensure_path_private(keytarget, "new key") log.debug("file made private: %s" % keytarget) shutil.rmtree(tempdir) return pub_DN
def _createCA(ca_name, basedir, cadir, log): javautil.check(basedir, log) # mkdir $cadir # mkdir $cadir/ca-certs # mkdir $cadir/trusted-certs # mkdir $cadir/user-certs os.mkdir(cadir) pathutil.ensure_dir_exists(cadir, "New CA directory") log.debug("Created %s" % cadir) cacertdir = pathutil.pathjoin(cadir, "ca-certs") os.mkdir(cacertdir) pathutil.ensure_dir_exists(cacertdir, "New CA certs directory") log.debug("Created %s" % cacertdir) trustedcertdir = pathutil.pathjoin(cadir, "trusted-certs") os.mkdir(trustedcertdir) pathutil.ensure_dir_exists(trustedcertdir, "New CA trusted certs directory") log.debug("Created %s" % trustedcertdir) usercertdir = pathutil.pathjoin(cadir, "user-certs") os.mkdir(usercertdir) pathutil.ensure_dir_exists(usercertdir, "New CA user certs directory") log.debug("Created %s" % usercertdir) # Create the cert via autocommon args = [cacertdir, ca_name] (exitcode, stdout, stderr) = javautil.run(basedir, log, EXE_CREATE_NEW_CA, args=args) runutil.generic_bailout("Problem creating CA.", exitcode, stdout, stderr) # Make the private key owner-readable only privkeyname = "private-key-" + ca_name + ".pem" cakeyfile = pathutil.pathjoin(cacertdir, privkeyname) pathutil.ensure_file_exists(cakeyfile, "New CA key") log.debug("file exists: %s" % cakeyfile) pathutil.make_path_rw_private(cakeyfile) pathutil.ensure_path_private(cakeyfile, "New CA key") log.debug("file made private: %s" % cakeyfile) # Copy the new certificate file to the "hash.0" version that some toolings # will expect. cacertfile = pathutil.pathjoin(cacertdir, ca_name + ".pem") pathutil.ensure_file_exists(cacertfile, "New CA cert") log.debug("file exists: %s" % cacertfile) args = [cacertfile] (exitcode, stdout, stderr) = javautil.run(basedir, log, EXE_GET_HASHED_CERT_NAME, args=args) runutil.generic_bailout("Problem finding hashed cert name.", exitcode, stdout, stderr) cacertfilehash = stdout.strip() log.debug("cert file hash is '%s'" % cacertfilehash) newpath = pathutil.pathjoin(cacertdir, cacertfilehash + ".0") shutil.copyfile(cacertfile, newpath) pathutil.ensure_file_exists(newpath, "New CA cert (hashed #1)") log.debug("file exists: %s" % newpath) newpath = pathutil.pathjoin(trustedcertdir, cacertfilehash + ".0") shutil.copyfile(cacertfile, newpath) pathutil.ensure_file_exists(newpath, "New CA cert (hashed #2)") log.debug("file exists: %s" % newpath) # Signing policy signing1 = pathutil.pathjoin(cacertdir, cacertfilehash + ".signing_policy") args = [cacertfile, signing1] (exitcode, stdout, stderr) = javautil.run(basedir, log, EXE_WRITE_SIGNING_POLICY, args=args) runutil.generic_bailout("Problem creating signing_policy file.", exitcode, stdout, stderr) pathutil.ensure_file_exists(signing1, "signing_policy file #1") log.debug("file exists: %s" % signing1) signing2 = pathutil.pathjoin(trustedcertdir, cacertfilehash + ".signing_policy") shutil.copyfile(signing1, signing2) pathutil.ensure_file_exists(signing2, "signing_policy file #2") log.debug("file exists: %s" % signing2) # CRL crl1 = pathutil.pathjoin(cacertdir, cacertfilehash + ".r0") args = [crl1, cacertfile, cakeyfile] (exitcode, stdout, stderr) = javautil.run(basedir, log, EXE_CREATE_CRL, args=args) runutil.generic_bailout("Problem creating revocation file.", exitcode, stdout, stderr) pathutil.ensure_file_exists(crl1, "revocation file #1") log.debug("file exists: %s" % crl1) crl2 = pathutil.pathjoin(trustedcertdir, cacertfilehash + ".r0") shutil.copyfile(crl1, crl2) pathutil.ensure_file_exists(crl2, "revocation file #2") log.debug("file exists: %s" % crl2)