mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-25 16:31:08 -06:00
1a2cd7f408
datetime.UTC alias was added in Python 3.11: https://docs.python.org/3/library/datetime.html#datetime.UTC datetime.timezone.utc was present since Python 3.2. Since RHEL 9 is using Python 3.9, use more compatible variant. Fixes: https://pagure.io/freeipa/issue/9454 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
74 lines
2.2 KiB
Python
74 lines
2.2 KiB
Python
#
|
|
# Copyright (C) 2018 FreeIPA Contributors see COPYING for license
|
|
#
|
|
|
|
from datetime import datetime, timedelta, timezone
|
|
UTC = timezone.utc
|
|
from cryptography import x509
|
|
from cryptography.hazmat.backends import default_backend
|
|
from cryptography.hazmat.primitives import serialization, hashes
|
|
from cryptography.hazmat.primitives.asymmetric import rsa
|
|
from cryptography.x509.oid import NameOID
|
|
|
|
|
|
def generate_csr(cn, is_hostname=True):
|
|
"""
|
|
Generate certificate signing request
|
|
|
|
:param cn: common name (str|unicode)
|
|
:param is_hostname: is the common name a hostname (default: True)
|
|
"""
|
|
key = rsa.generate_private_key(
|
|
public_exponent=65537,
|
|
key_size=2048,
|
|
backend=default_backend()
|
|
)
|
|
if isinstance(cn, bytes):
|
|
cn = cn.decode()
|
|
csr = x509.CertificateSigningRequestBuilder()
|
|
csr = csr.subject_name(
|
|
x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, cn)])
|
|
)
|
|
if is_hostname:
|
|
csr = csr.add_extension(
|
|
x509.SubjectAlternativeName([x509.DNSName(cn)]),
|
|
critical=False
|
|
)
|
|
|
|
csr = csr.sign(key, hashes.SHA256(), default_backend())
|
|
return csr.public_bytes(serialization.Encoding.PEM).decode()
|
|
|
|
|
|
def generate_certificate(hostname):
|
|
"""
|
|
Generate self-signed certificate for some DNS name.
|
|
The certificate is valid for 100 days from moment of generation.
|
|
|
|
:param hostname: DNS name (str|unicode)
|
|
"""
|
|
key = rsa.generate_private_key(
|
|
public_exponent=65537,
|
|
key_size=2048,
|
|
backend=default_backend()
|
|
)
|
|
if isinstance(hostname, bytes):
|
|
hostname = hostname.decode()
|
|
subject = issuer = x509.Name(
|
|
[x509.NameAttribute(NameOID.COMMON_NAME, hostname)]
|
|
)
|
|
|
|
cert = x509.CertificateBuilder()
|
|
cert = cert.subject_name(subject).issuer_name(issuer).public_key(
|
|
key.public_key()
|
|
).serial_number(
|
|
x509.random_serial_number()
|
|
).not_valid_before(
|
|
datetime.now(tz=UTC)
|
|
).not_valid_after(
|
|
datetime.now(tz=UTC) + timedelta(days=100)
|
|
).add_extension(
|
|
x509.SubjectAlternativeName([x509.DNSName(hostname)]),
|
|
critical=False
|
|
).sign(key, hashes.SHA256(), default_backend())
|
|
return cert.public_bytes(serialization.Encoding.PEM).decode()
|