mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-11 00:31:56 -06:00
09497d2df0
The following warning is displayed on a system running with Python 3.12: ------------------- /usr/lib/python3.12/site-packages/ipalib/rpc.py:925: DeprecationWarning: datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.now(datetime.UTC). timestamp=datetime.datetime.utcnow()) ------------------- Fixes: https://pagure.io/freeipa/issue/9425 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
74 lines
2.2 KiB
Python
74 lines
2.2 KiB
Python
#
|
|
# Copyright (C) 2018 FreeIPA Contributors see COPYING for license
|
|
#
|
|
|
|
from datetime import datetime, timedelta, UTC
|
|
|
|
from cryptography import x509
|
|
from cryptography.hazmat.backends import default_backend
|
|
from cryptography.hazmat.primitives import serialization, hashes
|
|
from cryptography.hazmat.primitives.asymmetric import rsa
|
|
from cryptography.x509.oid import NameOID
|
|
|
|
|
|
def generate_csr(cn, is_hostname=True):
|
|
"""
|
|
Generate certificate signing request
|
|
|
|
:param cn: common name (str|unicode)
|
|
:param is_hostname: is the common name a hostname (default: True)
|
|
"""
|
|
key = rsa.generate_private_key(
|
|
public_exponent=65537,
|
|
key_size=2048,
|
|
backend=default_backend()
|
|
)
|
|
if isinstance(cn, bytes):
|
|
cn = cn.decode()
|
|
csr = x509.CertificateSigningRequestBuilder()
|
|
csr = csr.subject_name(
|
|
x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, cn)])
|
|
)
|
|
if is_hostname:
|
|
csr = csr.add_extension(
|
|
x509.SubjectAlternativeName([x509.DNSName(cn)]),
|
|
critical=False
|
|
)
|
|
|
|
csr = csr.sign(key, hashes.SHA256(), default_backend())
|
|
return csr.public_bytes(serialization.Encoding.PEM).decode()
|
|
|
|
|
|
def generate_certificate(hostname):
|
|
"""
|
|
Generate self-signed certificate for some DNS name.
|
|
The certificate is valid for 100 days from moment of generation.
|
|
|
|
:param hostname: DNS name (str|unicode)
|
|
"""
|
|
key = rsa.generate_private_key(
|
|
public_exponent=65537,
|
|
key_size=2048,
|
|
backend=default_backend()
|
|
)
|
|
if isinstance(hostname, bytes):
|
|
hostname = hostname.decode()
|
|
subject = issuer = x509.Name(
|
|
[x509.NameAttribute(NameOID.COMMON_NAME, hostname)]
|
|
)
|
|
|
|
cert = x509.CertificateBuilder()
|
|
cert = cert.subject_name(subject).issuer_name(issuer).public_key(
|
|
key.public_key()
|
|
).serial_number(
|
|
x509.random_serial_number()
|
|
).not_valid_before(
|
|
datetime.now(tz=UTC)
|
|
).not_valid_after(
|
|
datetime.now(tz=UTC) + timedelta(days=100)
|
|
).add_extension(
|
|
x509.SubjectAlternativeName([x509.DNSName(hostname)]),
|
|
critical=False
|
|
).sign(key, hashes.SHA256(), default_backend())
|
|
return cert.public_bytes(serialization.Encoding.PEM).decode()
|