mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-24 16:10:02 -06:00
bf1875a0e7
Web UI tests now don't require additional configuration to test certificates. Self-signed certificates and CSR are generated on fly. Next variables from ~/.ipa/ui_test.conf for now are deprecated: - arbitrary_cert_path - service_csr_path - user_csr_path Ticket: https://pagure.io/freeipa/issue/7843 Reviewed-By: Sergey Orlov <sorlov@redhat.com>
74 lines
2.2 KiB
Python
74 lines
2.2 KiB
Python
#
|
|
# Copyright (C) 2018 FreeIPA Contributors see COPYING for license
|
|
#
|
|
|
|
from datetime import datetime, timedelta
|
|
|
|
from cryptography import x509
|
|
from cryptography.hazmat.backends import default_backend
|
|
from cryptography.hazmat.primitives import serialization, hashes
|
|
from cryptography.hazmat.primitives.asymmetric import rsa
|
|
from cryptography.x509.oid import NameOID
|
|
|
|
|
|
def generate_csr(cn, is_hostname=True):
|
|
"""
|
|
Generate certificate signing request
|
|
|
|
:param cn: common name (str|unicode)
|
|
:param is_hostname: is the common name a hostname (default: True)
|
|
"""
|
|
key = rsa.generate_private_key(
|
|
public_exponent=65537,
|
|
key_size=2048,
|
|
backend=default_backend()
|
|
)
|
|
if isinstance(cn, bytes):
|
|
cn = cn.decode()
|
|
csr = x509.CertificateSigningRequestBuilder()
|
|
csr = csr.subject_name(
|
|
x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, cn)])
|
|
)
|
|
if is_hostname:
|
|
csr = csr.add_extension(
|
|
x509.SubjectAlternativeName([x509.DNSName(cn)]),
|
|
critical=False
|
|
)
|
|
|
|
csr = csr.sign(key, hashes.SHA256(), default_backend())
|
|
return csr.public_bytes(serialization.Encoding.PEM).decode()
|
|
|
|
|
|
def generate_certificate(hostname):
|
|
"""
|
|
Generate self-signed certificate for some DNS name.
|
|
The certificate is valid for 100 days from moment of generation.
|
|
|
|
:param hostname: DNS name (str|unicode)
|
|
"""
|
|
key = rsa.generate_private_key(
|
|
public_exponent=65537,
|
|
key_size=2048,
|
|
backend=default_backend()
|
|
)
|
|
if isinstance(hostname, bytes):
|
|
hostname = hostname.decode()
|
|
subject = issuer = x509.Name(
|
|
[x509.NameAttribute(NameOID.COMMON_NAME, hostname)]
|
|
)
|
|
|
|
cert = x509.CertificateBuilder()
|
|
cert = cert.subject_name(subject).issuer_name(issuer).public_key(
|
|
key.public_key()
|
|
).serial_number(
|
|
x509.random_serial_number()
|
|
).not_valid_before(
|
|
datetime.utcnow()
|
|
).not_valid_after(
|
|
datetime.utcnow() + timedelta(days=100)
|
|
).add_extension(
|
|
x509.SubjectAlternativeName([x509.DNSName(hostname)]),
|
|
critical=False
|
|
).sign(key, hashes.SHA256(), default_backend())
|
|
return cert.public_bytes(serialization.Encoding.PEM).decode()
|