1
1
from datetime import datetime , timedelta
2
2
from tempfile import mkdtemp
3
- from cryptography .hazmat .primitives import serialization
4
- from cryptography .hazmat .primitives .asymmetric import rsa
3
+
5
4
from cryptography import x509
5
+ from cryptography .hazmat .primitives import hashes , serialization
6
+ from cryptography .hazmat .primitives .asymmetric import rsa
6
7
from cryptography .x509 .oid import NameOID
7
- from cryptography .hazmat .primitives import hashes
8
8
9
9
temp_dir = mkdtemp ()
10
10
print (temp_dir )
@@ -16,81 +16,109 @@ def genrsa(path):
16
16
key_size = 2048 ,
17
17
)
18
18
with open (path , "wb" ) as f :
19
- f .write (key .private_bytes (
20
- encoding = serialization .Encoding .PEM ,
21
- format = serialization .PrivateFormat .TraditionalOpenSSL ,
22
- encryption_algorithm = serialization .NoEncryption (),
23
- ))
19
+ f .write (
20
+ key .private_bytes (
21
+ encoding = serialization .Encoding .PEM ,
22
+ format = serialization .PrivateFormat .TraditionalOpenSSL ,
23
+ encryption_algorithm = serialization .NoEncryption (),
24
+ )
25
+ )
24
26
return key
25
27
26
28
27
29
def create_cert (path , C , ST , L , O , key ):
28
- subject = issuer = x509 .Name ([
29
- x509 .NameAttribute (NameOID .COUNTRY_NAME , C ),
30
- x509 .NameAttribute (NameOID .STATE_OR_PROVINCE_NAME , ST ),
31
- x509 .NameAttribute (NameOID .LOCALITY_NAME , L ),
32
- x509 .NameAttribute (NameOID .ORGANIZATION_NAME , O ),
33
- ])
34
- cert = x509 .CertificateBuilder ().subject_name (
35
- subject
36
- ).issuer_name (
37
- issuer
38
- ).public_key (
39
- key .public_key ()
40
- ).serial_number (
41
- x509 .random_serial_number ()
42
- ).not_valid_before (
43
- datetime .utcnow ()
44
- ).not_valid_after (
45
- # Our certificate will be valid for 10 days
46
- datetime .utcnow () + timedelta (days = 10 )
47
- ).add_extension (
48
- x509 .BasicConstraints (ca = True , path_length = None ), critical = True ,
49
- ).sign (key , hashes .SHA256 ())
30
+ subject = issuer = x509 .Name (
31
+ [
32
+ x509 .NameAttribute (NameOID .COUNTRY_NAME , C ),
33
+ x509 .NameAttribute (NameOID .STATE_OR_PROVINCE_NAME , ST ),
34
+ x509 .NameAttribute (NameOID .LOCALITY_NAME , L ),
35
+ x509 .NameAttribute (NameOID .ORGANIZATION_NAME , O ),
36
+ ]
37
+ )
38
+ cert = (
39
+ x509 .CertificateBuilder ()
40
+ .subject_name (subject )
41
+ .issuer_name (issuer )
42
+ .public_key (key .public_key ())
43
+ .serial_number (x509 .random_serial_number ())
44
+ .not_valid_before (datetime .utcnow ())
45
+ .not_valid_after (
46
+ # Our certificate will be valid for 10 days
47
+ datetime .utcnow ()
48
+ + timedelta (days = 10 )
49
+ )
50
+ .add_extension (
51
+ x509 .BasicConstraints (ca = True , path_length = None ),
52
+ critical = True ,
53
+ )
54
+ .sign (key , hashes .SHA256 ())
55
+ )
50
56
# Write our certificate out to disk.
51
57
with open (path , "wb" ) as f :
52
58
f .write (cert .public_bytes (serialization .Encoding .PEM ))
53
59
return cert
54
60
55
61
56
62
def create_req (path , C , ST , L , O , key ):
57
- csr = x509 .CertificateSigningRequestBuilder ().subject_name (x509 .Name ([
58
- # Provide various details about who we are.
59
- x509 .NameAttribute (NameOID .COUNTRY_NAME , C ),
60
- x509 .NameAttribute (NameOID .STATE_OR_PROVINCE_NAME , ST ),
61
- x509 .NameAttribute (NameOID .LOCALITY_NAME , L ),
62
- x509 .NameAttribute (NameOID .ORGANIZATION_NAME , O ),
63
- ])).sign (key , hashes .SHA256 ())
63
+ csr = (
64
+ x509 .CertificateSigningRequestBuilder ()
65
+ .subject_name (
66
+ x509 .Name (
67
+ [
68
+ # Provide various details about who we are.
69
+ x509 .NameAttribute (NameOID .COUNTRY_NAME , C ),
70
+ x509 .NameAttribute (NameOID .STATE_OR_PROVINCE_NAME , ST ),
71
+ x509 .NameAttribute (NameOID .LOCALITY_NAME , L ),
72
+ x509 .NameAttribute (NameOID .ORGANIZATION_NAME , O ),
73
+ ]
74
+ )
75
+ )
76
+ .sign (key , hashes .SHA256 ())
77
+ )
64
78
with open (path , "wb" ) as f :
65
79
f .write (csr .public_bytes (serialization .Encoding .PEM ))
66
80
return csr
67
81
68
82
69
83
def sign_certificate_request (path , csr_cert , ca_cert , private_ca_key ):
70
- cert = x509 . CertificateBuilder (). subject_name (
71
- csr_cert . subject
72
- ). issuer_name (
73
- ca_cert .subject
74
- ) .public_key (
75
- csr_cert . public_key ( )
76
- ). serial_number (
77
- x509 . random_serial_number ()
78
- ). not_valid_before (
79
- datetime .utcnow ()
80
- ). not_valid_after (
81
- # Our certificate will be valid for 10 days
82
- datetime . utcnow () + timedelta ( days = 10 )
83
- # Sign our certificate with our private key
84
- ). sign ( private_ca_key , hashes . SHA256 ())
84
+ cert = (
85
+ x509 . CertificateBuilder ()
86
+ . subject_name ( csr_cert . subject )
87
+ . issuer_name ( ca_cert .subject )
88
+ .public_key (csr_cert . public_key ())
89
+ . serial_number ( x509 . random_serial_number () )
90
+ . not_valid_before ( datetime . utcnow ())
91
+ . not_valid_after (
92
+ # Our certificate will be valid for 10 days
93
+ datetime .utcnow ()
94
+ + timedelta ( days = 10 )
95
+ # Sign our certificate with our private key
96
+ )
97
+ . sign ( private_ca_key , hashes . SHA256 ())
98
+ )
85
99
with open (path , "wb" ) as f :
86
100
f .write (cert .public_bytes (serialization .Encoding .PEM ))
87
101
return cert
88
102
89
103
90
104
ca_key = genrsa (temp_dir + "/ca.key" )
91
- ca_cert = create_cert (temp_dir + "/ca.pem" , "US" , "New York" , "New York" , "Gloo Certificate Authority" , ca_key )
105
+ ca_cert = create_cert (
106
+ temp_dir + "/ca.pem" ,
107
+ "US" ,
108
+ "New York" ,
109
+ "New York" ,
110
+ "Gloo Certificate Authority" ,
111
+ ca_key ,
112
+ )
92
113
93
114
pkey = genrsa (temp_dir + "/pkey.key" )
94
- csr = create_req (temp_dir + "/csr.csr" , "US" , "California" , "San Francisco" , "Gloo Testing Company" , pkey )
115
+ csr = create_req (
116
+ temp_dir + "/csr.csr" ,
117
+ "US" ,
118
+ "California" ,
119
+ "San Francisco" ,
120
+ "Gloo Testing Company" ,
121
+ pkey ,
122
+ )
95
123
96
124
cert = sign_certificate_request (temp_dir + "/cert.pem" , csr , ca_cert , ca_key )
0 commit comments