| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384 |
- # -*- coding: latin-1 -*-
- #
- # Copyright (C) AB Strakt
- # Copyright (C) Jean-Paul Calderone
- # See LICENSE for details.
- """
- Certificate generation module.
- """
- from OpenSSL import crypto
- TYPE_RSA = crypto.TYPE_RSA
- TYPE_DSA = crypto.TYPE_DSA
- def createKeyPair(type, bits):
- """
- Create a public/private key pair.
- Arguments: type - Key type, must be one of TYPE_RSA and TYPE_DSA
- bits - Number of bits to use in the key
- Returns: The public/private key pair in a PKey object
- """
- pkey = crypto.PKey()
- pkey.generate_key(type, bits)
- return pkey
- def createCertRequest(pkey, digest="sha256", **name):
- """
- Create a certificate request.
- Arguments: pkey - The key to associate with the request
- digest - Digestion method to use for signing, default is sha256
- **name - The name of the subject of the request, possible
- arguments are:
- C - Country name
- ST - State or province name
- L - Locality name
- O - Organization name
- OU - Organizational unit name
- CN - Common name
- emailAddress - E-mail address
- Returns: The certificate request in an X509Req object
- """
- req = crypto.X509Req()
- subj = req.get_subject()
- for key, value in name.items():
- setattr(subj, key, value)
- req.set_pubkey(pkey)
- req.sign(pkey, digest)
- return req
- def createCertificate(req, issuerCertKey, serial, validityPeriod,
- digest="sha256"):
- """
- Generate a certificate given a certificate request.
- Arguments: req - Certificate request to use
- issuerCert - The certificate of the issuer
- issuerKey - The private key of the issuer
- serial - Serial number for the certificate
- notBefore - Timestamp (relative to now) when the certificate
- starts being valid
- notAfter - Timestamp (relative to now) when the certificate
- stops being valid
- digest - Digest method to use for signing, default is sha256
- Returns: The signed certificate in an X509 object
- """
- issuerCert, issuerKey = issuerCertKey
- notBefore, notAfter = validityPeriod
- cert = crypto.X509()
- cert.set_serial_number(serial)
- cert.gmtime_adj_notBefore(notBefore)
- cert.gmtime_adj_notAfter(notAfter)
- cert.set_issuer(issuerCert.get_subject())
- cert.set_subject(req.get_subject())
- cert.set_pubkey(req.get_pubkey())
- cert.sign(issuerKey, digest)
- return cert
|