| 10 | |
| 11 | |
| 12 | def _new_cert(issuer=None, is_issuer=False, serial_number=None, **subject): |
| 13 | backend = backends.default_backend() |
| 14 | private_key = rsa.generate_private_key( |
| 15 | public_exponent=65537, key_size=4096, backend=backend |
| 16 | ) |
| 17 | public_key = private_key.public_key() |
| 18 | subject = x509.Name( |
| 19 | [ |
| 20 | x509.NameAttribute(getattr(oid.NameOID, key.upper()), value) |
| 21 | for key, value in subject.items() |
| 22 | ] |
| 23 | ) |
| 24 | builder = ( |
| 25 | x509.CertificateBuilder() |
| 26 | .subject_name(subject) |
| 27 | .public_key(public_key) |
| 28 | .serial_number(serial_number or int.from_bytes(os.urandom(8), "big")) |
| 29 | ) |
| 30 | if issuer: |
| 31 | issuer_cert, signing_key = issuer |
| 32 | builder = ( |
| 33 | builder.issuer_name(issuer_cert.subject) |
| 34 | .not_valid_before(issuer_cert.not_valid_before) |
| 35 | .not_valid_after(issuer_cert.not_valid_after) |
| 36 | ) |
| 37 | aki_ext = x509.AuthorityKeyIdentifier( |
| 38 | key_identifier=issuer_cert.extensions.get_extension_for_class( |
| 39 | x509.SubjectKeyIdentifier |
| 40 | ).value.digest, |
| 41 | authority_cert_issuer=[x509.DirectoryName(issuer_cert.subject)], |
| 42 | authority_cert_serial_number=issuer_cert.serial_number, |
| 43 | ) |
| 44 | else: |
| 45 | signing_key = private_key |
| 46 | builder = ( |
| 47 | builder.issuer_name(subject) |
| 48 | .not_valid_before( |
| 49 | datetime.datetime.today() - datetime.timedelta(days=1) |
| 50 | ) |
| 51 | .not_valid_after( |
| 52 | datetime.datetime.today() + datetime.timedelta(weeks=1000) |
| 53 | ) |
| 54 | ) |
| 55 | aki_ext = x509.AuthorityKeyIdentifier.from_issuer_public_key( |
| 56 | public_key |
| 57 | ) |
| 58 | if is_issuer: |
| 59 | builder = ( |
| 60 | builder.add_extension( |
| 61 | x509.BasicConstraints(ca=True, path_length=None), |
| 62 | critical=True, |
| 63 | ) |
| 64 | .add_extension( |
| 65 | x509.KeyUsage( |
| 66 | digital_signature=False, |
| 67 | content_commitment=False, |
| 68 | key_encipherment=False, |
| 69 | data_encipherment=False, |