Modify a real certificate chain to be served by our own privatekey
(self, certs, privkey)
| 269 | return s |
| 270 | |
| 271 | def gen_alike_chain(self, certs, privkey): |
| 272 | """ |
| 273 | Modify a real certificate chain to be served by our own privatekey |
| 274 | """ |
| 275 | c, certs = certs[0], certs[1:] |
| 276 | if certs: |
| 277 | # Recursive: if there are certificates above this one in the chain, do them |
| 278 | # first. |
| 279 | certs = self.gen_alike_chain(certs, privkey) |
| 280 | else: |
| 281 | # Last certificate of the chain. Make it self-signed |
| 282 | c.tbsCertificate.issuer = c.tbsCertificate.subject |
| 283 | # Set SubjectPublicKeyInfo to the one from our private key |
| 284 | c.setSubjectPublicKeyFromPrivateKey(privkey) |
| 285 | # Filter out extensions that would cause trouble |
| 286 | c.tbsCertificate.serialNumber.val = int( |
| 287 | RandInt() |
| 288 | ) # otherwise SEC_ERROR_REUSED_ISSUER_AND_SERIAL |
| 289 | c.tbsCertificate.extensions = [ |
| 290 | x |
| 291 | for x in c.tbsCertificate.extensions |
| 292 | if x.extnID |
| 293 | not in [ |
| 294 | "2.5.29.32", # CPS |
| 295 | "2.5.29.31", # cRLDistributionPoints |
| 296 | "1.3.6.1.5.5.7.1.1", # authorityInfoAccess |
| 297 | "1.3.6.1.4.1.11129.2.4.2", # SCT |
| 298 | "2.5.29.14", # subjectKeyIdentifier |
| 299 | "2.5.29.35", # authorityKeyIdentifier |
| 300 | ] |
| 301 | ] |
| 302 | # For now, we only provide a RSA private key, so we can only sign with that :/ |
| 303 | c.tbsCertificate.signature = X509_AlgorithmIdentifier( |
| 304 | algorithm=ASN1_OID("ecdsa-with-SHA384"), |
| 305 | ) |
| 306 | # Resign. |
| 307 | c = Cert(privkey.resignCert(c)) |
| 308 | # Return |
| 309 | return [c] + certs |
| 310 | |
| 311 | def get_key_and_alike_chain(self, cas, dest, server_name): |
| 312 | """ |
no test coverage detected