summaryrefslogtreecommitdiffstats
path: root/ipalib/x509.py
Commit message (Collapse)AuthorAgeFilesLines
* move MSCSTemplate classes to ipalibFraser Tweedale2019-07-171-0/+171
| | | | | | | | | | | | | As we expand the integration tests for external CA functionality, it is helpful (and avoids duplication) to use the MSCSTemplate* classes. These currently live in ipaserver.install.cainstance, but ipatests is no longer permitted to import from ipaserver (see commit 81714976e5e13131654c78eb734746a20237c933). So move these classes to ipalib. Part of: https://pagure.io/freeipa/issue/7548 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Use PKCS#8 instead of traditional privkey formatChristian Heimes2019-05-141-1/+1
| | | | | | | | | The modern PKCS#8 private key format supports better encryption standard and is preferable over traditional, weak PKCS#1 key format. Fixes: https://pagure.io/freeipa/issue/7943 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Oleg Kozlov <okozlov@redhat.com>
* Py3: Remove subclassing from objectChristian Heimes2018-09-271-1/+1
| | | | | | | | | Python 2 had old style and new style classes. Python 3 has only new style classes. There is no point to subclass from object any more. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Workaround for pyasn1 0.4Christian Heimes2018-09-271-5/+12
| | | | | | | | | | | | | | | pyasn1 0.4 changed handling of ANY containers in a backwards incompatible way. For 0.3.x, keep explicit wrap and unwrap in octet strings for ANY container members. For >= 0.4, let pyasn1 do the job. This patch also makes sorting of extended_key_usage_bytes() stable and adds tests. Tested with pyasn1 0.3.7 and 0.4.4. Fixes: https://pagure.io/freeipa/issue/7685 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Ensure that public cert and CA bundle are readableChristian Heimes2018-06-271-1/+3
| | | | | | | | | | | | In CIS hardened mode, the process umask is 027. This results in some files not being world readable. Ensure that write_certificate_list() calls in client installer, server installer, and upgrader create cert bundles with permission bits 0644. Fixes: https://pagure.io/freeipa/issue/7594 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Encrypt httpd key stored on diskStanislav Laznicka2018-03-231-2/+8
| | | | | | | | | | | | | | | This commit adds configuration for HTTPD to encrypt/decrypt its key which we currently store in clear on the disc. A password-reading script is added for mod_ssl. This script is extensible for the future use of directory server with the expectation that key encryption/decription will be handled similarly by its configuration. https://pagure.io/freeipa/issue/7421 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* x509: Fix docstring of write_certificate()Stanislav Laznicka2018-02-211-2/+1
| | | | | | Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* x509: Remove unused argument of load_certificate_from_file()Stanislav Laznicka2018-02-211-1/+1
| | | | | | Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* httpinstance: handle supplied PKCS#12 files in installationStanislav Laznicka2018-02-211-3/+56
| | | | | | | | | | | Part of the mod_nss -> mod_ssl move. This patch allows loading necessary certificates for Apache to function from PKCS#12 files. This should fix CA-less and domain level 0 installations. Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix pylint warnings inconsistent-return-statementsChristian Heimes2017-12-181-1/+1
| | | | | | | | | | Add consistent return to all functions and methods that are covered by tox -e pylint[23]. I haven't checked if return None is always a good idea or if we should rather raise an error. See: https://pagure.io/freeipa/issue/7326 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* x509: remove subject_base() functionStanislav Laznicka2017-11-011-13/+0
| | | | | | | | | | | The x509.subject_base() function is only used in tests. During the recent certificate refactoring, we had to get rid of the ipalib.x509 import from the module scope so that there were no circular dependecies and add it exactly to this funcion which is not used in the production code. Reviewed-By: Tibor Dudlak <tdudlak@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* x509: remove the strip_header() functionStanislav Laznicka2017-11-011-15/+0
| | | | | | | | We don't need the strip_header() function, to load an unknown x509 certificate, load_unknown_x509_certificate() should be used. Reviewed-By: Tibor Dudlak <tdudlak@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* p11-kit: add serial number in DER formatStanislav Laznicka2017-10-171-0/+7
| | | | | | | | | | | This causes Firefox to report our CA certificate as not-trustworthy. We were previously doing this correctly, however it slipped as an error due to certificate refactoring. https://pagure.io/freeipa/issue/7210 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* py3: fix pkcs7 file processingFraser Tweedale2017-09-221-1/+1
| | | | | | https://pagure.io/freeipa/issue/7131 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Don't write p11-kit EKU extension object if no EKUStanislav Laznicka2017-09-191-1/+4
| | | | | | | | | | | | | | | b5732efd introduced a regression because it tries to write EKU that's actually in the CA cert instead of using the LDAP information. However, when no EKU is available, IPACertificate.extended_key_usage_bytes still returned at least EKU_PLACEHOLDER OID to keep the behavior the same as in previous versions. This caused the EKU_PLACEHOLDER to be written in the ipa.p11-kit file which made Firefox report FreeIPA Web UI as improperly configured. https://pagure.io/freeipa/issue/7119 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* client: make ipa-client-install py3 compatibleStanislav Laznicka2017-08-021-1/+1
| | | | | | | | | | This commit enables ipa-client-install to be installable in Python 3 and makes it run in Python 3 by default. https://pagure.io/freeipa/issue/4985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Create a Certificate parameterStanislav Laznicka2017-07-271-38/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Up until now, Bytes parameter was used for certificate parameters throughout the framework. However, the Bytes parameter does nothing special for certificates, like validation, so this had to be done for each of the parameters which were supposed to represent a certificate. This commit introduces a special Certificate parameter which takes care of certificate validation so this does not have to be done separately. It also makes sure that the certificates represented by this parameter are always converted to DER format so that we can work with them in a unified manner throughout the framework. This commit also makes it possible to pass bytes directly during instantiation of the Certificate parameter and they are still represented correctly after their conversion in the _convert_scalar() method. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Introduce load_unknown_x509_certificate()Stanislav Laznicka2017-07-271-0/+14
| | | | | | | | | | | | load_unknown_x509_certificate() serves for the cases where we can't be sure what the format of its input certificate is. This is the case for installers, it should not be used anywhere else. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* x509: Make certificates represented as objectsStanislav Laznicka2017-07-271-204/+328
| | | | | | | | https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Split x509.load_certificate() into PEM/DER functionsStanislav Laznicka2017-07-271-23/+33
| | | | | | | | | | | | | Splitting the load_certificate() function into two separate helps us word the requirements for the input explicitly. It also makes our backend similar to the one of python-cryptography so eventually we can swap python-cryptography for IPA x509 module. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: trust IPA CA for PKINITJan Cholasta2017-05-191-0/+2
| | | | | | | | | | Trust IPA CA to issue PKINIT KDC and client authentication certificates in the IPA certificate store. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb: use certutil and match_hostname for cert verificationJan Cholasta2017-03-311-16/+55
| | | | | | | Use certutil and ssl.match_hostname calls instead of python-nss for certificate verification. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipalib.x509: Handle missing SAN gracefullyDavid Kupka2017-02-071-1/+5
| | | | | | | When extension is not present None is returned instead of empty iterable or exception thrown. Reviewed-By: Martin Basti <mbasti@redhat.com>
* py3: x509.py: return principal as unicode stringMartin Basti2017-02-071-6/+6
| | | | | | | | | X509 return principal as unicode string https://fedorahosted.org/freeipa/ticket/4985 https://fedorahosted.org/freeipa/ticket/6640 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* py3: normalize_certificate: support both bytes and unicodeMartin Basti2017-01-311-6/+15
| | | | | | https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: strip_header: support both bytes and unicodeMartin Basti2017-01-311-6/+10
| | | | | | | | Various method passed various bytes or unicode as parameter https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* x509: use PyASN1 to parse PKCS#7Jan Cholasta2016-12-221-17/+31
| | | | | | | | | | Use PyASN1 with the PKCS#7 definitions from `pyasn1_modules` to parse PKCS#7 in `pkcs7_to_pems()` instead of calling `openssl pkcs7` in a subprocess. https://fedorahosted.org/freeipa/ticket/6550 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Add function for extracting PEM certs from PKCS #7Fraser Tweedale2016-12-121-1/+28
| | | | | | | | | | | Add a single function for extracting X.509 certs in PEM format from a PKCS #7 object. Refactor sites that execute ``openssl pkcs7`` to use the new function. Part of: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove __main__ code from ipalib.x509 and ipalib.pkcs10Fraser Tweedale2016-11-101-15/+0
| | | | | | | | | | This code was presumably once used for testing, but has been subsumed by the actual test suite. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* x509: use python-cryptography to process certsFraser Tweedale2016-11-101-165/+162
| | | | | | | | | | | | | | | | | Update x509.load_certificate and related functions to return python-cryptography ``Certificate`` objects. Update the call sites accordingly, including removal of NSS initialisation code. Also update GeneralName parsing code to return python-cryptography GeneralName values, for consistency with other code that processes GeneralNames. The new function, `get_san_general_names`, and associated helper functions, can be removed when python-cryptography provides a way to deal with unrecognised critical extensions. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* x509: use pyasn1-modules X.509 specsFraser Tweedale2016-11-101-96/+7
| | | | | | | | | | | | | Remove our hand-rolled pyasn1 specifications for X.509 in favour of those provided by the pyasn1-modules library. This also avoids a bug in our _Extension spec wherein parsing fails if the 'critical' field is absent. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* x509: avoid use of nss.data_to_hexFraser Tweedale2016-11-101-0/+23
| | | | | | | | | | | Avoid use of the nss.data_to_hex function for formatting certificate fingerprints. Add our own helper functions to format the fingerprints as hex (with colons). Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* pkcs10: use python-cryptography for CSR processingFraser Tweedale2016-11-101-0/+39
| | | | | | | | | | Update ``ipalib.pkcs10`` module to use python-cryptography for CSR processing instead of NSS. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* x509: include otherName DER value in GeneralNameInfoFraser Tweedale2016-08-261-4/+9
| | | | | | | | | | We want to include the whole DER value when we pretty-print unrecognised otherNames, so add a field to the GeneralNameInfo namedtuple and populate it for otherNames. Part of: https://fedorahosted.org/freeipa/ticket/6022 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* x509: use NSS enums and OIDs to identify SAN typesFraser Tweedale2016-08-261-7/+23
| | | | | | | | | | GeneralName parsing currently relies heavily on strings from NSS. Make the code hopefully less brittle by identifying GeneralName types by NSS enums and, for otherName, the name-type OID also. Part of: https://fedorahosted.org/freeipa/ticket/6022 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* x509: fix SAN directoryName parsingFraser Tweedale2016-08-261-3/+9
| | | | | | | | | | | | | | The subjectAltName extension parsing code in ipalib.x509 fails on directoryName values because the Choice structure is not endowed with an inner type. Implement the Name structure, whose inner type is a CHOICE { SEQUENCE OF RelativeDistinguishedName }, to resolve. Note that the structure still does not get fully parsed; only enough to recognise the SequenceOf tag and not fail. Part of: https://fedorahosted.org/freeipa/ticket/6022 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move GeneralName parsing code to ipalib.x509Fraser Tweedale2016-08-261-1/+113
| | | | | | | | | | | GeneralName parsing code is primarily relevant to X.509. An upcoming change will add SAN parsing to the cert-show command, so first move the GeneralName parsing code from ipalib.pkcs10 to ipalib.x509. Part of: https://fedorahosted.org/freeipa/ticket/6022 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove service and host cert issuer validationFraser Tweedale2016-06-061-26/+0
| | | | | | | | | | | When adding certifiates to a host or service entry, we currently check that the issuer matches the issuer DN of the IPA CA. Now that sub-CAs have been implemented, this check is no longer valid and will cause false negatives. Remove it and update call sites. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Pylint: enable reimported checkMartin Basti2016-03-221-1/+0
| | | | | | | Fixes current reimports and enables pylint check for them Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* ipalib.x809: Accept bytes for make_pemPetr Viktorin2016-03-031-0/+2
| | | | | | Part of the work for https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Avoid builtins that were removed in Python 3Petr Viktorin2016-01-201-1/+1
| | | | | | | | | | | | - `file` was removed in favor of `open`. Switch to the new spelling. - `buffer` was removed in favor of a buffer protocol (and memoryview), and `reload` was moved to importlib. Both are used in py2-only blocks, so just placate PyLint. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipalib/x509.py: revert deletion of ipalib api importMartin Babinsky2016-01-041-0/+1
| | | | | | | | | | | This import statement has been removed in commit e4075b1fe26a608cd1f3778ee1f655a5f5700c65. This caused requests for service certs to fail, since the validation functions from x509 module crashed with NameError. https://fedorahosted.org/freeipa/ticket/5561 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused importsMartin Basti2015-12-231-2/+0
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* x509: Port to Python 3Petr Viktorin2015-10-131-1/+8
| | | | | | | | | | | | In python 3 , `bytes` has the buffer interface, and `buffer` was removed. Also, invalid padding in base64-encoded data raises a ValueError rather than TypeError. In tests, use pytest.assert_raises for more correct exception assertions. Also, get rid of unused imports in the tests Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Use the print functionPetr Viktorin2015-09-011-1/+3
| | | | | | | | | In Python 3, `print` is no longer a statement. Call it as a function everywhere, and include the future import to remove the statement in Python 2 code as well. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modernize 'except' clausesPetr Viktorin2015-08-121-3/+3
| | | | | | | The 'as' syntax works from Python 2 on, and Python 3 will drop the "comma" syntax. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix client ca.crt to match the server's certGabe2015-07-271-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/3809 Reviewed-By: Martin Basti <mbasti@redhat.com>
* reworked certificate normalization and revocationMartin Babinsky2015-07-021-3/+11
| | | | | | | | | | | Validation of certificate is now handled by `x509.validate_certificate'. Revocation of the host and service certificates was factored out to a separate function. Part of http://www.freeipa.org/page/V4/User_Certificates Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Re-initialize NSS database after otptoken plugin testsTomas Babej2014-11-261-11/+20
| | | | | | | | | | | OTP token tests do not properly reinitialize the NSS db, thus making subsequent xmlrpc tests fail on SSL cert validation. Make sure NSS db is re-initalized in the teardown method. https://fedorahosted.org/freeipa/ticket/4748 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Check LDAP instead of local configuration to see if IPA CA is enabledJan Cholasta2014-10-171-1/+1
| | | | | | | | The check is done using a new hidden command ca_is_enabled. https://fedorahosted.org/freeipa/ticket/4621 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 04:38:48 +0000