| #!/usr/bin/env python |
| |
| # |
| # =================================================================== |
| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| # =================================================================== |
| # |
| |
| # This script creates the private keys and certificates required for |
| # running the serf test suite. |
| # |
| # It should be run from the test/certs folder without arguments. |
| # Certificates will be created in the test/certs folder, private keys in the |
| # test/certs/private folder. |
| # |
| # You'll need to install pyOpenSSL for this script to work. |
| |
| from OpenSSL import crypto, SSL |
| from calendar import timegm |
| from datetime import datetime |
| |
| # for serf, update this number every time the certs are updated. |
| SERIAL_NUMBER=100020 |
| |
| KEY_ALGO=crypto.TYPE_RSA |
| KEY_SIZE=2048 |
| KEY_CIPHER='DES3' |
| SIGN_ALGO='SHA256' |
| VALID_DAYS=365 * 3 |
| |
| def create_key(keyfile='', passphrase=None): |
| key = crypto.PKey() |
| key.generate_key(KEY_ALGO, KEY_SIZE) |
| if passphrase: |
| open(keyfile, "wt").write(crypto.dump_privatekey(crypto.FILETYPE_PEM, |
| key, KEY_CIPHER, |
| passphrase)) |
| else: |
| open(keyfile, "wt").write(crypto.dump_privatekey(crypto.FILETYPE_PEM, |
| key)) |
| |
| return key |
| |
| def create_pkcs12(clientkey, clientcert, issuer, pkcs12file, passphrase=None): |
| pkcs12 = crypto.PKCS12() |
| |
| pkcs12.set_certificate(clientcert) |
| pkcs12.set_privatekey(clientkey) |
| pkcs12.set_ca_certificates([issuer]) |
| open(pkcs12file, "wt").write(pkcs12.export(passphrase=passphrase, |
| iter=2048, maciter=2048)) |
| |
| def create_crl(revokedcert, cakey, cacert, crlfile, next_crl_days=VALID_DAYS): |
| crl = crypto.CRL() |
| revoked = crypto.Revoked() |
| |
| serial_number = "%x" % revokedcert.get_serial_number() |
| now = datetime.utcnow() |
| now_str = now.strftime('%Y%m%d%H%M%SZ') |
| |
| revoked.set_serial(serial_number) |
| revoked.set_reason('unspecified') |
| revoked.set_rev_date(now_str) # revoked as of now |
| |
| crl.add_revoked(revoked) |
| try: |
| exported = crl.export(cacert, cakey, days=next_crl_days, digest=b"md5") |
| except TypeError: |
| # Some very old versions of pyopenssl (such as the one on macOS) |
| # do not support the 'digest' keyword argument. |
| exported = crl.export(cacert, cakey, days=next_crl_days) |
| open(crlfile, "wt").write(exported) |
| |
| # subjectAltName |
| def create_cert(subjectkey, certfile, issuer=None, issuerkey=None, country='', |
| state='', city='', org='', ou='', cn='', email='', ca=False, |
| valid_before=0, days_valid=VALID_DAYS, subjectAltName=None, |
| ocsp_responder_url=None, ocsp_signer=False): |
| ''' |
| Create a X509 signed certificate. |
| |
| subjectAltName |
| Array of fully qualified subject alternative names (use OpenSSL syntax): |
| For a DNS entry, use: ['DNS:localhost']. Other options are 'email', 'URI', 'IP'. |
| ''' |
| cert = crypto.X509() |
| |
| cert.set_version(3-1) # version 3, starts at 0 |
| cert.get_subject().C = country |
| cert.get_subject().ST = state |
| cert.get_subject().L = city |
| cert.get_subject().O = org |
| cert.get_subject().OU = ou |
| if cn: |
| cert.get_subject().CN = cn |
| cert.get_subject().emailAddress = email |
| cert.set_serial_number(SERIAL_NUMBER) |
| cert.set_pubkey(subjectkey) |
| |
| cert.gmtime_adj_notBefore(valid_before * 24 * 3600) |
| cert.gmtime_adj_notAfter(days_valid * 24 * 3600) |
| |
| if issuer is None: |
| issuer = cert # self signed |
| issuerkey = subjectkey |
| cert.set_issuer(issuer.get_subject()) |
| |
| if ca: |
| cert.add_extensions([ |
| crypto.X509Extension("basicConstraints", False, |
| "CA:TRUE"), |
| crypto.X509Extension("subjectKeyIdentifier", False, "hash", |
| subject=cert) |
| ]) |
| cert.add_extensions([ |
| crypto.X509Extension("authorityKeyIdentifier", False, |
| "keyid:always", issuer=issuer) |
| ]) |
| |
| if subjectAltName: |
| critical = True if not cn else False |
| cert.add_extensions([ |
| crypto.X509Extension('subjectAltName', critical, ", ".join(subjectAltName))]) |
| |
| if ocsp_responder_url: |
| cert.add_extensions([ |
| crypto.X509Extension('authorityInfoAccess', False, |
| 'OCSP;URI:' + ocsp_responder_url)]) |
| |
| if ocsp_signer: |
| cert.add_extensions([ |
| crypto.X509Extension('extendedKeyUsage', True, 'OCSPSigning') |
| ]) |
| |
| cert.sign(issuerkey, SIGN_ALGO) |
| |
| open(certfile, "wt").write(crypto.dump_certificate(crypto.FILETYPE_PEM, |
| cert)) |
| return cert |
| |
| if __name__ == '__main__': |
| # root CA key pair and certificate. |
| # This key will be used to sign the intermediate CA certificate |
| rootcakey = create_key('private/serfrootcakey.pem', 'serftest') |
| |
| rootcacert = create_cert(subjectkey=rootcakey, |
| certfile='serfrootcacert.pem', |
| country='BE', state='Antwerp', city='Mechelen', |
| org='In Serf we trust, Inc.', |
| ou='Test Suite Root CA', cn='Serf Root CA', |
| email='serfrootca@example.com', ca=True) |
| |
| # intermediate CA key pair and certificate |
| # This key will be used to sign all server certificates |
| cakey = create_key('private/serfcakey.pem', 'serftest') |
| |
| cacert = create_cert(subjectkey=cakey, certfile='serfcacert.pem', |
| issuer=rootcacert, issuerkey=rootcakey, |
| country='BE', state='Antwerp', city='Mechelen', |
| org='In Serf we trust, Inc.', |
| ou='Test Suite CA', cn='Serf CA', |
| email='serfca@example.com', ca=True) |
| |
| # server key pair |
| # server certificate, no errors |
| serverkey = create_key('private/serfserverkey.pem', 'serftest') |
| |
| servercert = create_cert(subjectkey=serverkey, |
| certfile='serfservercert.pem', |
| issuer=cacert, issuerkey=cakey, |
| country='BE', state='Antwerp', city='Mechelen', |
| org='In Serf we trust, Inc.', |
| ou='Test Suite Server', cn='localhost', |
| email='serfserver@example.com') |
| |
| # server certificate that expired a year ago |
| expiredcert = create_cert(subjectkey=serverkey, |
| certfile='serfserver_expired_cert.pem', |
| issuer=cacert, issuerkey=cakey, |
| country='BE', state='Antwerp', city='Mechelen', |
| org='In Serf we trust, Inc.', |
| ou='Test Suite Server', cn='localhost', |
| email='serfserver@example.com', |
| days_valid=-365) |
| |
| # server certificate that will be valid in 10 years |
| expiredcert = create_cert(subjectkey=serverkey, |
| certfile='serfserver_future_cert.pem', |
| issuer=cacert, issuerkey=cakey, |
| country='BE', state='Antwerp', city='Mechelen', |
| org='In Serf we trust, Inc.', |
| ou='Test Suite Server', cn='localhost', |
| email='serfserver@example.com', |
| valid_before=10*365, |
| days_valid=13*365) |
| |
| # server certificate with SubjectAltName and empty CN |
| san_nocncert = create_cert(subjectkey=serverkey, |
| certfile='serfserver_san_nocn_cert.pem', |
| issuer=cacert, issuerkey=cakey, |
| country='BE', state='Antwerp', city='Mechelen', |
| org='In Serf we trust, Inc.', |
| ou='Test Suite Server', |
| cn=None, |
| email='serfserver@example.com', |
| days_valid=13*365, |
| subjectAltName=['DNS:localhost']) |
| |
| # server certificate with OCSP responder URL |
| ocspcert = create_cert(subjectkey=serverkey, |
| certfile='serfserver_san_ocsp_cert.pem', |
| issuer=cacert, issuerkey=cakey, |
| country='BE', state='Antwerp', city='Mechelen', |
| org='In Serf we trust, Inc.', |
| ou='Test Suite Server', |
| cn='localhost', |
| email='serfserver@example.com', |
| days_valid=13*365, |
| subjectAltName=['DNS:localhost'], |
| ocsp_responder_url='http://localhost:17080') |
| |
| # OCSP responder certifi |
| ocsprspcert = create_cert(subjectkey=serverkey, |
| certfile='serfocspresponder.pem', |
| issuer=cacert, issuerkey=cakey, |
| country='BE', state='Antwerp', city='Mechelen', |
| org='In Serf we trust, Inc.', |
| ou='Test Suite Server', |
| cn='localhost', |
| email='serfserver@example.com', |
| days_valid=13*365, |
| ocsp_signer=True) |
| |
| # client key pair and certificate |
| clientkey = create_key('private/serfclientkey.pem', 'serftest') |
| |
| clientcert = create_cert(subjectkey=clientkey, |
| certfile='serfclientcert.pem', |
| issuer=cacert, issuerkey=cakey, |
| country='BE', state='Antwerp', city='Mechelen', |
| org='In Serf we trust, Inc.', |
| ou='Test Suite Client', cn='Serf Client', |
| email='serfclient@example.com') |
| |
| clientpkcs12 = create_pkcs12(clientkey, clientcert, cacert, |
| 'serfclientcert.p12', 'serftest') |
| |
| # Note that this creates a v1 CRL file without extensions set, and with |
| # MD5 hash. Not ideal, but pyOpenSSL doesn't support more than this. |
| # |
| # crl |
| crl = create_crl(servercert, cakey, cacert, 'serfservercrl.pem') |
