Skip to content

Commit a702c76

Browse files
yaroslaffyaroslaff
committed
tests for pkcs12
1 parent 8796ae3 commit a702c76

File tree

2 files changed

+161
-1
lines changed

2 files changed

+161
-1
lines changed

‎tests/test_gencert_main.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
from unittest import mock
22
from showcert.cli.gencert_main import main
3-
3+
import os
44
def test_cacert():
55
with mock.patch('sys.argv', ['gencert_main.py',
66
'--ca', '--cert', '/tmp/ca.pem', '--key', '/tmp/ca-priv.pem', "My CA"]):
@@ -20,9 +20,11 @@ def test_cert():
2020
'--cacert', '/tmp/ca.pem', '--cakey', '/tmp/ca-priv.pem', 'example.com', 'www.example.com', '0.0.0.1']):
2121
code = main()
2222
assert code == 0
23+
os.unlink('example.com.pem')
2324

2425
def test_cert_combined():
2526
with mock.patch('sys.argv', ['gencert_main.py',
2627
'--cacert', '/tmp/ca2.pem', 'example.com', 'www.example.com']):
2728
code = main()
2829
assert code == 0
30+
os.unlink('example.com.pem')

‎tests/test_pkcs12.py‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
from cryptography.hazmat.primitives.serialization import pkcs12
2+
from cryptography import x509
3+
from cryptography.hazmat.primitives import serialization, hashes
4+
from cryptography.hazmat.primitives.asymmetric import rsa
5+
from cryptography.x509.oid import NameOID
6+
7+
from showcert import process_cert
8+
import datetime
9+
from unittest import mock
10+
import os
11+
12+
class TestShowcertPKCS12():
13+
14+
showcert = 'showcert'
15+
gencert = 'gencert'
16+
testcert_p12 = '/tmp/testcert.p12'
17+
testchain_p12 = '/tmp/testchain.p12'
18+
password = 'mysecret'
19+
20+
21+
def make_p12chain(self):
22+
# Generate root CA
23+
root_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
24+
root_name = x509.Name([
25+
x509.NameAttribute(NameOID.COUNTRY_NAME, "US"),
26+
x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Root CA"),
27+
x509.NameAttribute(NameOID.COMMON_NAME, "Root CA"),
28+
])
29+
root_cert = (
30+
x509.CertificateBuilder()
31+
.subject_name(root_name)
32+
.issuer_name(root_name)
33+
.public_key(root_key.public_key())
34+
.serial_number(x509.random_serial_number())
35+
.not_valid_before(datetime.datetime.utcnow())
36+
.not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=3650))
37+
.add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
38+
.sign(root_key, hashes.SHA256())
39+
)
40+
41+
# Generate intermediate CA
42+
int_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
43+
int_name = x509.Name([
44+
x509.NameAttribute(NameOID.COUNTRY_NAME, "US"),
45+
x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Intermediate CA"),
46+
x509.NameAttribute(NameOID.COMMON_NAME, "Intermediate CA"),
47+
])
48+
int_cert = (
49+
x509.CertificateBuilder()
50+
.subject_name(int_name)
51+
.issuer_name(root_name)
52+
.public_key(int_key.public_key())
53+
.serial_number(x509.random_serial_number())
54+
.not_valid_before(datetime.datetime.utcnow())
55+
.not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=730))
56+
.add_extension(x509.BasicConstraints(ca=True, path_length=0), critical=True)
57+
.sign(root_key, hashes.SHA256())
58+
)
59+
60+
# Generate end-entity certificate
61+
ee_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
62+
ee_name = x509.Name([
63+
x509.NameAttribute(NameOID.COUNTRY_NAME, "US"),
64+
x509.NameAttribute(NameOID.ORGANIZATION_NAME, "My Company"),
65+
x509.NameAttribute(NameOID.COMMON_NAME, "mysite.com"),
66+
])
67+
ee_cert = (
68+
x509.CertificateBuilder()
69+
.subject_name(ee_name)
70+
.issuer_name(int_name)
71+
.public_key(ee_key.public_key())
72+
.serial_number(x509.random_serial_number())
73+
.not_valid_before(datetime.datetime.utcnow())
74+
.not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=365))
75+
.add_extension(x509.BasicConstraints(ca=False, path_length=None), critical=True)
76+
.sign(int_key, hashes.SHA256())
77+
)
78+
79+
# Create PKCS12 with chain (end-entity cert + intermediate + root)
80+
p12_data = pkcs12.serialize_key_and_certificates(
81+
name=b"cert-with-chain",
82+
key=ee_key,
83+
cert=ee_cert,
84+
cas=[int_cert, root_cert],
85+
encryption_algorithm=serialization.BestAvailableEncryption(self.password.encode())
86+
)
87+
88+
with open(self.testchain_p12, "wb") as f:
89+
f.write(p12_data)
90+
91+
print(f"Generated certificate with chain: {self.testchain_p12}")
92+
93+
94+
def make_p12(self):
95+
# Generate private key
96+
private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
97+
98+
# Create self-signed cert
99+
subject = issuer = x509.Name([
100+
x509.NameAttribute(NameOID.COUNTRY_NAME, "US"),
101+
x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "California"),
102+
x509.NameAttribute(NameOID.LOCALITY_NAME, "San Francisco"),
103+
x509.NameAttribute(NameOID.ORGANIZATION_NAME, "My Company"),
104+
x509.NameAttribute(NameOID.COMMON_NAME, "mysite.com"),
105+
])
106+
107+
cert = x509.CertificateBuilder().subject_name(
108+
subject
109+
).issuer_name(
110+
issuer
111+
).public_key(
112+
private_key.public_key()
113+
).serial_number(
114+
x509.random_serial_number()
115+
).not_valid_before(
116+
datetime.datetime.utcnow()
117+
).not_valid_after(
118+
datetime.datetime.utcnow() + datetime.timedelta(days=365)
119+
).add_extension(
120+
x509.BasicConstraints(ca=True, path_length=None), critical=True,
121+
).sign(private_key, hashes.SHA256())
122+
123+
# Export as PKCS12 (.p12)
124+
password = self.password.encode() # Change this!
125+
p12 = serialization.pkcs12.serialize_key_and_certificates(
126+
name=b"self-signed-cert",
127+
key=private_key,
128+
cert=cert,
129+
cas=None,
130+
encryption_algorithm=serialization.BestAvailableEncryption(self.password.encode())
131+
)
132+
133+
with open(self.testcert_p12, "wb") as f:
134+
f.write(p12)
135+
136+
print("Generated self_signed.p12")
137+
138+
139+
def test_p12(self):
140+
141+
self.make_p12()
142+
143+
rc = process_cert(CERT=self.testcert_p12, password=self.password)
144+
assert(rc == 1)
145+
146+
rc = process_cert(CERT=self.testcert_p12, password=self.password, insecure=True)
147+
assert(rc == 0)
148+
149+
# os.unlink(self.testcert_p12)
150+
151+
def test_chain_p12(self):
152+
153+
self.make_p12chain()
154+
155+
rc = process_cert(CERT=self.testchain_p12, password=self.password, insecure=True)
156+
assert(rc == 0)
157+
158+
# os.unlink(self.testcert_p12)

0 commit comments

Comments
 (0)