@@ -57,13 +57,14 @@ def remove_passphrase(
57
57
key_in_path : str ,
58
58
password : str ,
59
59
key_out_path : str ,
60
- timeout : int = 10 ) -> bool :
60
+ timeout : int = 10 ,
61
+ ) -> bool :
61
62
"""Remove passphrase from a private key."""
62
63
command = [
63
64
'openssl' , 'rsa' ,
64
65
'-passin' , 'pass:%s' % password ,
65
66
'-in' , key_in_path ,
66
- '-out' , key_out_path
67
+ '-out' , key_out_path ,
67
68
]
68
69
return run_openssl_command (command , timeout )
69
70
@@ -72,12 +73,13 @@ def gen_private_key(
72
73
key_path : str ,
73
74
password : str ,
74
75
bits : int = 2048 ,
75
- timeout : int = 10 ) -> bool :
76
+ timeout : int = 10 ,
77
+ ) -> bool :
76
78
"""Generates a private key."""
77
79
command = [
78
80
'openssl' , 'genrsa' , '-aes256' ,
79
81
'-passout' , 'pass:%s' % password ,
80
- '-out' , key_path , str (bits )
82
+ '-out' , key_path , str (bits ),
81
83
]
82
84
return run_openssl_command (command , timeout )
83
85
@@ -90,15 +92,16 @@ def gen_public_key(
90
92
alt_subj_names : Optional [List [str ]] = None ,
91
93
extended_key_usage : Optional [str ] = None ,
92
94
validity_in_days : int = 365 ,
93
- timeout : int = 10 ) -> bool :
95
+ timeout : int = 10 ,
96
+ ) -> bool :
94
97
"""For a given private key, generates a corresponding public key."""
95
98
with ssl_config (alt_subj_names , extended_key_usage ) as (config_path , has_extension ):
96
99
command = [
97
100
'openssl' , 'req' , '-new' , '-x509' , '-sha256' ,
98
101
'-days' , str (validity_in_days ), '-subj' , subject ,
99
102
'-passin' , 'pass:%s' % private_key_password ,
100
103
'-config' , config_path ,
101
- '-key' , private_key_path , '-out' , public_key_path
104
+ '-key' , private_key_path , '-out' , public_key_path ,
102
105
]
103
106
if has_extension :
104
107
command .extend ([
@@ -112,13 +115,14 @@ def gen_csr(
112
115
key_path : str ,
113
116
password : str ,
114
117
crt_path : str ,
115
- timeout : int = 10 ) -> bool :
118
+ timeout : int = 10 ,
119
+ ) -> bool :
116
120
"""Generates a CSR based upon existing certificate and key file."""
117
121
command = [
118
122
'openssl' , 'x509' , '-x509toreq' ,
119
123
'-passin' , 'pass:%s' % password ,
120
124
'-in' , crt_path , '-signkey' , key_path ,
121
- '-out' , csr_path
125
+ '-out' , csr_path ,
122
126
]
123
127
return run_openssl_command (command , timeout )
124
128
@@ -133,7 +137,8 @@ def sign_csr(
133
137
alt_subj_names : Optional [List [str ]] = None ,
134
138
extended_key_usage : Optional [str ] = None ,
135
139
validity_in_days : int = 365 ,
136
- timeout : int = 10 ) -> bool :
140
+ timeout : int = 10 ,
141
+ ) -> bool :
137
142
"""Sign a CSR using CA key and certificate."""
138
143
with ext_file (alt_subj_names , extended_key_usage ) as extension_path :
139
144
command = [
@@ -152,7 +157,8 @@ def sign_csr(
152
157
153
158
def get_ext_config (
154
159
alt_subj_names : Optional [List [str ]] = None ,
155
- extended_key_usage : Optional [str ] = None ) -> bytes :
160
+ extended_key_usage : Optional [str ] = None ,
161
+ ) -> bytes :
156
162
config = b''
157
163
# Add SAN extension
158
164
if alt_subj_names is not None and len (alt_subj_names ) > 0 :
@@ -169,12 +175,14 @@ def get_ext_config(
169
175
@contextlib .contextmanager
170
176
def ext_file (
171
177
alt_subj_names : Optional [List [str ]] = None ,
172
- extended_key_usage : Optional [str ] = None ) -> Generator [str , None , None ]:
178
+ extended_key_usage : Optional [str ] = None ,
179
+ ) -> Generator [str , None , None ]:
173
180
# Write config to temp file
174
181
config_path = os .path .join (tempfile .gettempdir (), uuid .uuid4 ().hex )
175
182
with open (config_path , 'wb' ) as cnf :
176
183
cnf .write (
177
- get_ext_config (alt_subj_names , extended_key_usage ))
184
+ get_ext_config (alt_subj_names , extended_key_usage ),
185
+ )
178
186
179
187
yield config_path
180
188
@@ -185,7 +193,8 @@ def ext_file(
185
193
@contextlib .contextmanager
186
194
def ssl_config (
187
195
alt_subj_names : Optional [List [str ]] = None ,
188
- extended_key_usage : Optional [str ] = None ) -> Generator [Tuple [str , bool ], None , None ]:
196
+ extended_key_usage : Optional [str ] = None ,
197
+ ) -> Generator [Tuple [str , bool ], None , None ]:
189
198
config = DEFAULT_CONFIG
190
199
191
200
has_extension = False
@@ -212,7 +221,7 @@ def run_openssl_command(command: List[str], timeout: int) -> bool:
212
221
cmd = subprocess .Popen (
213
222
command ,
214
223
stdout = subprocess .PIPE ,
215
- stderr = subprocess .PIPE
224
+ stderr = subprocess .PIPE ,
216
225
)
217
226
cmd .communicate (timeout = timeout )
218
227
return cmd .returncode == 0
@@ -221,7 +230,7 @@ def run_openssl_command(command: List[str], timeout: int) -> bool:
221
230
if __name__ == '__main__' :
222
231
available_actions = (
223
232
'remove_passphrase' , 'gen_private_key' , 'gen_public_key' ,
224
- 'gen_csr' , 'sign_csr'
233
+ 'gen_csr' , 'sign_csr' ,
225
234
)
226
235
227
236
parser = argparse .ArgumentParser (
@@ -231,7 +240,7 @@ def run_openssl_command(command: List[str], timeout: int) -> bool:
231
240
'action' ,
232
241
type = str ,
233
242
default = None ,
234
- help = 'Valid actions: ' + ', ' .join (available_actions )
243
+ help = 'Valid actions: ' + ', ' .join (available_actions ),
235
244
)
236
245
parser .add_argument (
237
246
'--password' ,
@@ -294,17 +303,24 @@ def run_openssl_command(command: List[str], timeout: int) -> bool:
294
303
if args .action == 'gen_private_key' :
295
304
gen_private_key (args .private_key_path , args .password )
296
305
elif args .action == 'gen_public_key' :
297
- gen_public_key (args .public_key_path , args .private_key_path ,
298
- args .password , args .subject )
306
+ gen_public_key (
307
+ args .public_key_path , args .private_key_path ,
308
+ args .password , args .subject ,
309
+ )
299
310
elif args .action == 'remove_passphrase' :
300
- remove_passphrase (args .private_key_path , args .password ,
301
- args .private_key_path )
311
+ remove_passphrase (
312
+ args .private_key_path , args .password ,
313
+ args .private_key_path ,
314
+ )
302
315
elif args .action == 'gen_csr' :
303
316
gen_csr (
304
317
args .csr_path ,
305
318
args .private_key_path ,
306
319
args .password ,
307
- args .public_key_path )
320
+ args .public_key_path ,
321
+ )
308
322
elif args .action == 'sign_csr' :
309
- sign_csr (args .csr_path , args .crt_path , args .private_key_path , args .password ,
310
- args .public_key_path , str (int (time .time ())), alt_subj_names = [args .hostname , ])
323
+ sign_csr (
324
+ args .csr_path , args .crt_path , args .private_key_path , args .password ,
325
+ args .public_key_path , str (int (time .time ())), alt_subj_names = [args .hostname ],
326
+ )
0 commit comments