Revize 1fa20e93

Re #8708 - Implemented a new method in the CertificateService that does generate a PKCS12 identity by using the CryptographyService

Covered the new method with few integration tests
Fixed minor typos in the CertificateService

src/services/certificate_service.py

@@ -434 +434 @@
         # Read the selected certificate from the repository
         certificate = self.certificate_repository.read(id)
         if certificate is None:
-            Logger.error("Certificate whose details were requested does not exists.")
+            Logger.error("Certificate whose details were requested does not exist.")
             raise CertificateNotFoundException(id)
 
         # check the expiration date using OpenSSL
@@ -477 +477 @@
 
         return self.configuration.base_server_url + "/api/ocsp/" + str(ca_identifier)
 
+    def generate_pkcs_identity(self, cert_id: int, cert_key: PrivateKey, identity_name: str, identity_passphrase: str):
+        """
+        Generates a PKCS identity of the certificate given by the specified ID while using the private key passed.
+        A name of the identity to be used and certificate's passphrase have to be specified as well as the passphrase
+        of certificate's private key (if encrypted).
+        :param cert_id: ID of the certificate to be put into the PKCS identity store
+        :param cert_key: key used to sign the given certificate
+        :param identity_name: name to be given to the identity to be created
+        :param identity_passphrase: passphrase to be used to encrypt the identity
+        :return: byte array containing the generated identity (PKCS12 store)
+        """
+        Logger.debug("Function launched.")
+
+        # Read the selected certificate from the repository
+        certificate = self.certificate_repository.read(cert_id)
+        if certificate is None:
+            Logger.error("Certificate whose identity should be generated does not exist.")
+            raise CertificateNotFoundException(cert_id)
+
+        # get the chain of trust of the certificate whose identity should be generated and exclude the certificate
+        # whose chain of trust we are querying
+        cot_pem_list = [cert.pem_data for cert in self.get_chain_of_trust(cert_id, exclude_root=False)[1:]]
+
+        return self.cryptography_service.generate_pkcs_identity(certificate.pem_data, cert_key.private_key,
+                                                                identity_name,
+                                                                identity_passphrase, cot_pem_list, cert_key.password)
+
 
 class RevocationReasonInvalidException(Exception):
     """

tests/integration_tests/services/certificate_service_test.py

@@ -394 +394 @@
 
     with pytest.raises(CertificateNotFoundException) as e:
         certificate_service_unique.get_certificate_state(888)
+
+
+def test_create_pkcs_identity(certificate_service_unique, private_key_service_unique):
+    # create tests certificates
+    root_ca_private_key = private_key_service_unique.create_new_key()
+    intermediate_ca_key = private_key_service_unique.create_new_key()
+    child_key = private_key_service_unique.create_new_key()
+
+    root_ca_cert = certificate_service_unique.create_root_ca(root_ca_private_key,
+                                                             Subject(common_name="RootFoo",
+                                                                     organization_unit="Department of Foo"))
+
+    intermediate_ca_cert = certificate_service_unique.create_end_cert(intermediate_ca_key,
+                                                                   Subject(common_name="Intermediate Bar"),
+                                                                   root_ca_cert,
+                                                                   root_ca_private_key, usages={SSL_ID: True})
+
+    child_cert = certificate_service_unique.create_end_cert(child_key,
+                                                            Subject(common_name="Foo Child"),
+                                                            intermediate_ca_cert,
+                                                            intermediate_ca_key, usages={SSL_ID: True})
+
+    # generate the identity
+    pkcs = certificate_service_unique.generate_pkcs_identity(child_cert.certificate_id, child_key, "Foo Child's Identity", "pass")
+
+    # print out the pkcs store in order to be able to check it
+    pkcs_info = subprocess.check_output(
+        ["openssl", "pkcs12", "-info", "-in", "-", "-nodes", "-passin", "pass:pass"],
+        input=pkcs,
+        stderr=subprocess.STDOUT).decode()
+
+    assert child_cert.pem_data in pkcs_info
+    assert intermediate_ca_cert.pem_data in pkcs_info
+    assert root_ca_cert.pem_data in pkcs_info
+
+
+def test_create_pkcs_identity_incorrect_id(certificate_service_unique):
+    with pytest.raises(CertificateNotFoundException):
+        certificate_service_unique.generate_pkcs_identity(999, None, None, None)