Revize 2c8b7911

Re #8708 - Implemented a new method in the CryptographyService that allows the caller to create a PKCS12 identity of a certificate and it's chain of trust

Covered the new method with unit tests.

src/services/cryptography.py

@@ -2 +2 @@
 import subprocess
 import time
 import random
+from typing import List
 
 from src.constants import CRL_CONFIG
 from src.model.certificate import Certificate
@@ -411 +412 @@
 
         # openssl ca requires the .srl file to exists, therefore a dummy, unused file is created
         with TemporaryFile("serial.srl", "0") as serial_file, \
-             TemporaryFile("crl.conf", CRL_CONFIG % (index_file_path, serial_file)) as config_file, \
-             TemporaryFile("certificate.pem", cert.pem_data) as cert_file, \
-             TemporaryFile("private_key.pem", key.private_key) as key_file:
-
+                TemporaryFile("crl.conf", CRL_CONFIG % (index_file_path, serial_file)) as config_file, \
+                TemporaryFile("certificate.pem", cert.pem_data) as cert_file, \
+                TemporaryFile("private_key.pem", key.private_key) as key_file:
             args = ["ca", "-config", config_file, "-gencrl", "-keyfile", key_file, "-cert", cert_file, "-outdir", "."]
 
             if key.password is not None and key.password != "":
@@ -437 +437 @@
         Logger.debug("Function launched.")
 
         with TemporaryFile("certificate.pem", cert.pem_data) as ca_certificate, \
-             TemporaryFile("private_key.pem", key.private_key) as key_file, \
-             TemporaryFile("request.der", der_ocsp_request) as request_file:
-
+                TemporaryFile("private_key.pem", key.private_key) as key_file, \
+                TemporaryFile("request.der", der_ocsp_request) as request_file:
             args = ["ocsp", "-index", index_path, "-CA", ca_certificate, "-rsigner", ca_certificate, "-rkey", key_file,
                     "-reqin", request_file, "-respout", "-"]
 
@@ -448 +447 @@
 
             return self.__run_for_output(args)
 
+    def generate_pkcs_identity(self, cert_pem: str, cert_key_pem: str, identity_name: str, identity_passphrase: str,
+                               chain_of_trust_pems: List[str], cert_key_passphrase: str = None):
+        """
+        Generates a PKCS12 identity of the given child certificate while including the given chain of trust.
+
+        :param cert_pem: PEM of the certificate whose identity should be created
+        :param cert_key_pem: PEM of the private key used to sign the certificate whose identity should be created
+        :param identity_name: the name to be given to the identity created
+        :param chain_of_trust_pems: list of PEMs representing certificates present in the chain of trust of the certificate
+        whose identity should be created
+        :param identity_passphrase: passphrase to be used when encrypting the identity
+        :param cert_key_passphrase: passphrase of the key used to sign the certificate whose identity should be created
+        :return: byte array containing the generated identity
+        """
+        with TemporaryFile("cert_key.pem", cert_key_pem) as cert_key_pem_file:
+            args = ["pkcs12", "-export", "-name", identity_name, "-in", "-", "-inkey", cert_key_pem_file, "-CAfile",
+                    "-", "-passout", f"pass:{identity_passphrase}", "-passin", f"pass:{cert_key_passphrase}"]
+            return self.__run_for_output(args,
+                                         proc_input=bytes(cert_pem + "".join(chain_of_trust_pems),
+                                                          encoding="utf-8"))
+
 
 class CryptographyException(Exception):