Revize 329216fe

Re #8585 - Fixed an issue where required extensions based on cert. usages were not present in the generated certificate

Created an utility that converts usages to extension configuration lines
Defined which extension field flags are required for certain usages

src/services/certificate_service.py

@@ -4 +4 @@
 
 from src.config.configuration import Configuration
 from src.constants import ROOT_CA_ID, INTERMEDIATE_CA_ID, CA_ID, CERTIFICATE_ID, CERTIFICATE_STATES, \
-    CERTIFICATE_REVOCATION_REASONS
+    CERTIFICATE_REVOCATION_REASONS, SSL_ID, SIGNATURE_ID, AUTHENTICATION_ID
 from src.dao.certificate_repository import CertificateRepository
 from src.exceptions.certificate_not_found_exception import CertificateNotFoundException
 from src.exceptions.database_exception import DatabaseException
@@ -16 +16 @@
 
 import time
 
+from src.utils.usages_to_extensions import usages_to_extension_lines, ExtensionFieldFlags, CRITICAL, KEY_CERT_SIGN, \
+    CRL_SIGN, CA, DIGITAL_SIGNATURE, KEY_ENCIPHERMENT, KEY_AGREEMENT, SERVER_AUTH, NON_REPUDIATION, TIME_STAMPING, \
+    CLIENT_AUTH
+
 VALID_FROM_TO_DATE_FORMAT = "%d.%m.%Y %H:%M:%S"
 CA_EXTENSIONS = "basicConstraints=critical,CA:TRUE"
 CRL_EXTENSION = "crlDistributionPoints=URI:"
@@ -23 +27 @@
 STATUS_REVOKED = "revoked"
 STATUS_VALID = "valid"
 
+# define which flags are required for various usages
+REQUIRED_USAGE_EXTENSION_FLAGS = {
+    CA_ID: ExtensionFieldFlags({CRITICAL, KEY_CERT_SIGN, CRL_SIGN}, {}, {CRITICAL, CA}),
+    SSL_ID: ExtensionFieldFlags({DIGITAL_SIGNATURE, KEY_ENCIPHERMENT, KEY_AGREEMENT}, {SERVER_AUTH}, {}),
+    SIGNATURE_ID: ExtensionFieldFlags({DIGITAL_SIGNATURE, NON_REPUDIATION}, {TIME_STAMPING}, {}),
+    AUTHENTICATION_ID: ExtensionFieldFlags({DIGITAL_SIGNATURE}, {CLIENT_AUTH}, {})}
+
 
 class CertificateService:
 
@@ -52 +63 @@
 
         cert_id = self.certificate_repository.get_next_id()
 
+        # specify CA usage
+        usages[CA_ID] = True
+
+        # generate extension configuration lines based on the specified usages
+        extensions = extensions + "\n" + "\n".join(usages_to_extension_lines(usages, REQUIRED_USAGE_EXTENSION_FLAGS))
+
         # create a new self signed  certificate
         cert_pem = self.cryptography_service.create_sscrt(subject, key.private_key, key_pass=key.password,
                                                           extensions=extensions, config=config, days=days, sn=cert_id)
-        # specify CA usage
-        usages[CA_ID] = True
 
         # wrap into Certificate class
         certificate = self.__create_wrapper(cert_pem, key.private_key_id, usages, 0,
@@ -111 +126 @@
         if usages is None:
             usages = {}
 
-        extensions = extensions + "\n" + CA_EXTENSIONS
+        # specify CA usage
+        usages[CA_ID] = True
+
+        # generate extension configuration lines based on the specified usages
+        extensions = extensions + "\n" + "\n".join(usages_to_extension_lines(usages, REQUIRED_USAGE_EXTENSION_FLAGS))
+
         # Add CRL and OCSP distribution point to certificate extensions
         cert_id = self.certificate_repository.get_next_id()
         extensions = extensions + "\n" + CRL_EXTENSION + " " + self.__get_crl_endpoint(issuer_cert.certificate_id)
@@ -125 +145 @@
                                                         days=days,
                                                         sn=cert_id)
 
-        # specify CA usage
-        usages[CA_ID] = True
-
         # wrap into Certificate class
         self.__create_wrapper(cert_pem, subject_key.private_key_id, usages,
                               issuer_cert.certificate_id, INTERMEDIATE_CA_ID)
@@ -139 +156 @@
         not_before_formatted = time.strftime(VALID_FROM_TO_DATE_FORMAT, not_before)
         not_after_formatted = time.strftime(VALID_FROM_TO_DATE_FORMAT, not_after)
 
-        # specify CA usage
-        usages[CA_ID] = True
-
         # create a certificate wrapper
         certificate = Certificate(-1, subject.common_name, not_before_formatted, not_after_formatted, cert_pem,
                                   subject_key.private_key_id, INTERMEDIATE_CA_ID, issuer_cert.certificate_id, usages)
@@ -174 +188 @@
         # get the next certificate ID in order to be able to specify the serial number
         cert_id = self.certificate_repository.get_next_id()
 
+        # generate extension configuration lines based on the specified usages
+        extensions = extensions + "\n" + "\n".join(usages_to_extension_lines(usages, REQUIRED_USAGE_EXTENSION_FLAGS))
+
         # Add CRL and OCSP distribution point to certificate extensions
         extensions = extensions + "\n" + CRL_EXTENSION + " " + self.__get_crl_endpoint(issuer_cert.certificate_id)
         extensions = extensions + "\n" + OCSP_EXTENSION + " " + self.__get_ocsp_endpoint(issuer_cert.certificate_id)