aswi2021jmsd-gitlab/tests/services/cryptography/sign_csr_test.py @ 98846b35

import subprocess

import pytest

from src.model.subject import Subject
from src.services.cryptography import CryptographyException


def export_crt(csr):
    return subprocess.check_output(["openssl", "x509", "-noout", "-text", "-in", "-"],
                                   input=bytes(csr, encoding="utf-8"), stderr=subprocess.STDOUT).decode()


def test_sign_csr(service):
    # create root CA
    root_key = service.create_private_key()
    root_ca = service.create_sscrt(Subject(common_name="foo"), root_key)

    # create a private key to be used to make a CSR for the intermediate CA
    inter_key = service.create_private_key()
    csr = service._CryptographyService__create_csr(Subject(common_name="bar", country="CZ"), inter_key)

    # sign the created CSR with root CA
    inter_ca = service._CryptographyService__sign_csr(csr, root_ca, root_key)

    inter_ca_printed = export_crt(inter_ca)

    # assert fields
    assert "Issuer: CN = foo" in inter_ca_printed
    assert "Subject: CN = bar, C = CZ" in inter_ca_printed


def test_sign_csr_passphrase(service):
    # create root CA and encrypt the private key of the root CA
    root_key_passphrase = "barbaz"
    root_key = service.create_private_key(passphrase=root_key_passphrase)
    root_ca = service.create_sscrt(Subject(common_name="foo"), root_key, key_pass=root_key_passphrase)

    # create a private key to be used to make a CSR for the intermediate CA
    inter_key = service.create_private_key()
    csr = service._CryptographyService__create_csr(Subject(common_name="bar", country="CZ"), inter_key)

    # sign the created CSR with root CA and specify root key passphrase
    inter_ca = service._CryptographyService__sign_csr(csr, root_ca, root_key, issuer_key_pass=root_key_passphrase)

    inter_ca_printed = export_crt(inter_ca)

    # assert fields
    assert "Issuer: CN = foo" in inter_ca_printed
    assert "Subject: CN = bar, C = CZ" in inter_ca_printed

    # try to sign it using a wrong passphrase
    with pytest.raises(CryptographyException) as e:
        service._CryptographyService__sign_csr(csr, root_ca, root_key,
                                               extensions="authorityInfoAccess = caIssuers;URI:bar.cz/baz.cert",
                                               issuer_key_pass="bazbaz")
    assert "bad decrypt" in e.value.message

    # try to sign it without specifying a passphrase
    with pytest.raises(CryptographyException) as e:
        service._CryptographyService__sign_csr(csr, root_ca, root_key,
                                               extensions="authorityInfoAccess = caIssuers;URI:bar.cz/baz.cert")
    assert "bad decrypt" in e.value.message


def test_sign_csr_extensions(service):
    # create root CA and encrypt the private key of the root CA
    root_key_passphrase = "barbaz"
    root_key = service.create_private_key(passphrase=root_key_passphrase)
    root_ca = service.create_sscrt(Subject(common_name="foo"), root_key, key_pass=root_key_passphrase)

    # create a private key to be used to make a CSR for the intermediate CA
    inter_key = service.create_private_key()
    csr = service._CryptographyService__create_csr(Subject(common_name="bar", country="CZ"), inter_key)

    # sign the created CSR with root CA and specify root key passphrase and specify extensions (AIA and CA)
    inter_ca = service._CryptographyService__sign_csr(csr, root_ca, root_key,
                                                      extensions="authorityInfoAccess = caIssuers;URI:bar.cz/baz/cert\nbasicConstraints=critical,CA:TRUE",
                                                      issuer_key_pass=root_key_passphrase)

    inter_ca_printed = export_crt(inter_ca)

    # assert fields
    assert "Issuer: CN = foo" in inter_ca_printed
    assert "Subject: CN = bar, C = CZ" in inter_ca_printed

    # assert extensions
    expected_extensions = """        X509v3 extensions:
            Authority Information Access: 
                CA Issuers - URI:bar.cz/baz/cert

            X509v3 Basic Constraints: critical
                CA:TRUE"""
    assert expected_extensions in inter_ca_printed