Revize df7f5fda

Re #8708 - Changed the behaviour of the generate_pkcs_identity method in the CryptographyService that now does not use the -CAfile argument when the passed chain of trust is empty

Added a unit test verifying that the changed method works as expected when empty chain of trust is passed

src/services/cryptography.py

@@ -462 +462 @@
         :return: byte array containing the generated identity
         """
         with TemporaryFile("cert_key.pem", cert_key_pem) as cert_key_pem_file:
-            args = ["pkcs12", "-export", "-name", identity_name, "-in", "-", "-inkey", cert_key_pem_file, "-CAfile",
-                    "-", "-passout", f"pass:{identity_passphrase}", "-passin", f"pass:{cert_key_passphrase}"]
+            args = ["pkcs12", "-export", "-name", identity_name, "-in", "-", "-inkey", cert_key_pem_file, "-passout", f"pass:{identity_passphrase}", "-passin", f"pass:{cert_key_passphrase}"]
+            proc_input = cert_pem
+            # when the chain of trust is not empty append the -CAfile argument and the concatenated list of CoT PEMs
+            # to the input of the process to be launched
+            if len(chain_of_trust_pems) > 0:
+                args.extend(["-CAfile", "-", ])
+                proc_input += "".join(chain_of_trust_pems)
             return self.__run_for_output(args,
-                                         proc_input=bytes(cert_pem + "".join(chain_of_trust_pems),
-                                                          encoding="utf-8"))
+                                         proc_input=bytes(proc_input, encoding="utf-8"))
 
 
 class CryptographyException(Exception):