Revize 7f9b2c58

Re #8577 - Added a `generate_ocsp` method to the CryptoService - calls OpenSSL to generate the response.

src/services/cryptography.py

@@ -380 +380 @@
 
             return self.__run_for_output(args).decode("utf-8")
 
+    def generate_ocsp(self, cert, key, index_path, der_ocsp_request):
+        """
+        Generate an OCSP Response from an OCSP Request given the issuer cert, issuer cert key and the index file.
+        The OSCP Response is signed by the CA itself (recommended way according to multiple sources).
+
+        :param cert: issuer certificate
+        :param key: corresponding key
+        :param index_path: path/to/the/generated/index/file
+        :param der_ocsp_request: DER encoded OCSP Request
+        :return: DER encoded OCSP Response
+        """
+        with TemporaryFile("certificate.pem", cert.pem_data) as ca_certificate, \
+             TemporaryFile("private_key.pem", key.private_key) as key_file, \
+             TemporaryFile("request.der", der_ocsp_request) as request_file:
+
+            args = ["ocsp", "-index", index_path, "-CA", ca_certificate, "-rsigner", ca_certificate, "-rkey", key_file,
+                    "-reqin", request_file, "-respout", "-"]
+
+            if key.password is not None and key.password != "":
+                args.extend(["-passin", f"pass:{key.password}"])
+
+            return self.__run_for_output(args)
+
 
 class CryptographyException(Exception):