commit dd03da191d06841ad03512330ee3d74e2f2155cf
Author: Stanislav Král <stanislav.kral3@gmail.com>
Date:   Wed Mar 31 10:04:26 2021 +0200

    Re #8472 - Changed access modifiers of some methods and fixed verify_ca_test.py

diff --git a/proj/services/cryptography.py b/proj/services/cryptography.py
index 396e246..cb22f7a 100644
--- a/proj/services/cryptography.py
+++ b/proj/services/cryptography.py
@@ -12,7 +12,7 @@ OPENSSL_EXECUTABLE = "openssl"
 class CryptographyService:
 
     @staticmethod
-    def subject_to_param_format(subject):
+    def _subject_to_param_format(subject):
         subj_dict = {}
         if subject.common_name is not None:
             subj_dict["CN"] = subject.common_name
@@ -96,7 +96,7 @@ class CryptographyService:
         assert key is not None
         assert subject is not None
 
-        subj = self.subject_to_param_format(subject)
+        subj = self._subject_to_param_format(subject)
 
         with TemporaryFile("openssl.conf", config) as conf_path:
             args = ["req", "-x509", "-new", "-subj", subj,
@@ -116,7 +116,7 @@ class CryptographyService:
 
             return self._run_for_output(args, proc_input=bytes(key, encoding="utf-8")).decode()
 
-    def create_csr(self, subject, subject_key, subject_key_pass=""):
+    def _create_csr(self, subject, subject_key, subject_key_pass=""):
         """
         Creates a CSR (Certificate Signing Request)
 
@@ -126,7 +126,7 @@ class CryptographyService:
         :return: string containing the generated certificate signing request in PEM format
         """
 
-        subj_param = self.subject_to_param_format(subject)
+        subj_param = self._subject_to_param_format(subject)
 
         args = ["req", "-new", "-subj", subj_param, "-key", "-"]
 
@@ -136,7 +136,7 @@ class CryptographyService:
 
         return self._run_for_output(args, proc_input=bytes(subject_key, encoding="utf-8")).decode()
 
-    def sign_csr(self, csr, issuer_pem, issuer_key, issuer_key_pass=None, extensions="", days=30):
+    def _sign_csr(self, csr, issuer_pem, issuer_key, issuer_key_pass=None, extensions="", days=30):
         """
         Signs the given CSR by the given issuer CA
 
@@ -188,9 +188,9 @@ class CryptographyService:
         :param days: number of days for which the certificate will be valid
         :return: string containing the generated certificate in PEM format
         """
-        csr = self.create_csr(subject, subject_key, subject_key_pass=subject_key_pass)
-        return self.sign_csr(csr, issuer_pem, issuer_key, issuer_key_pass=issuer_key_pass, extensions=extensions,
-                             days=days)
+        csr = self._create_csr(subject, subject_key, subject_key_pass=subject_key_pass)
+        return self._sign_csr(csr, issuer_pem, issuer_key, issuer_key_pass=issuer_key_pass, extensions=extensions,
+                              days=days)
 
     @staticmethod
     def verify_cert(certificate):
diff --git a/proj/tests/services/cryptography/make_csr_test.py b/proj/tests/services/cryptography/make_csr_test.py
index 9e7a91b..ff1f92e 100644
--- a/proj/tests/services/cryptography/make_csr_test.py
+++ b/proj/tests/services/cryptography/make_csr_test.py
@@ -12,7 +12,7 @@ def test_make_csr(service):
     private_key = service.create_private_key()
 
     subject = Subject(common_name="foo", country="CZ")
-    csr = service.create_csr(subject, private_key)
+    csr = service._create_csr(subject, private_key)
 
     assert "Subject: CN = foo, C = CZ" in get_csr_pem(csr)
 
@@ -21,6 +21,6 @@ def test_make_csr_pkey_passphrase(service):
     private_key = service.create_private_key(passphrase="foobar")
 
     subject = Subject(common_name="foo", country="CZ", organization_unit="Mysterious Unit")
-    csr = service.create_csr(subject, private_key, subject_key_pass="foobar")
+    csr = service._create_csr(subject, private_key, subject_key_pass="foobar")
 
     assert "Subject: CN = foo, C = CZ, OU = Mysterious Unit" in get_csr_pem(csr)
diff --git a/proj/tests/services/cryptography/sign_csr_test.py b/proj/tests/services/cryptography/sign_csr_test.py
index 255fee4..d16006d 100644
--- a/proj/tests/services/cryptography/sign_csr_test.py
+++ b/proj/tests/services/cryptography/sign_csr_test.py
@@ -18,10 +18,10 @@ def test_sign_csr(service):
 
     # create a private key to be used to make a CSR for the intermediate CA
     inter_key = service.create_private_key()
-    csr = service.create_csr(Subject(common_name="bar", country="CZ"), inter_key)
+    csr = service._create_csr(Subject(common_name="bar", country="CZ"), inter_key)
 
     # sign the created CSR with root CA
-    inter_ca = service.sign_csr(csr, root_ca, root_key)
+    inter_ca = service._sign_csr(csr, root_ca, root_key)
 
     inter_ca_printed = export_crt(inter_ca)
 
@@ -38,10 +38,10 @@ def test_sign_csr_passphrase(service):
 
     # create a private key to be used to make a CSR for the intermediate CA
     inter_key = service.create_private_key()
-    csr = service.create_csr(Subject(common_name="bar", country="CZ"), inter_key)
+    csr = service._create_csr(Subject(common_name="bar", country="CZ"), inter_key)
 
     # sign the created CSR with root CA and specify root key passphrase
-    inter_ca = service.sign_csr(csr, root_ca, root_key, issuer_key_pass=root_key_passphrase)
+    inter_ca = service._sign_csr(csr, root_ca, root_key, issuer_key_pass=root_key_passphrase)
 
     inter_ca_printed = export_crt(inter_ca)
 
@@ -51,14 +51,14 @@ def test_sign_csr_passphrase(service):
 
     # try to sign it using a wrong passphrase
     with pytest.raises(CryptographyException) as e:
-        service.sign_csr(csr, root_ca, root_key,
-                         extensions="authorityInfoAccess = caIssuers;URI:bar.cz/baz.cert", issuer_key_pass="bazbaz")
+        service._sign_csr(csr, root_ca, root_key,
+                          extensions="authorityInfoAccess = caIssuers;URI:bar.cz/baz.cert", issuer_key_pass="bazbaz")
     assert "bad decrypt" in e.value.message
 
     # try to sign it without specifying a passphrase
     with pytest.raises(CryptographyException) as e:
-        service.sign_csr(csr, root_ca, root_key,
-                         extensions="authorityInfoAccess = caIssuers;URI:bar.cz/baz.cert")
+        service._sign_csr(csr, root_ca, root_key,
+                          extensions="authorityInfoAccess = caIssuers;URI:bar.cz/baz.cert")
     assert "bad decrypt" in e.value.message
 
 
@@ -70,12 +70,12 @@ def test_sign_csr_extensions(service):
 
     # create a private key to be used to make a CSR for the intermediate CA
     inter_key = service.create_private_key()
-    csr = service.create_csr(Subject(common_name="bar", country="CZ"), inter_key)
+    csr = service._create_csr(Subject(common_name="bar", country="CZ"), inter_key)
 
     # sign the created CSR with root CA and specify root key passphrase and specify extensions (AIA and CA)
-    inter_ca = service.sign_csr(csr, root_ca, root_key,
-                                extensions="authorityInfoAccess = caIssuers;URI:bar.cz/baz/cert\nbasicConstraints=critical,CA:TRUE",
-                                issuer_key_pass=root_key_passphrase)
+    inter_ca = service._sign_csr(csr, root_ca, root_key,
+                                 extensions="authorityInfoAccess = caIssuers;URI:bar.cz/baz/cert\nbasicConstraints=critical,CA:TRUE",
+                                 issuer_key_pass=root_key_passphrase)
 
     inter_ca_printed = export_crt(inter_ca)
 
diff --git a/proj/tests/services/cryptography/verify_ca_test.py b/proj/tests/services/cryptography/verify_ca_test.py
index 9678500..4b3edc3 100644
--- a/proj/tests/services/cryptography/verify_ca_test.py
+++ b/proj/tests/services/cryptography/verify_ca_test.py
@@ -10,8 +10,8 @@ def test_verify_valid_ca(service):
     root_cert = service.create_sscrt(private_key, Subject(common_name="foo"))
     child_cert = service.create_crt(Subject(common_name="Expired Foo"), private_key, root_cert, private_key, days=1)
 
-    assert service.verify_ca(root_cert, private_key)
-    assert service.verify_ca(child_cert, private_key)
+    assert service.verify_cert(root_cert)
+    assert service.verify_cert(child_cert)
 
 
 def test_verify_invalid_ca(service):
@@ -21,7 +21,7 @@ def test_verify_invalid_ca(service):
 
     expired_cert = service.create_crt(Subject(common_name="Expired Foo"), private_key, root_cert, private_key, days=0)
 
-    assert not service.verify_ca(expired_cert, private_key)
+    assert not service.verify_cert(expired_cert)
 
 
 def test_verify_invalid_cert_format(service):
@@ -29,4 +29,4 @@ def test_verify_invalid_cert_format(service):
     private_key = service.create_private_key()
 
     with pytest.raises(CryptographyException):
-        service.verify_ca("invalid cert", private_key)
+        service.verify_cert("invalid cert")
