Revize fe647b46

Re #8472 - Added sign_csr method that signs a CSR

Added 3 unit tests testing the added method.

proj/services/cryptography.py

@@ -49 +49 @@
             args.insert(0, executable)
 
             # create a new process
-            proc = subprocess.Popen(args, stdin=subprocess.PIPE if proc_input is not None else None, stdout=subprocess.PIPE,
+            proc = subprocess.Popen(args, stdin=subprocess.PIPE if proc_input is not None else None,
+                                    stdout=subprocess.PIPE,
                                     stderr=subprocess.PIPE)
 
             out, err = proc.communicate(proc_input)
@@ -108 +109 @@
             # it would be best to not send the pass phrase at all, but for some reason pytest then prompts for
             # the pass phrase (this does not happen when run from pycharm)
 
-            # if key_passphrase is not None:
+            #  add the passphrase even when None is passed. Otherwise when running tests with pytest some tests freeze
+            # waiting for the passphrase to be typed in
             args.extend(["-passin", f"pass:{key_passphrase}"])
 
             return self._run_for_output(args, proc_input=bytes(key, encoding="utf-8")).decode()
 
-    def make_csr(self, subject, subject_key, subject_key_pass=None):
+    def make_csr(self, subject, subject_key, subject_key_pass=""):
         """
         Makes a CSR (Certificate Signing Request)
 
@@ -127 +129 @@
 
         args = ["req", "-new", "-subj", subj_param, "-key", "-"]
 
-        if subject_key_pass is not None:
-            args.extend(["-passin", f"pass:{subject_key_pass}"])
+        # add the passphrase even when None is passed. Otherwise when running tests with pytest some tests freeze
+        # waiting for the passphrase to be typed in
+        args.extend(["-passin", f"pass:{subject_key_pass}"])
 
         return self._run_for_output(args, proc_input=bytes(subject_key, encoding="utf-8")).decode()
 
+    def sign_csr(self, csr, issuer_pem, issuer_key, issuer_key_pass=None, config="", extensions=""):
+        """
+        Signs the given CSR by the given issuer CA
+        :param csr: a string containing the CSR to be signed
+        :param issuer_pem: string containing the certificate of the issuer that will sign this CSR in PEM format
+        :param issuer_key: string containing the private key of the issuer's certificate in PEM format
+        :param issuer_key_pass: string containing the private key of the issuer's certificate in PEM format
+        :param config: TODO NOT USED
+        :param extensions: extensions to be applied when signing the CSR
+        :return: string containing the generated and signed certificate in PEM format
+        """
+
+        # concatenate CSR, issuer certificate and issuer's key (will be used in the openssl call)
+        proc_input = csr + issuer_pem + issuer_key
+
+        # prepare openssl parameters...
+        # CSR, CA and CA's private key will be passed via stdin (that's the meaning of the '-' symbol)
+        params = ["x509", "-req", "-in", "-", "-CA", "-", "-CAkey", "-", "-CAcreateserial"]
+
+        # TODO delete created -.srl file
+
+        with TemporaryFile("extensions.conf", extensions) as ext_path:
+            # add the passphrase even when None is passed. Otherwise when running tests with pytest some tests freeze
+            # waiting for the passphrase to be typed in
+            params.extend(["-passin", f"pass:{issuer_key_pass}"])
+
+            if len(extensions) > 0:
+                params.extend(["-extfile", ext_path])
+
+            return self._run_for_output(params, proc_input=(bytes(proc_input, encoding="utf-8"))).decode()
+
 
 class CryptographyException(Exception):