pyca-20031118/ 0040755 0000764 0000144 00000000000 07756443113 012252 5 ustar michael users pyca-20031118/bin/ 0040755 0000764 0000144 00000000000 07756443113 013022 5 ustar michael users pyca-20031118/bin/certs2ldap.py 0100755 0000764 0000144 00000034075 07475754042 015454 0 ustar michael users #!/usr/bin/python
"""
certs2ldap.py - Upload all EE certificates on LDAP server
(c) by Michael Stroeder, michael@stroeder.com
"""
__version__ = '0.6.6'
import sys, string, os, getopt
ldap_attrtype = {
'ST':'st',
'Email':'mail',
'emailAddress':'mail',
'E':'mail',
'L':'l',
'O':'o',
'OU':'ou',
'CN':'cn',
}
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
--config=[pathname]
Pathname of OpenSSL configuration file.
You may also use env variable OPENSSL_CONF.
Default: /etc/openssl/openssl.cnf
--pycalib=[directory]
Specify directory containing the pyCA modules
You may also use env variable PYCALIB.
Default: /usr/local/pyca/pylib
--host=[LDAP host]
Specify an alternate host:port on which the ldap server
is running.
Default: localhost:389
--basedn=[searchbase]
Use searchbase as the starting point for the search
instead of the default.
Default: emtpy string
--binddn=[binddn]
Use binddn to bind to the LDAP directory.
Default: cn=root[,searchbase]
--bindpasswd=[password]
Use password to bind to the LDAP directory. For security
reasons it is better to set this with the env variable
LDAP_PASSWD if you really have to provide the password
in a non-interactive script.
Default: emtpy string
--filtertemplate=[Python dict string]
A Python string used as template for searching the
LDAP entries of certificate owners.
E.g. (&(cn=%%(CN)s)(mail=%%(Email)s))
Default: (mail=%%(Email)s)
--certdnfilter=[regex]
Specify a filter as comma separated list of regular expressions
for DNs of the certificates which should be sent to the LDAP host.
E.g. C=DE,CN=.*,Email=.*@domain.my
Default: Email=.*
--objectclasses=[objectClass]
Add objectclass: [objectClass] to the entry. Might be
a comma-separated list for specifying multiple object classes.
--replace
Replace existing userCertificate;binary attributes
--create
Create LDAP entries if no entry for a user certificate
was found.
--dntemplate=[Python dict string]
A Python string used as template for the distinguished
name of LDAP entries to be created.
E.g. cn=%%(CN)s+mail=%%(Email)s,ou=Testing,dc=stroeder,dc=com
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
script_name=sys.argv[0]
try:
options,args=getopt.getopt(
sys.argv[1:],'h',
[
'help',
'config=',
'pycalib=',
'host=',
'basedn=',
'binddn=',
'bindpasswd=',
'filtertemplate=',
'certdnfilter=',
'objectclasses=',
'replace',
'create',
'dntemplate='
]
)
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage()
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
PrintUsage('Config file %s not found.' % (opensslcnfname))
sys.exit(1)
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
PrintUsage('Directory %s with pyCA modules not found!' % (pycalib))
sys.path.append(pycalib)
try:
import ldap
except ImportError:
PrintUsage('python-ldap module not found.' % (pycalib))
sys.exit(1)
try:
import openssl,charset
except ImportError:
PrintUsage('pyCA modules not found in directory %s.' % (pycalib))
sys.exit(1)
# Read the configuration file
if os.path.isfile('%s.pickle' % (opensslcnfname)):
# Try to read OpenSSL's config file from a pickled copy
f=open('%s.pickle' % (opensslcnfname),'rb')
try:
# first try to use the faster cPickle module
from cPickle import load
except ImportError:
from pickle import load
opensslcnf=load(f)
f.close()
else:
# Parse OpenSSL's config file from source
opensslcnf=openssl.cnf.OpenSSLConfigClass(opensslcnfname)
delete_reason = {openssl.db.DB_TYPE_EXP:'expired',openssl.db.DB_TYPE_REV:'revoked'}
pyca_section = opensslcnf.data.get('pyca',{})
openssl.bin_filename = pyca_section.get('OpenSSLExec','/usr/local/ssl/bin/openssl')
if not os.path.isfile(openssl.bin_filename):
sys.stderr.write('Did not find OpenSSL executable %s.\n' % (openssl.bin_filename))
sys.exit(1)
if findoption(options,'--host')!=():
ldap_host = findoption(options,'--host')[1]
else:
ldap_host = 'localhost:389'
if findoption(options,'--basedn')!=():
basedn = findoption(options,'--basedn')[1]
else:
basedn = ''
if findoption(options,'--binddn')!=():
binddn = findoption(options,'--binddn')[1]
else:
if basedn:
binddn = 'cn=root,%s' % basedn
else:
binddn = 'cn=root'
if findoption(options,'--bindpasswd')!=():
bindpasswd = findoption(options,'--bindpasswd')[1]
else:
if os.environ.has_key('LDAP_PASSWD'):
bindpasswd = os.environ.get['LDAP_PASSWD']
else:
from getpass import getpass
sys.stdout.write('Enter password for bind DN "%s".\n' % (binddn))
bindpasswd = getpass()
if findoption(options,'--filtertemplate')!=():
filtertemplate = findoption(options,'--filtertemplate')[1]
else:
filtertemplate = r'(mail=%(Email)s)'
if findoption(options,'--objectclasses')!=():
objectclasses = map(
string.strip,
map(
None,string.split(findoption(options,'--objectclasses')[1],',')
)
)
else:
objectclasses = None
replace = findoption(options,'--replace')!=()
if findoption(options,'--certdnfilter')!=():
certdnfilterlist = string.split(findoption(options,'--certdnfilter')[1],',')
certdnfilter = {}
for i in certdnfilterlist:
attr,filter = string.split(i,'=',1)
if filter:
certdnfilter[attr]=filter
else:
certdnfilter = {'Email':'.*'}
create = findoption(options,'--create')!=()
if findoption(options,'--dntemplate')!=():
dntemplate = findoption(options,'--dntemplate')[1]
else:
dntemplate = r'mail=%(Email)s,'+basedn
print repr(dntemplate)
# FIX ME!!!
# This should be surrounded by a nice try: except: clause
# which catches specific exceptions and outputs
# nicer error messages.
l = ldap.open(ldap_host)
l.bind_s(binddn,bindpasswd,ldap.AUTH_SIMPLE)
ca_names = opensslcnf.sectionkeys.get('ca',[])
old_db_filenames = []
for ca_name in ca_names:
sys.stdout.write('*** Processing %s ***\n\n' % (ca_name))
ca = opensslcnf.getcadata(ca_name)
# Ist der Zertifikattyp 'S/MIME for client use' ?
if ca.isclientcert() and \
not ca.database in old_db_filenames and \
os.path.isfile(ca.database):
old_db_filenames.append(ca.database)
# Anfrage starten
certs_found = openssl.db.GetEntriesbyDN(ca.database,certdnfilter,casesensitive=1,onlyvalid=0)
for cert_entry in certs_found:
certdn = charset.asn12iso(cert_entry[openssl.db.DB_name])
certdndict = openssl.db.SplitDN(charset.iso2utf(certdn))
ldap_filter = filtertemplate % certdndict
try:
ldap_result = l.search_s(
basedn,
ldap.SCOPE_SUBTREE,
ldap_filter,
['objectclass','userCertificate;binary','userSMIMECertificate;binary'],
0
)
except ldap.NO_SUCH_OBJECT:
sys.stdout.write('Certificate subject "%s" not found with filter "%s".\n' % (certdn,ldap_filter))
ldap_result=[]
except:
exc_obj,exc_value,exc_traceback = sys.exc_info()
sys.stderr.write('Unexpected error during searching with filter "%s":\n%s\n' % (ldap_filter,exc_value))
sys.exit(1)
if ldap_result:
# Read certificate data
certfilename = os.path.join(ca.certs,'%s.pem' % (cert_entry[openssl.db.DB_serial]))
cert = openssl.cert.X509CertificateClass(certfilename)
local_cert = cert.readcertfile('der')
for entry in ldap_result:
ldap_dn = entry[0]
old_objectclasses = {}
for oc in entry[1].get('objectClass',entry[1].get('objectclass',[])):
old_objectclasses[string.lower(oc)] = None
existing_usercert_attrtype = None
for a in [
'userCertificate;binary','userCertificate',
'usercertificate;binary','usercertificate',
]:
if entry[1].has_key(a):
existing_usercert_attrtype = a
break
old_usercertificate_attr = {}
if existing_usercert_attrtype!=None:
for ldap_cert in entry[1][existing_usercert_attrtype]:
old_usercertificate_attr[ldap_cert] = None
ldap_modlist = []
if cert_entry[openssl.db.DB_type]==openssl.db.DB_TYPE_VAL:
if existing_usercert_attrtype is None:
# Add new certificate attribute
ldap_modlist.append((ldap.MOD_ADD,'userCertificate;binary',[local_cert]))
sys.stdout.write('Adding new certificate attribute usercertificate;binary with certificate serial %s of LDAP entry "%s".\n' % (cert_entry[openssl.db.DB_serial],charset.utf2iso(ldap_dn)))
elif replace:
# Replace existing certificate attribute
ldap_modlist.append((ldap.MOD_DELETE,existing_usercert_attrtype,None))
ldap_modlist.append((ldap.MOD_ADD,existing_usercert_attrtype,[local_cert]))
sys.stdout.write('Replacing attribute %s of entry %s with certificate serial %s.\n' % (
existing_usercert_attrtype,
charset.utf2iso(ldap_dn),
cert_entry[openssl.db.DB_serial]
)
)
elif not old_usercertificate_attr.has_key(local_cert):
# Add new certificate attribute value
ldap_modlist.append((ldap.MOD_DELETE,existing_usercert_attrtype,None))
ldap_modlist.append((ldap.MOD_ADD,existing_usercert_attrtype,old_usercertificate_attr.keys()+[local_cert]))
sys.stdout.write(
'Adding certificate with certificate serial %s to existing attribute %s of LDAP entry "%s".\n' % (
cert_entry[openssl.db.DB_serial],
existing_usercert_attrtype,
charset.utf2iso(ldap_dn)
)
)
else:
sys.stdout.write('Leaving attribute %s of entry %s untouched.\n' % (
existing_usercert_attrtype,
charset.utf2iso(ldap_dn)
)
)
if ldap_modlist and objectclasses:
# New object classes were specified at command-line
# => add to modify list if necessary
new_objectclasses = []
for oc in objectclasses:
if not old_objectclasses.has_key(string.lower(oc)):
new_objectclasses.append(oc)
if new_objectclasses:
ldap_modlist.append((ldap.MOD_ADD,'objectClass',new_objectclasses))
elif (cert_entry[openssl.db.DB_type]==openssl.db.DB_TYPE_EXP) or \
(cert_entry[openssl.db.DB_type]==openssl.db.DB_TYPE_REV):
sys.stdout.write('Certificate (serial %s) %s.\n' % (cert_entry[openssl.db.DB_serial],delete_reason[cert_entry[openssl.db.DB_type]]))
if old_usercertificate_attr.has_key(local_cert):
del old_usercertificate_attr[local_cert]
sys.stdout.write('Deleting certificate with certificate serial %s from attribute usercertificate;binary of LDAP entry "%s".\n' % (cert_entry[openssl.db.DB_serial],charset.utf2iso(ldap_dn)))
ldap_modlist.append((ldap.MOD_REPLACE,existing_usercert_attrtype,old_usercertificate_attr.keys()))
if ldap_modlist and objectclasses:
new_objectclasses = []
for oc in objectclasses:
if old_objectclasses.has_key(string.lower(oc)):
new_objectclasses.append(oc)
if new_objectclasses:
ldap_modlist.append((ldap.MOD_DELETE,'objectClass',new_objectclasses))
# Do modifications on directory if modlist is not empty
if ldap_modlist:
try:
l.modify_s(ldap_dn,ldap_modlist)
except ldap.NO_SUCH_OBJECT:
sys.stderr.write('No such object "%s": Probably a parent entry is missing.\n' % (
charset.utf2iso(ldap_dn)
)
)
except ldap.INSUFFICIENT_ACCESS,e:
sys.stderr.write('You are not allowed to modify entry "%s": %s.\n' % (
charset.utf2iso(ldap_dn),str(e)
)
)
except ldap.LDAPError,e:
sys.stderr.write('LDAPError: %s.\n' % str(e))
else:
if cert_entry[openssl.db.DB_type]==openssl.db.DB_TYPE_VAL:
if create:
# Read certificate data
certfilename = os.path.join(ca.certs,'%s.pem' % (cert_entry[openssl.db.DB_serial]))
cert = openssl.cert.X509CertificateClass(certfilename)
local_cert = cert.readcertfile('der')
ldap_dn = dntemplate % certdndict
ldap_modlist = [
('objectClass',['person','organizationalPerson','inetOrgPerson']),
('userCertificate;binary',[local_cert]),
('sn',['-'])
]
for k in certdndict.keys():
try:
ldap_modlist.append((ldap_attrtype[k],certdndict[k]))
except KeyError:
pass
try:
# print ldap_modlist
l.add_s(ldap_dn,ldap_modlist)
except ldap.NO_SUCH_OBJECT:
sys.stderr.write('No such object "%s": Probably a parent entry is missing.\n' % (
charset.utf2iso(ldap_dn)
)
)
except ldap.INSUFFICIENT_ACCESS,e:
sys.stderr.write('You are not allowed to add entry "%s": %s.\n' % (
charset.utf2iso(ldap_dn),str(e)
)
)
except ldap.LDAPError,e:
sys.stderr.write('LDAPError: %s.\n' % str(e))
else:
sys.stdout.write('Added new entry "%s" for certificate serial %s.\n' % (charset.utf2iso(ldap_dn),cert_entry[openssl.db.DB_serial]))
else:
sys.stderr.write('No entry found with filter "%s" for %s.\n' % (ldap_filter,certdn))
l.unbind_s()
pyca-20031118/bin/ca2ldif.py 0100755 0000764 0000144 00000011714 07434757702 014711 0 ustar michael users #!/usr/bin/python
########################################################################
# ca2ldif.py
# (c) by Michael Stroeder, michael@stroeder.com
########################################################################
__version__ = '0.6.6'
########################################################################
# This simple script generates a LDIF file containing all CA certs
# and CRLs.
########################################################################
import sys, string, os, getopt, types, shutil
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
--config=[pathname]
Pathname of OpenSSL configuration file.
Default: /etc/openssl/openssl.cnf
--pycalib=[directory]
Specify directory containing the pyCA modules
Default: /usr/local/pyca/pylib
--out=[pathname]
Pathname of LDIF file for output
Default: stdout
--dntemplate=[Python dict string]
A Python string used as template for building LDAP
Distinguished Names E.g. cn=%%(CN)s,ou=TestCA,o=My company,c=DE
Default: cn=%%(CN)s
--crl
Add CRLs to entries.
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
script_name=sys.argv[0]
try:
options,args=getopt.getopt(sys.argv[1:],'h',['help','config=','pycalib=','out=','dntemplate=','crl'])
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage(script_name)
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
PrintUsage('Config file %s not found.' % (opensslcnfname))
sys.exit(1)
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
PrintUsage('Module directory %s does not exist or is no directory.' % (pycalib))
sys.exit(1)
sys.path.append(pycalib)
try:
import openssl, charset, ldif, ldapbase
except ImportError:
PrintUsage('Required pyCA modules not found in directory %s!' % (pycalib))
# Read the configuration file
if os.path.isfile('%s.pickle' % (opensslcnfname)):
# Try to read OpenSSL's config file from a pickled copy
f=open('%s.pickle' % (opensslcnfname),'rb')
try:
# first try to use the faster cPickle module
from cPickle import load
except ImportError:
from pickle import load
opensslcnf=load(f)
f.close()
else:
# Parse OpenSSL's config file from source
opensslcnf=openssl.cnf.OpenSSLConfigClass(opensslcnfname)
create_crls = findoption(options,'--crl')!=()
pyca_section = opensslcnf.data.get('pyca',{})
openssl.bin_filename = pyca_section.get('OpenSSLExec','/usr/local/ssl/bin/openssl')
if not os.path.isfile(openssl.bin_filename):
sys.stderr.write('Did not find OpenSSL executable %s.\n' % (openssl.bin_filename))
sys.exit(1)
if findoption(options,'--out')!=():
ldiffile = open(findoption(options,'--out')[1],'w')
else:
ldiffile = sys.stdout
if findoption(options,'--dntemplate')!=():
dntemplate = findoption(options,'--dntemplate')[1]
else:
dntemplate = r'cn=%(CN)s'
ca_names = opensslcnf.sectionkeys.get('ca',[])
ca_dn_dict = {}
for ca_name in ca_names:
ca = opensslcnf.getcadata(ca_name)
if os.path.isfile(ca.certificate):
cacert = openssl.cert.X509CertificateClass(ca.certificate)
ca_dn = charset.iso2utf(charset.t612iso(dntemplate % (cacert.subject)))
if ca_dn_dict.has_key(ca_dn):
sys.stderr.write('Warning: DN of %s conflicts with %s.\n' % (ca_name,ca_dn_dict[ca_dn]))
else:
ca_dn_dict[ca_dn]=ca_name
if ldapbase.dn_regex.match(ca_dn):
ca_entry = {'objectclass':['top','certificationAuthority']}
ca_entry['cACertificate;binary'] = [cacert.readcertfile('der')]
if create_crls:
if os.path.isfile(ca.crl):
cacrl = openssl.cert.CRLClass(ca.crl)
ca_entry['certificateRevocationList;binary'] = [cacrl.readcertfile('der')]
ca_entry['authorityRevocationList;binary'] = [cacrl.readcertfile('der')]
else:
sys.stderr.write('Warning: CRL file %s not found.\n' % (ca.crl))
certificateRevocationList_binary=''
ldiffile.write(ldif.CreateLDIF(ca_dn,ca_entry,['cACertificate;binary','certificateRevocationList;binary']))
ldiffile.write('\n')
else:
sys.stderr.write('Warning: DN "%s" is not a valid DN.\nCheck parameter --dntemplate="%s".\n' % (ca_dn,dntemplate))
cACertificate_binary=''
else:
sys.stderr.write('Warning: CA certificate file %s not found.\n' % (ca.certificate))
cACertificate_binary=''
ldiffile.close()
pyca-20031118/bin/print-cacerts.py 0100755 0000764 0000144 00000011707 07321127433 016150 0 ustar michael users #!/usr/bin/python
########################################################################
# print-ca-certs.py
# (c) by Michael Stroeder, michael@stroeder.com
########################################################################
__version__ = '0.6.6'
########################################################################
# This simple script prints all CA certs on stdout.
# This is intended to generate a authentic printout of the fingerprints
# on the private CA system.
# Choose the option --html to generate nicer formatted HTML-output
# instead of the default textual output in ISO-8859-1.
########################################################################
import sys, string, os, getopt
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
--config=[pathname]
Pathname of OpenSSL configuration file.
You may also use env variable OPENSSL_CONF.
Default: /etc/openssl/openssl.cnf
--pycalib=[directory]
Specify directory containing the pyCA modules
Default: /usr/local/pyca/pylib
--html
Generate nicer formatted HTML output
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
script_name=sys.argv[0]
try:
options,args=getopt.getopt(sys.argv[1:],'h',['help','config=','pycalib=','html'])
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage()
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
PrintUsage('Config file %s not found.' % (opensslcnfname))
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
PrintUsage('Module directory %s not exists or not a directory.' % (pycalib))
sys.path.append(pycalib)
try:
import openssl, charset, htmlbase
except ImportError:
PrintUsage('Required pyCA modules not found in directory %s!' % (pycalib))
# Read the configuration file
if os.path.isfile('%s.pickle' % (opensslcnfname)):
# Try to read OpenSSL's config file from a pickled copy
f=open('%s.pickle' % (opensslcnfname),'rb')
try:
# first try to use the faster cPickle module
from cPickle import load
except ImportError:
from pickle import load
opensslcnf=load(f)
f.close()
else:
# Parse OpenSSL's config file from source
opensslcnf=openssl.cnf.OpenSSLConfigClass(opensslcnfname)
pyca_section = opensslcnf.data.get('pyca',{})
openssl.bin_filename = pyca_section.get('OpenSSLExec','/usr/local/ssl/bin/openssl')
if not os.path.isfile(openssl.bin_filename):
PrintUsage('Did not find OpenSSL executable %s.' % (openssl.bin_filename))
ca_names = opensslcnf.sectionkeys.get('ca',[])
htmlmode = findoption(options,'--html')!=()
if htmlmode:
#HTML mode
sys.stdout.write('\n\nCA certs\n\n\n
\n')
for ca_name in ca_names:
ca = opensslcnf.getcadata(ca_name)
if os.path.isfile(ca.certificate):
# Parse certificate textual output
cacert = openssl.cert.X509CertificateClass(ca.certificate)
sys.stdout.write('
\n\n\n')
else:
# Text mode
for ca_name in ca_names:
ca = opensslcnf.getcadata(ca_name)
if os.path.isfile(ca.certificate):
# Parse certificate textual output
cacert = openssl.cert.X509CertificateClass(ca.certificate)
# Convert character sets
subject,issuer = {},{}
for attr in ['CN','Email','OU','O','L','ST','C']:
subject[attr] = string.strip(charset.asn12iso(cacert.subject.get(attr,'')))
issuer[attr] = string.strip(charset.asn12iso(cacert.issuer.get(attr,'')))
sys.stdout.write('Subject:\nCommon Name: "%(CN)s"\nOrganizational Unit: "%(OU)s"\nOrganization: "%(O)s"\nLocation: "%(L)s"\nState/Province: "%(ST)s"\nCountry: "%(C)s"\n\n' % (subject))
sys.stdout.write('Issuer:\nCommon Name: "%(CN)s"\nOrganizational Unit: "%(OU)s"\nOrganization: "%(O)s"\nLocation: "%(L)s"\nState/Province: "%(ST)s"\nCountry: "%(C)s"\n\n' % (issuer))
sys.stdout.write('Serial: %s\n' % (cacert.serial))
sys.stdout.write('Validity: from %s until %s\n' % (cacert.notBefore,cacert.notAfter))
sys.stdout.write('Hash: %s\n' % (cacert.hash))
sys.stdout.write('SHA-1 Fingerprint: %s\n' % (cacert.getfingerprint('sha1')))
sys.stdout.write('MD5 Fingerprint: %s\n' % (cacert.getfingerprint('md5')))
sys.stdout.write('\n%s\n\n' % (72*'-'))
pyca-20031118/bin/ldap2certs.py 0100755 0000764 0000144 00000020125 07301173255 015430 0 ustar michael users #!/usr/bin/python
########################################################################
# ldap2certs.py
# (c) by Michael Stroeder, michael@stroeder.com
# This simple script retrieves client certs from a LDAP repository
# and stores the fingerprint in a text mapping file for use with
# Postfix/TLS (see option relay_clientcert) and
########################################################################
__version__ = '0.6.6'
import sys, string, os, getopt
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
-v or --verbose
Print debugging output to stdout
--pylib=[directory]
Specify directory containing the additonal Python modules.
Default:
--host=[LDAP host]
Specify an alternate host:port on which the ldap server
is running.
Default: localhost:389
--basedn=[searchbase]
Use searchbase as the starting point for the search
instead of the default.
Default: emtpy string
--binddn=[binddn]
Use binddn to bind to the LDAP directory.
Default: cn=root[,searchbase]
--bindpasswd=[password]
Use password to bind to the LDAP directory. For security
reasons it is better to set this with the env variable
LDAP_PASSWD if you really have to provide the password
in a non-interactive script.
Default: emtpy string
--searchfilter=[Python dict string]
LDAP search filter for finding entries with
certificate data.
Default: (usercertificate;binary=*)
--certdnfilter=[regex]
Specify a filter as comma separated list of regular expressions
for DNs of the certificates which should be sent to the LDAP host.
E.g. C=DE,CN=.*,Email=.*@domain.my
Default: Email=.*
--outdir=[directory name]
Directory where to store the client cert files
and symbolic links ([hash value].0).
If not defined no client cert files are written.
--rcc_filename=[path name]
Path name of lookup table file.
(parameter relay_clientcerts in main.cf of Postfix/TLS)
If not defined the table is not written.
--rcc_delimiter=(:|_)
Character used as delimiter for fingerprint string
Default: ":"
--replace
Replace existing files (append or add otherwise)
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
script_name=sys.argv[0]
try:
options,args=getopt.getopt(
sys.argv[1:],'vh',
[
'help',
'verbose',
'pylib=',
'host=',
'basedn=',
'binddn=',
'bindpasswd=',
'searchfilter=',
'outdir=',
'rcc_filename=',
'rcc_delimiter=',
'replace'
]
)
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage()
if findoption(options,'-v')!=() or findoption(options,'--verbose')!=():
pass
else:
sys.stdout.close()
sys.stdout = open('/dev/null','w')
if findoption(options,'--pylib')!=():
pylib = findoption(options,'--pylib')[1]
if not os.path.exists(pylib) or not os.path.isdir(pylib):
PrintUsage('Modules directory %s not found or is not a directory!' % (pylib))
sys.path.append(pylib)
import charset,ldap,certhelper
if findoption(options,'--host')!=():
ldap_host = findoption(options,'--host')[1]
else:
ldap_host = 'localhost:389'
if findoption(options,'--basedn')!=():
basedn = findoption(options,'--basedn')[1]
else:
basedn = ''
if findoption(options,'--binddn')!=():
binddn = findoption(options,'--binddn')[1]
else:
if basedn:
binddn = 'cn=root,%s' % basedn
else:
binddn = 'cn=root'
if findoption(options,'--bindpasswd')!=():
bindpasswd = findoption(options,'--bindpasswd')[1]
else:
if os.environ.has_key('LDAP_PASSWD'):
bindpasswd = os.environ.get['LDAP_PASSWD']
else:
from getpass import getpass
bindpasswd = getpass()
if findoption(options,'--searchfilter')!=():
searchfilter = charset.iso2utf(findoption(options,'--searchfilter')[1])
else:
searchfilter = '(usercertificate;binary=*)'
if findoption(options,'--replace')!=():
replace = 1
else:
replace = 0
sys.stderr.write('replace=%s\n' % replace)
rcc_filemode = {0:'a',1:'w'}
cert_filemode = {0:'w',1:'w'}
if findoption(options,'--rcc_filename')!=():
rcc_filename = findoption(options,'--rcc_filename')[1]
sys.stdout.write('rcc_filename=%s\n' % rcc_filename)
rcc_file = open(rcc_filename,rcc_filemode[replace])
else:
rcc_filename = None
if findoption(options,'--rcc_delimiter')!=():
rcc_delimiter = findoption(options,'--rcc_delimiter')[1]
else:
rcc_delimiter = ':'
sys.stdout.write('rcc_delimiter=%s\n' % rcc_delimiter)
if findoption(options,'--outdir')!=():
outdir = findoption(options,'--outdir')[1]
if not os.path.exists(outdir) or not os.path.isdir(outdir):
PrintUsage('Directory %s not found or is not a directory!' % (outdir))
else:
outdir = None
try:
l = ldap.open(ldap_host)
except:
exc_obj,exc_value,exc_traceback = sys.exc_info()
sys.stderr.write('Error %d connecting to %s: %s\n' % (exc_value[0],ldap_host,exc_value[1]))
sys.exit(1)
try:
l.bind_s(binddn,bindpasswd,ldap.AUTH_SIMPLE)
except:
exc_obj,exc_value,exc_traceback = sys.exc_info()
sys.stderr.write('Unable to bind as "%s" to "%s":\n%s\n' % (binddn,ldap_host,exc_value))
sys.exit(1)
try:
ldap_msgid = l.search(
basedn,
ldap.SCOPE_SUBTREE,
searchfilter,
['cn','mail','usercertificate','usersmimecertificate','usercertificate;binary','usersmimecertificate;binary'],
0
)
except ldap.NO_SUCH_OBJECT:
result_dnlist = []
except ldap.FILTER_ERROR:
sys.stderr.write('Bad search filter %s.\n' % charset.utf2iso(searchfilter))
sys.exit(1)
except ldap.SIZELIMIT_EXCEEDED:
sys.stderr.write('Sizelimit exceeded. Please refine search.\n')
sys.exit(1)
except ldap.NO_SUCH_OBJECT:
sys.stderr.write('No search results with filter %s.\n' % charset.utf2iso(searchfilter))
sys.exit(1)
except ldap.error:
exc_obj,exc_value,exc_traceback = sys.exc_info()
sys.stderr.write('LDAP exception %(desc)s: %(info)s.\n' % exc_value)
sys.exit(1)
#except:
# exc_obj,exc_value,exc_traceback = sys.exc_info()
# sys.stderr.write('Unhandled exception: %s.\n' % exc_value)
# sys.exit(1)
result_type,result_data = l.result(ldap_msgid,0)
if not result_type in ['RES_SEARCH_ENTRY','RES_SEARCH_RESULT']:
l.abandon(ldap_msgid)
sys.stderr.write('Wrong result type: "%s"' % (result_type))
sys.exit(1)
# Retrieve the search results
while result_data:
# Process found entries
for dn,data in result_data:
sys.stdout.write('Processing entry "%s".\n' % (charset.utf2iso(dn)))
if data.has_key('usercertificate'):
pass
elif data.has_key('usersmimecertificate'):
pass
elif data.has_key('usercertificate;binary'):
sys.stdout.write('%d DER-encoded certificate(s) found.\n' % (len(data['usercertificate;binary'])))
# Process all certificates in attribute
for cert_der in data['usercertificate;binary']:
cert_md5fingerprint = certhelper.MD5Fingerprint(cert_der,':')
if rcc_filename:
# append fingerprint to rcc_filename
rcc_name = data.get('mail',data.get('cn',[dn]))[0]
rcc_file.write('%s %s\n' % (string.replace(cert_md5fingerprint,':',rcc_delimiter),rcc_name))
if outdir:
cert_pem = certhelper.der2pem(cert_der)
cert_pem_filename = os.path.join(outdir,'%s.pem' % string.replace(cert_md5fingerprint,':','_'))
if replace or not os.path.isfile(cert_pem_filename):
cert_pem_file = open(cert_pem_filename,cert_filemode[replace])
cert_pem_file.write(cert_pem)
cert_pem_file.close()
sys.stdout.write('Certificate file %s written.\n' % (cert_pem_filename))
else:
sys.stdout.write('Certificate file %s already exists.\n' % (cert_pem_filename))
elif data.has_key('usersmimecertificate;binary'):
pass
else:
sys.stdout.write('No certificate data.\n')
# Get next result
result_type,result_data = l.result(ldap_msgid,0)
l.unbind_s()
pyca-20031118/bin/copy-cacerts.py 0100755 0000764 0000144 00000012415 07301173255 015764 0 ustar michael users #!/usr/bin/python
########################################################################
# copy-cacerts.py
# (c) by Michael Stroeder, michael@stroeder.com
########################################################################
__version__ = '0.6.6'
########################################################################
# This simple script copies either
# - all CA certs into a single PEM file
# (intended for use ApacheSSL SSLCACertificateFile) or
# - a directory with appropriate hash symlinks to the CA cert files
# (intended for use ApacheSSL SSLCACertificatePath).
########################################################################
import sys, string, os, getopt, types, shutil
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
--config=[pathname]
Pathname of OpenSSL configuration file.
Default: /etc/openssl/openssl.cnf
--pycalib=[directory]
Specify directory containing the pyCA modules
You may also use env variable PYCALIB.
Default: /usr/local/pyca/pylib
--certfile=[pathname of output PEM file]
Pathname of output PEM file containing all CA certs
--certdir=[directoryname]
Target directory for all CA certs. The CA certs are copied
to files named like the subject DN and symbolic links are
created like cacert.pem -> certhash.0.
Default is to use the current directory.
If you do not specify any of these options --certfile=./ca-certs.pem
is assumed.
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
script_name=sys.argv[0]
try:
options,args=getopt.getopt(sys.argv[1:],'h',['help','config=','pycalib=','certdir=','certfile='])
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage(script_name)
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
PrintUsage('Config file %s not found.' % (opensslcnfname))
sys.exit(1)
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
PrintUsage('Module directory %s not exists or not a directory.' % (pycalib))
sys.exit(1)
sys.path.append(pycalib)
try:
import openssl, charset
except ImportError:
PrintUsage('Required pyCA modules not found in directory %s!' % (pycalib))
# Read the configuration file
if os.path.isfile('%s.pickle' % (opensslcnfname)):
# Try to read OpenSSL's config file from a pickled copy
f=open('%s.pickle' % (opensslcnfname),'rb')
try:
# first try to use the faster cPickle module
from cPickle import load
except ImportError:
from pickle import load
opensslcnf=load(f)
f.close()
else:
# Parse OpenSSL's config file from source
opensslcnf=openssl.cnf.OpenSSLConfigClass(opensslcnfname)
pyca_section = opensslcnf.data.get('pyca',{})
openssl.bin_filename = pyca_section.get('OpenSSLExec','/usr/local/ssl/bin/openssl')
if findoption(options,'--certfile')!=():
certfilename = findoption(options,'--certfile')[1]
certfile = open(certfilename,'w')
else:
certfilename = ''
if findoption(options,'--certdir')!=():
certdir = findoption(options,'--certdir')[1]
if not os.path.exists(certdir) or not os.path.isdir(certdir):
PrintUsage('Directory %s not exists or not a directory.' % (certdir))
sys.exit(1)
else:
certdir = ''
if not certfilename and not certdir:
# Set at least one usable default
certfilename = './ca-certs.pem'
certfile = open(certfilename,'w')
ca_names = opensslcnf.sectionkeys.get('ca',[])
for ca_num in range(len(ca_names)):
ca_name = ca_names[ca_num]
ca = opensslcnf.getcadata(ca_name)
if os.path.isfile(ca.certificate):
cacert = openssl.cert.X509CertificateClass(ca.certificate)
# Copy the CA certificate file to directory
if certdir:
# Convert character sets
for dict in [cacert.issuer,cacert.subject]:
for attr in dict.keys():
dict[attr] = charset.asn12iso(dict[attr])
# New filename for CA cert
cacert_filename = '%(CN)s_%(OU)s_%(O)s_%(L)s_%(ST)s_%(C)s' % (cacert.subject) + os.path.splitext(ca.certificate)[1]
# Copy the file
shutil.copyfile(ca.certificate,os.path.join(certdir,cacert_filename))
# Create appropriate symlink
symlinkname = os.path.join(certdir,'%s.0' % (cacert.hash))
try:
os.symlink(cacert_filename,symlinkname)
except OSError:
sys.stderr.write('Warning: Could not create symbolic link.\n')
# Append CA certificate file to single certificate file
if certfilename:
cacertfile = open(ca.certificate,'r')
buf = cacertfile.read()
while buf:
certfile.write(buf)
buf = cacertfile.read()
cacertfile.close()
else:
sys.stderr.write('Warning: CA certificate file %s not found.\n')
if certfilename:
certfile.close()
pyca-20031118/bin/ns-jsconfig.py 0100755 0000764 0000144 00000012142 07301173255 015605 0 ustar michael users #!/usr/bin/python
########################################################################
# ns-jscertconfig.py
# (c) by Michael Stroeder, michael@stroeder.com
########################################################################
__version__ = '0.6.6'
########################################################################
# This simple script generates Javascript code containing all CA certs
# for a netscape.cfg
########################################################################
import sys, string, os, getopt, types, shutil
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
--config=[pathname]
Pathname of OpenSSL configuration file.
Default: /etc/openssl/openssl.cnf
--pycalib=[directory]
Specify directory containing the pyCA modules
Default: /usr/local/pyca/pylib
--nssecconf=[pathname]
Pathname of Javascript file to output containing all CA certs
for inclusion in netscape.cfg.
The trust parameters are marked according to nsCertType.
Self-signed certificates are marked with flag 'C' otherwise 'c'.
Default: stdout
--friendlynametemplate=[Python dict string]
A Python string used as template for building friendly
CA names. E.g. TestCA %%(CN)s %%(O)s
Default: %%(CN)s
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
script_name=sys.argv[0]
try:
options,args=getopt.getopt(sys.argv[1:],'h',['help','config=','pycalib=','nssecconf=','friendlynametemplate='])
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage(script_name)
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
PrintUsage('Config file %s not found.' % (opensslcnfname))
sys.exit(1)
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
PrintUsage('Module directory %s not exists or not a directory.' % (pycalib))
sys.exit(1)
sys.path.append(pycalib)
try:
import openssl, charset
except ImportError:
PrintUsage('Required pyCA modules not found in directory %s!' % (pycalib))
# Read the configuration file
if os.path.isfile('%s.pickle' % (opensslcnfname)):
# Try to read OpenSSL's config file from a pickled copy
f=open('%s.pickle' % (opensslcnfname),'rb')
try:
# first try to use the faster cPickle module
from cPickle import load
except ImportError:
from pickle import load
opensslcnf=load(f)
f.close()
else:
# Parse OpenSSL's config file from source
opensslcnf=openssl.cnf.OpenSSLConfigClass(opensslcnfname)
pyca_section = opensslcnf.data.get('pyca',{})
openssl.bin_filename = pyca_section.get('OpenSSLExec','/usr/local/ssl/bin/openssl')
if findoption(options,'--nssecconf')!=():
nssecconf = open(findoption(options,'--nssecconf')[1],'w')
else:
nssecconf = sys.stdout
if findoption(options,'--friendlynametemplate')!=():
friendlynametemplate = findoption(options,'--friendlynametemplate')[1]
else:
friendlynametemplate = '%(CN)s'
ca_names = opensslcnf.sectionkeys.get('ca',[])
nssecconf.write("""with (SecurityConfig) {
function pyCACertConfig() {\n
""")
for ca_num in range(len(ca_names)):
ca_name = ca_names[ca_num]
ca = opensslcnf.getcadata(ca_name)
if os.path.isfile(ca.certificate):
cacert = openssl.cert.X509CertificateClass(ca.certificate)
# Append CA certificate file to Javascript configuration file
cacertfile = open(ca.certificate,'r')
certbuf = []
line = cacertfile.readline()
while line:
certbuf.append('"%s\\n"' % (string.strip(line)))
line = cacertfile.readline()
cacertfile.close()
if cacert.issuer==cacert.subject:
ns_trustflag = 'C'
else:
ns_trustflag = 'c'
if ca.nsCertType:
ns_trustparams = ['','','']
if type(ca.nsCertType)==types.ListType:
nsCertType = ca.nsCertType
else:
nsCertType = [ca.nsCertType]
for nstype in nsCertType:
if nstype in ['server','sslCA']:
ns_trustparams[0]=ns_trustflag
if nstype in ['email','client','emailCA']:
ns_trustparams[1]=ns_trustflag
if nstype in ['objsign','objCA']:
ns_trustparams[2]=ns_trustflag
else:
ns_trustparams = [ns_trustflag,ns_trustflag,ns_trustflag]
nssecconf.write("""CE_addCert%d = new Certificate(
%s);
if ( ! CE_addCert%d.isPerm ) {
certDB.addCert(CE_addCert%d, "%s", "%s");
}
""" % (ca_num,string.join(certbuf,'+\n'),ca_num,ca_num,string.join(ns_trustparams,','),friendlynametemplate % cacert.subject))
else:
sys.stderr.write('Warning: CA certificate file %s not found.\n')
nssecconf.write("""}
pyCACertConfig()
}""")
nssecconf.close()
pyca-20031118/conf/ 0040755 0000764 0000144 00000000000 07756443113 013177 5 ustar michael users pyca-20031118/conf/openssl.cnf 0100644 0000764 0000144 00000037767 07745162000 015362 0 ustar michael users #
# OpenSSL configuration file: Two-level hierarchy
#
# Root-+
# |
# +-UserCerts (end user certs for S/MIME e-mail protection and
# | client authentication)
# |
# +-AuthCerts (solely for strong authentication with SSL/TLS)
# |
# +-ServerCerts (solely for server certificates with SSL/TLS)
# |
# +-CodeSigning (solely for code signing, Authenticode etc.)
RANDFILE = "$ENV::HOME/.rnd"
oid_file = /etc/openssl/.oid
oid_section = new_oids
[ new_oids ]
# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
dnQualifier = 2.5.4.46
surName = 2.5.4.4
givenName = 2.5.4.42
initials = 2.5.4.43
generationQualifier = 2.5.4.44
userID = 0.9.2342.19200300.100.1.1
####################################################################
[ ca ]
Root = CA_Root
EmailCerts = CA_EmailCerts
AuthCerts = CA_AuthCerts
CodeSigning = CA_CodeSigning
ServerCerts = CA_ServerCerts
####################################################################
[ CA_Root ]
dir = /usr/local/myCA/Root# Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
pend_reqs_dir = "" # default place for new unconfirmed cert reqs.
new_reqs_dir = "" # default place for new cert reqs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file
default_days = 730 # how long to certify for
default_crl_days= 5 # how long before next CRL
default_md = sha1 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_CA
ca_x509_extfile = /etc/openssl/cacert_Root.cnf
x509_extensions = x509v3_ext_CA # This section is only used for
# displaying the params in ca-index.py
[ CA_EmailCerts ]
dir = /usr/local/myCA/EmailCerts # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
pend_reqs_dir = $dir/pendreqs # default place for new unconfirmed cert reqs.
new_reqs_dir = $dir/newreqs # default place for new cert reqs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file
default_days = 200 # how long to certify for
default_crl_days= 2 # how long before next CRL
default_md = sha1 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_EmailCerts
x509_extensions = x509v3_ext_EmailCerts
signedby = Root
ca_x509_extfile = /etc/openssl/cacert_EmailCerts.cnf
req = req_EmailCerts
min_key_size = 768
[ CA_AuthCerts ]
dir = /usr/local/myCA/AuthCerts # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
pend_reqs_dir = $dir/pendreqs # default place for new unconfirmed cert reqs.
new_reqs_dir = $dir/newreqs # default place for new cert reqs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file
default_days = 200 # how long to certify for
default_crl_days= 2 # how long before next CRL
default_md = sha1 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_AuthCerts
x509_extensions = x509v3_ext_AuthCerts
signedby = Root
ca_x509_extfile = /etc/openssl/cacert_AuthCerts.cnf
req = req_AuthCerts
[ CA_CodeSigning ]
dir = /usr/local/myCA/CodeSigning # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
pend_reqs_dir = $dir/pendreqs # default place for new unconfirmed cert reqs.
new_reqs_dir = $dir/newreqs # default place for new cert reqs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file
default_days = 200 # how long to certify for
default_crl_days= 5 # how long before next CRL
default_md = sha1 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_CodeSigning
x509_extensions = x509v3_ext_CodeSigning
signedby = Root
ca_x509_extfile = /etc/openssl/cacert_CodeSigning.cnf
req = req_EmailCerts
[ CA_ServerCerts ]
dir = /usr/local/myCA/ServerCerts # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir/newcerts # default place for new certs.
pend_reqs_dir = $dir/pendreqs # default place for new unconfirmed cert reqs.
new_reqs_dir = $dir/newreqs # default place for new cert reqs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file
default_days = 60 # how long to certify for
default_crl_days= 2 # how long before next CRL
default_md = sha1 # which md to use.
preserve = no # keep passed DN ordering
policy = policy_ServerCerts
x509_extensions = x509v3_ext_ServerCerts
signedby = Root
ca_x509_extfile = /etc/openssl/cacert_ServerCerts.cnf
########################### Policies ###############################
[ policy_EmailCerts ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = supplied
organizationalUnitName = optional
commonName = supplied
emailAddress = supplied
[ policy_AuthCerts ]
organizationName = supplied
organizationalUnitName = optional
userID = supplied
#emailAddress = supplied
[ policy_CodeSigning ]
countryName = match
stateOrProvinceName = match
localityName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
userID = optional
emailAddress = supplied
[ policy_ServerCerts ]
countryName = supplied
stateOrProvinceName = optional
localityName = supplied
organizationName = supplied
organizationalUnitName = optional
commonName = supplied
####################################################################
[ req ]
default_bits = 1024
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
# attributes = req_attributes
[ req_distinguished_name ]
countryName = country ISO code
countryName_default = DE
countryName_min = 2
countryName_max = 2
countryName_regex = "[a-zA-Z][a-zA-Z]"
stateOrProvinceName = State/Province Name
stateOrProvinceName_default = ""
localityName = Location
localityName_default = Karlsruhe
organizationName = Organization
organizationName_default = "Your Organization"
organizationalUnitName = Organizational Unit Name
organizationalUnitName_default = Department One,Department Two,Department Three
commonName = Common Name
commonName_max = 64
emailAddress = Email Address
emailAddress_default = ""
emailAddress_max = 64
emailAddress_regex = "^([\w@.=/_ +-]+)@([\w-]+)(\.[\w-]+)*$"
[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
# unstructuredName = An optional company name
####################################################################
[ req_EmailCerts ]
distinguished_name = req_distinguished_name_EmailCerts
[ req_distinguished_name_EmailCerts ]
countryName = country ISO code
countryName_default = "DE"
countryName_min = 2
countryName_max = 2
countryName_regex = "[a-zA-Z][a-zA-Z]"
stateOrProvinceName = State/Province Name
stateOrProvinceName_default = ""
localityName = Location
localityName_default = Karlsruhe
organizationName = Organization
organizationName_default = "Your Organization"
organizationalUnitName = Organizational Unit Name
organizationalUnitName_default = Department One,Department Two,Department Three
commonName = Common Name
commonName_max = 64
emailAddress = Email Address
emailAddress_default = ""
emailAddress_max = 64
emailAddress_regex = "^([\w@.=/_ +-]+)@([\w-]+)(\.[\w-]+)*$"
[ req_AuthCerts ]
distinguished_name = req_distinguished_name_AuthCerts
[ req_distinguished_name_AuthCerts ]
organizationName = Organization
organizationName_default = "Your Organization"
userID = "User ID"
userID_max = 8
emailAddress = Email Address
emailAddress_default = "@ms.inka.de"
emailAddress_max = 64
emailAddress_regex = "^([\w@.=/_ +-]+)@([\w-]+)(\.[\w-]+)*$"
####################################################################
[ req_short_and_empty ]
distinguished_name = req_distinguished_name_short_and_empty
[ req_distinguished_name_short_and_empty ]
countryName = country ISO code
countryName_min = 2
countryName_max = 2
countryName_regex = "[a-zA-Z][a-zA-Z]"
stateOrProvinceName = State/Province Name
localityName = Location
organizationName = Organization
organizationalUnitName = Organizational Unit Name
commonName = Common Name
commonName_max = 64
emailAddress = Email Address
emailAddress_max = 64
emailAddress_regex = "^([\w@.=/_ +-]+)@([\w-]+)(\.[\w-]+)*$"
##############################################################################
[ x509v3_ext_CA ]
basicConstraints = CA:true
keyUsage = cRLSign,keyCertSign
crlDistributionPoints = URI:"http://localhost/pyca/get-cert.py/Root/crl.crl"
nsComment = "This certificate is used for issueing sub-CA certs."
nsBaseUrl = "https://localhost/"
nsCaRevocationUrl = pyca/get-cert.py/Root/crl.crl
nsRevocationUrl = pyca/ns-check-rev.py/Root?
nsRenewalUrl = pyca/ns-renewal.py/Root?
nsCaPolicyUrl = TestCA/policy/CA-policy.html
[ x509v3_ext_EmailCerts ]
# PKIX extensions
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = nonRepudiation,digitalSignature,keyEncipherment
extendedKeyUsage = emailProtection
issuerAltName = URI:"https://localhost/pyca/get-cert.py/EmailCerts/ca.crt"
crlDistributionPoints = URI:"http://localhost/pyca/get-cert.py/EmailCerts/crl.crl"
subjectAltName = email:copy
# Netscape-specific extensions
nsComment = "This certificate is used for e-mail."
nsBaseUrl = "https://localhost/"
nsCaRevocationUrl = pyca/get-cert.py/EmailCerts/crl.crl
nsRevocationUrl = pyca/ns-check-rev.py/EmailCerts?
nsRenewalUrl = pyca/ns-renewal.py/EmailCerts?
nsCaPolicyUrl = TestCA/policy/EmailCerts-policy.html
nsCertType = email
[ x509v3_ext_AuthCerts ]
# PKIX extensions
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = digitalSignature
extendedKeyUsage = clientAuth
issuerAltName = URI:"https://localhost/pyca/get-cert.py/AuthCerts/ca.crt"
crlDistributionPoints = URI:"http://localhost/pyca/get-cert.py/AuthCerts/crl.crl"
# Netscape-specific extensions
nsComment = "This certificate is used for strong authentication."
nsBaseUrl = "https://localhost/"
nsCaRevocationUrl = pyca/get-cert.py/AuthCerts/crl.crl
nsRevocationUrl = pyca/ns-check-rev.py/AuthCerts?
nsRenewalUrl = pyca/ns-renewal.py/AuthCerts?
nsCaPolicyUrl = TestCA/policy/AuthCerts-policy.html
nsCertType = client
[ x509v3_ext_CodeSigning ]
# PKIX extensions
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = digitalSignature
extendedKeyUsage = codeSigning
issuerAltName = URI:"https://localhost/pyca/get-cert.py/CodeSigning/ca.crt"
crlDistributionPoints = URI:"http://localhost/pyca/get-cert.py/CodeSigning/crl.crl"
# Netscape-specific extensions
nsComment = "This certificate is used for CodeSigning signing."
nsBaseUrl = "https://localhost/"
nsCaRevocationUrl = pyca/get-cert.py/CodeSigning/crl.crl
nsRevocationUrl = pyca/ns-check-rev.py/CodeSigning?
nsRenewalUrl = pyca/ns-renewal.py/CodeSigning?
nsCaPolicyUrl = TestCA/policy/CodeSigning-policy.html
nsCertType = objsign
[ x509v3_ext_ServerCerts ]
# PKIX extensions
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
crlDistributionPoints = URI:"http://localhost/pyca/get-cert.py/ServerCerts/crl.crl"
keyUsage = keyEncipherment
extendedKeyUsage = serverAuth,nsSGC,msSGC
# Netscape-specific extensions
nsComment = "This certificate is used for SSL ServerCerts."
nsBaseUrl = "https://localhost/"
nsCaRevocationUrl = pyca/get-cert.py/ServerCerts/crl.crl
nsRevocationUrl = pyca/ns-check-rev.py/ServerCerts?
nsRenewalUrl = pyca/ns-renewal.py/ServerCerts?
nsCaPolicyUrl = TestCA/policy/ServerCerts-policy.html
nsCertType = server
# [ pyca ] is a proprietary, non-OpenSSL section for the pyca-package
# on http://www.pyca.de/
[ pyca ]
caCertFormat = DER
# Base-URL for the other URL addresses
# This is meant as fallback option if the CA-specific
# attribute nsBaseUrl is not set
nsBaseUrl = "https://localhost/"
# Relative URL address of ca-index.py
nsCAIndexUrl = pyca/ca-index.py
# Relative URL address of client-enroll.py
nsEnrollUrl = pyca/client-enroll.py
# Relative URL address of get-cert.py
nsGetCertUrl = pyca/get-cert.py
# Relative URL address of view-cert.py
nsViewCertUrl = pyca/view-cert.py
# Pathname of the openssl executable
OpenSSLExec = /usr/bin/openssl
# Username of caadmin
userCAAdmin = caadmin
# Username of WWW Server
userWWWRun = wwwrun
# Username of mail delivery demon
userMailDaemon = daemon
# Preferred HTTP method for submitting form parameters
ScriptMethod = POST
# Relative URL address of help texts (e.g. client-enroll-help.html)
HelpUrl = inkasite/python/pyca/help/
# The default SMTP mail relay
MailRelay = localhost
# Directory for temporary files
TmpDir = /tmp
# Path to file for log output of ca-certreq-mail.py.
# The directory must be writeable for the user defined with parameter
# userMailDaemon
caCertConfirmReqLog = /var/log/pyca/ca-certreq-mail.out
# Pathname for the error log file.
# stderr is used as default, if empty or not defined.
#ErrorLog = /var/log/pyca/httpd_error_log
# E-mail address of the mail dialogue script for certificate requests
# if empty, no mail dialogue is initiated.
caCertReqMailAdr = confirm-cert-req@ms.inka.de
# Central e-mail address of the CA's administrator.
# This is used as From: address if the subject name of a CA cert does
# not contain an Email attribute.
caAdminMailAdr = caadmin@ms.inka.de
# Amount of time [h] how long a pending certificate request is stored
# in caPendCertReqDir without being confirmed by e-mail.
# Set to zero (this is the default) to disable automatic deletion of
# unconfirmed certificate requests by ca-cycle-pub.py.
caPendCertReqValid = 24
# List CA names for which certificate requests can only be created
# from an internal network (see caInternalIPAdr and caInternalDomains).
# The integrity of your PKI should not be based on such mechanisms!
caInternalCertTypes = CodeSigning
# List of network addresses/-masks which are considered internal
caInternalIPAdr = 127.0.0.0/255.0.0.0,10.0.0.0/255.0.0.0
# List of email address domains which are handled as internal
caInternalDomains = pyca.de
# List of CA names for which handling of intermediate CA certs should
# be provided.
caIntermediateCACerts = EmailCerts
# All parameters for tag (quote " with ´´).
htmlBodyParam = ´TEXT="#000000" LINK="Red" VLINK="Green" BGCOLOR="#FFFFFF"´
pyca-20031118/conf/cacert_ServerCerts.cnf 0100644 0000764 0000144 00000003216 07660756463 017467 0 ustar michael users extensions = extension_section
x509_extensions = extension_section
[ req ]
default_bits = 1024
distinguished_name = req_dn
encrypt_rsa_key = yes
[ req_dn ]
#1.domainComponent = DNS domain Component
#1.domainComponent_default = "com"
#2.domainComponent = DNS domain Component
#2.domainComponent_default = "localhost"
countryName = ISO country code
countryName_default = "XX"
stateOrProvinceName = State/Province Name
stateOrProvinceName_default = ""
localityName = Location
localityName_default = ""
organizationName = Organization
organizationName_default = "Looser Org."
organizationalUnitName = Organizational Unit Name
organizationalUnitName_default = "bad CA!"
commonName = Common Name
commonName_default = "ServerCerts TestCA"
commonName_max = 64
[extension_section]
# PKIX
basicConstraints=critical,CA:true
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
keyUsage = cRLSign, keyCertSign
extendedKeyUsage = nsSGC,msSGC
subjectAltName = URI:"http://localhost/pyca/get-cert.py/ServerCerts/ca.crt"
issuerAltName = issuer:copy
crlDistributionPoints = URI:"http://localhost/pyca/get-cert.py/Root/crl.crl"
#certificatePolicies=ia5org,@polsect
# Netscape cert extensions
nsComment = "This CA issues SSL server certificates."
nsCaPolicyUrl = "https://localhost/ServerCerts/policy.html"
nsCertType = sslCA
nsCaRevocationUrl = "http://localhost/pyca/get-cert.py/Root/crl.crl"
[ polsect ]
#policyIdentifier=1.2.3.4
#CPS="https://localhost/ServerCerts/policy.html"
#userNotice=@notice
[ notice ]
explicitText="This CA issues SSL server certificates."
organization="Looser Org. with bad CA admin."
noticeNumbers=4, 2
pyca-20031118/conf/ssl_server_csr.cnf 0100644 0000764 0000144 00000002074 07753215421 016721 0 ustar michael users # This is a config template for generating CSRs for
# SSL server certs with OpenSSL.
#
# Usage:
# openssl req -new -config ~michael/Proj/python/pyca/conf/ssl_server_csr.cnf
#
# You probably want to adjust the settings to reflect your
# domain, company name etc.
[ req ]
default_bits = 1024
distinguished_name = req_dn
encrypt_rsa_key = yes
[ req_dn ]
countryName = ISO country code
countryName_default = "DE"
stateOrProvinceName = State/Province Name
stateOrProvinceName_default = ""
localityName = Location
localityName_default = "Karlsruhe"
organizationName = Organization
organizationName_default = "stroeder.com"
organizationalUnitName = Organizational Unit Name
organizationalUnitName_default = "ITS"
commonName = FQDN of SSL Server
commonName_default = ""
commonName_max = 64
#emailAddress = E-Mail address
#emailAddress_default = ""
#emailAddress_max = 64
pyca-20031118/conf/cacert_Root.cnf 0100644 0000764 0000144 00000003315 07660756463 016143 0 ustar michael users extensions = extension_section
x509_extensions = extension_section
[ req ]
default_bits = 1024
distinguished_name = req_dn
encrypt_rsa_key = yes
[ req_dn ]
#1.domainComponent = DNS domain Component
#1.domainComponent_default = "com"
#2.domainComponent = DNS domain Component
#2.domainComponent_default = "localhost"
countryName = ISO country code
countryName_default = "XX"
stateOrProvinceName = State/Province Name
stateOrProvinceName_default = ""
localityName = Location
localityName_default = ""
organizationName = Organization
organizationName_default = "Looser Org."
organizationalUnitName = Organizational Unit Name
organizationalUnitName_default = "bad CA!"
commonName = Common Name
commonName_default = "Root TestCA"
commonName_max = 64
[extension_section]
# Netscape cert extensions
nsCertType = sslCA,emailCA,objCA
nsComment = "This Root CA issues sub-CA certs of different policies and has no contact with end-entities."
nsCaPolicyUrl = "https://localhost/Root/policy.html"
nsCaRevocationUrl = "http://localhost/pyca/get-cert.py/Root/crl.crl"
# PKIX
basicConstraints=critical,CA:true
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
keyUsage = cRLSign,keyCertSign
extendedKeyUsage = nsSGC,msSGC
subjectAltName = URI:"http://localhost/pyca/get-cert.py/Root/ca.crt"
crlDistributionPoints = URI:"http://localhost/pyca/get-cert.py/Root/crl.crl"
#certificatePolicies=ia5org,@polsect
[ polsect ]
#policyIdentifier=1.2.3.4
#CPS="https://localhost/Root/policy.html"
#userNotice=@notice
[ notice ]
explicitText="This Root CA issues sub-CA certs of different policies and has no contact with end-entities."
organization="Looser Org. with bad CA admin."
noticeNumbers=4, 2
pyca-20031118/conf/cacert_CodeSigning.cnf 0100644 0000764 0000144 00000003147 07660756463 017414 0 ustar michael users extensions = extension_section
x509_extensions = extension_section
[ req ]
default_bits = 1024
distinguished_name = req_dn
encrypt_rsa_key = yes
[ req_dn ]
#1.domainComponent = DNS domain Component
#1.domainComponent_default = "com"
#2.domainComponent = DNS domain Component
#2.domainComponent_default = "localhost"
countryName = ISO country code
countryName_default = "XX"
stateOrProvinceName = State/Province Name
stateOrProvinceName_default = ""
localityName = Location
localityName_default = ""
organizationName = Organization
organizationName_default = "Looser Org."
organizationalUnitName = Organizational Unit Name
organizationalUnitName_default = "bad CA!"
commonName = Common Name
commonName_default = "CodeSigning TestCA"
commonName_max = 64
[extension_section]
# PKIX
basicConstraints=critical,CA:true
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
keyUsage = cRLSign, keyCertSign
subjectAltName = URI:"http://localhost/pyca/get-cert.py/CodeSigning/ca.crt"
issuerAltName = issuer:copy
crlDistributionPoints = URI:"http://localhost/pyca/get-cert.py/Root/crl.crl"
#certificatePolicies=ia5org,@polsect
# Netscape cert extensions
nsComment = "This CA issues code signing certificates."
nsCaPolicyUrl = "https://localhost/CodeSigning/policy.html"
nsCertType = objCA
nsCaRevocationUrl = "http://localhost/pyca/get-cert.py/Root/crl.crl"
[ polsect ]
#policyIdentifier=1.2.3.4
#CPS="https://localhost/CodeSigning/policy.html"
#userNotice=@notice
[ notice ]
explicitText="This CA issues code signing certificates."
organization="Looser Org. with bad CA admin."
noticeNumbers=4, 2
pyca-20031118/conf/cacert_AuthCerts.cnf 0100644 0000764 0000144 00000003147 07660756463 017125 0 ustar michael users extensions = extension_section
x509_extensions = extension_section
[ req ]
default_bits = 1024
distinguished_name = req_dn
encrypt_rsa_key = yes
[ req_dn ]
#1.domainComponent = DNS domain Component
#1.domainComponent_default = "com"
#2.domainComponent = DNS domain Component
#2.domainComponent_default = "localhost"
countryName = ISO country code
countryName_default = "XX"
stateOrProvinceName = State/Province Name
stateOrProvinceName_default = ""
localityName = Location
localityName_default = ""
organizationName = Organization
organizationName_default = "Looser Org."
organizationalUnitName = Organizational Unit Name
organizationalUnitName_default = "bad CA!"
commonName = Common Name
commonName_default = "AuthCerts TestCA"
commonName_max = 64
[extension_section]
# PKIX
basicConstraints=critical,CA:true
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
keyUsage = cRLSign, keyCertSign
subjectAltName = URI:"http://localhost/pyca/get-cert.py/AuthCerts/ca.crt"
issuerAltName = issuer:copy
crlDistributionPoints = URI:"http://localhost/pyca/get-cert.py/Root/crl.crl"
#certificatePolicies=ia5org,@polsect
# Netscape cert extensions
nsComment = "This CA issues SSL client certificates."
nsCaPolicyUrl = "https://localhost/AuthCerts/policy.html"
nsCertType = sslCA
nsCaRevocationUrl = "http://localhost/pyca/get-cert.py/Root/crl.crl"
[ polsect ]
#policyIdentifier=1.2.3.4
#CPS="https://localhost/AuthCerts/policy.html"
#userNotice=@notice
[ notice ]
explicitText="This CA issues SSL client certificates."
organization="Looser Org. with bad CA admin."
noticeNumbers=4, 2
pyca-20031118/conf/cacert_EmailCerts.cnf 0100644 0000764 0000144 00000003131 07660756463 017244 0 ustar michael users extensions = extension_section
x509_extensions = extension_section
[ req ]
default_bits = 1024
distinguished_name = req_dn
encrypt_rsa_key = yes
[ req_dn ]
#1.domainComponent = DNS domain Component
#1.domainComponent_default = "com"
#2.domainComponent = DNS domain Component
#2.domainComponent_default = "localhost"
countryName = ISO country code
countryName_default = "XX"
stateOrProvinceName = State/Province Name
stateOrProvinceName_default = ""
localityName = Location
localityName_default = ""
organizationName = Organization
organizationName_default = "Looser Org."
organizationalUnitName = Organizational Unit Name
organizationalUnitName_default = "bad CA!"
commonName = Common Name
commonName_default = "EmailCerts TestCA"
commonName_max = 64
[extension_section]
# PKIX
basicConstraints=critical,CA:true
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
keyUsage = cRLSign, keyCertSign
subjectAltName = URI:"http://localhost/pyca/get-cert.py/EmailCerts/ca.crt"
issuerAltName = issuer:copy
crlDistributionPoints = URI:"http://localhost/pyca/get-cert.py/Root/crl.crl"
#certificatePolicies=ia5org,@polsect
# Netscape cert extensions
nsComment = "This CA issues e-mail certificates."
nsCaPolicyUrl = "https://localhost/EmailCerts/policy.html"
nsCertType = emailCA
nsCaRevocationUrl = "http://localhost/pyca/get-cert.py/Root/crl.crl"
[ polsect ]
#policyIdentifier=1.2.3.4
#CPS="https://localhost/EmailCerts/policy.html"
#userNotice=@notice
[ notice ]
explicitText="This CA issues e-mail certificates."
organization="Looser Org. with bad CA admin."
noticeNumbers=4, 2
pyca-20031118/docs/ 0040755 0000764 0000144 00000000000 07756443113 013202 5 ustar michael users pyca-20031118/help/ 0040755 0000764 0000144 00000000000 07756443113 013202 5 ustar michael users pyca-20031118/sbin/ 0040755 0000764 0000144 00000000000 07756443113 013205 5 ustar michael users pyca-20031118/sbin/ca-revoke.py 0100755 0000764 0000144 00000013767 07301173261 015437 0 ustar michael users #!/usr/bin/python
########################################################################
# ca-revoke.py
# (c) by Michael Stroeder, michael@stroeder.com
########################################################################
__version__ = '0.6.6'
########################################################################
# This script is used to revoke certificates from the command line
# ca-revoke.py -h prints usage of parameters.
########################################################################
import sys, string, os, smtplib, getopt
from time import time,localtime,strftime,mktime
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
--config=[pathname]
Pathname of OpenSSL configuration file.
You may also use env variable OPENSSL_CONF.
Default: /etc/openssl/openssl.cnf
--pycalib=[directory]
Specify directory containing the pyCA modules
You may also use env variable PYCALIB.
Default: /usr/local/pyca/pylib
--name=[CA name]
Name of CA in section [ca] of OpenSSL config.
--serial=[hex number]
Serial number of certificate to revoke.
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
########################################################################
# Main
########################################################################
script_name=sys.argv[0]
try:
options,args=getopt.getopt(sys.argv[1:],'h',['help','config=','pycalib=','name=','serial='])
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage()
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
PrintUsage('Config file %s not found.' % (opensslcnfname))
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
PrintUsage('Module directory %s not exists or not a directory.' % (pycalib))
sys.path.append(pycalib)
try:
import openssl,charset
from openssl.db import \
empty_DN_dict, \
DB_type,DB_exp_date,DB_rev_date,DB_serial,DB_file,DB_name,DB_number, \
DB_TYPE_REV,DB_TYPE_EXP,DB_TYPE_VAL, \
dbtime2tuple,GetEntriesbyDN,SplitDN
except ImportError:
PrintUsage('Required pyCA modules not found in directory %s!' % (pycalib))
# Read the configuration file
if os.path.isfile('%s.pickle' % (opensslcnfname)):
# Try to read OpenSSL's config file from a pickled copy
f=open('%s.pickle' % (opensslcnfname),'rb')
try:
# first try to use the faster cPickle module
from cPickle import load
except ImportError:
from pickle import load
opensslcnf=load(f)
f.close()
else:
# Parse OpenSSL's config file from source
opensslcnf=openssl.cnf.OpenSSLConfigClass(opensslcnfname)
pyca_section = opensslcnf.data.get('pyca',{})
ca_names = opensslcnf.sectionkeys.get('ca',[])
openssl.bin_filename = pyca_section.get('OpenSSLExec','/usr/local/ssl/bin/openssl')
if not os.path.isfile(openssl.bin_filename):
sys.stderr.write('Did not find OpenSSL executable %s.\n' % (openssl.bin_filename))
sys.exit(1)
if findoption(options,'--name')!=():
ca_name = findoption(options,'--name')[1]
if not ca_name in ca_names:
PrintUsage('Wrong CA name.\nCA names listed in the current configuration:\n%s.' % string.join(ca_names,', '))
else:
PrintUsage('You have to provide a name of a CA definition.')
if findoption(options,'--serial')!=():
try:
serial = string.atoi(findoption(options,'--serial')[1],16)
except ValueError:
PrintUsage('No valid serial number.')
else:
PrintUsage('You have to provide the serial number of the certificate you want to revoke.')
ca = opensslcnf.getcadata(ca_name)
sys.stdout.write('Searching database %s for certificate %x...\n' % (ca.database,serial))
ca_db = openssl.db.OpenSSLcaDatabaseClass(ca.database)
result = ca_db.GetEntrybySerial(serial)
if result:
sys.stdout.write("""Found the following certificate:
Serial number: %s
Distinguished Name: %s
""" % (result[DB_serial],charset.asn12iso(result[DB_name])))
if result[DB_type]==DB_TYPE_REV:
sys.stdout.write('Certificate already revoked since %s.\n' % strftime('%d.%m.%Y',localtime(mktime(dbtime2tuple(result[DB_rev_date])))))
sys.exit(0)
elif result[DB_type]==DB_TYPE_EXP:
sys.stdout.write('Certificate already expired since %s.\n' % strftime('%d.%m.%Y',localtime(mktime(dbtime2tuple(result[DB_exp_date])))))
sys.exit(0)
elif result[DB_type]==DB_TYPE_VAL:
sys.stdout.write('Valid until %s.\n\nRevoke the certificate? (y/n) ' % strftime('%d.%m.%Y',localtime(mktime(dbtime2tuple(result[DB_exp_date])))))
answer = sys.stdin.readline()
if string.lower(string.strip(answer))=='y':
ca_db.Revoke(serial)
sys.stdout.write('Certificate %x in %s marked as revoked.\n' % (serial,ca_name))
# CA's private key present <=> we are on the private CA system
if os.path.isfile(ca.certificate) and os.path.isfile(ca.private_key):
sys.stdout.write('Issue new CRL? (y/n) ')
answer = sys.stdin.readline()
if string.lower(string.strip(answer))=='y':
sys.stdout.write('Issueing new CRL %s.\n' % (ca.crl))
rc = os.system('%s ca -config %s -name %s -gencrl -out %s' % \
(openssl.bin_filename,opensslcnfname,ca.sectionname,ca.crl))
if rc:
sys.stderr.write('Error %d creating CRL %s.\n' % (rc,ca.crl))
else:
raise ValueError, 'Unknown type field %s in certificate database.' % result[DB_type]
else:
PrintUsage('No certificate found in "%s" with serial %x.\n' % (ca_name,serial))
pyca-20031118/sbin/ca-make.py 0100755 0000764 0000144 00000030723 07475760310 015061 0 ustar michael users #!/usr/bin/python
"""
ca-make.py - boot-strap of certificate authorities
(c) by Michael Stroeder, michael@stroeder.com
This script creates if non-existent (in the order given below,
does not overwrite existing files with file length > 0):
Directory structure:
dir Where everything is kept
certs Where the issued certs are kept
new_certs_dir default place for new certs.
crl_dir Where the issued crl are kept
Files:
database database index file.
serial The current serial number
Certificate files:
private_key The private key of the CA
certificate The CA certificate
"""
__version__ = '0.6.6'
import sys, string, os, stat, pwd, grp, getopt, time
def filenotvalid(pathname):
return not os.path.isfile(pathname) or os.stat(pathname)[stat.ST_SIZE]==0
def CheckedMakeDir(dirname,perms=0,uid=0,gid=0):
if not dirname:
return
if os.path.exists(dirname):
# Directory does already exist
if not os.path.isdir(dirname):
sys.stderr.write('Warning: %s already exists but is no directory.\n' % (dirname))
else:
# Create directory
try:
os.makedirs(dirname)
sys.stdout.write('Created directory %s\n' % (dirname))
except OSError:
sys.stderr.write('Error: Could not create directory %s.\n' % (dirname))
return
# Get current file stat info
fstat = os.stat(dirname)
if perms:
os.chmod(dirname,perms)
sys.stdout.write('Changed permissions of %s to %o\n' % (dirname,perms))
if (uid and fstat[stat.ST_UID]!=uid) or \
(gid and fstat[stat.ST_GID]!=gid):
if not uid:
uid=fstat[stat.ST_UID]
if not gid:
gid=pwd.getpwuid(uid)[3]
os.chown(dirname,uid,gid)
sys.stdout.write('Changed owner/group of %s to %s.%s\n' % (dirname,pwd.getpwuid(uid)[0],grp.getgrgid(gid)[0]))
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
--config=[pathname]
Pathname of OpenSSL configuration file.
You may also use env variable OPENSSL_CONF.
Default: /etc/openssl/openssl.cnf
--pycalib=[directory]
Specify directory containing the pyCA modules
Default: /usr/local/pyca/pylib
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
########################################################################
# Main
########################################################################
script_name=sys.argv[0]
try:
options,args=getopt.getopt(sys.argv[1:],'h',['help','config=','pycalib='])
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage()
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
PrintUsage('Config file %s not found.' % (opensslcnfname))
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
PrintUsage('Module directory %s not exists or not a directory.' % (pycalib))
sys.path.append(pycalib)
try:
import openssl, charset
except ImportError:
PrintUsage('Required pyCA modules not found in directory %s!' % (pycalib))
# Read the configuration file
if os.path.isfile('%s.pickle' % (opensslcnfname)):
# Try to read OpenSSL's config file from a pickled copy
f=open('%s.pickle' % (opensslcnfname),'rb')
try:
# first try to use the faster cPickle module
from cPickle import load
except ImportError:
from pickle import load
opensslcnf=load(f)
f.close()
else:
# Parse OpenSSL's config file from source
opensslcnf=openssl.cnf.OpenSSLConfigClass(opensslcnfname)
pyca_section = opensslcnf.data.get('pyca',{})
openssl.bin_filename = pyca_section.get('OpenSSLExec','/usr/local/ssl/bin/openssl')
if not os.path.isfile(openssl.bin_filename):
PrintUsage('Did not find OpenSSL executable %s.' % (openssl.bin_filename))
OpenSSLExec = openssl.bin_filename
currentusername = pwd.getpwuid(os.getuid())[0]
# Getting UIDs
# Set current UID as default
uidCAAdmin = pwd.getpwnam(pyca_section.get('userCAAdmin',currentusername))[2]
uidMailDaemon = pwd.getpwnam(pyca_section.get('userMailDaemon',currentusername))[2]
uidWWWRun = pwd.getpwnam(pyca_section.get('userWWWRun',currentusername))[2]
gidCAAdmin = pwd.getpwuid(uidCAAdmin)[3]
gidMailDaemon = pwd.getpwuid(uidMailDaemon)[3]
gidWWWRun = pwd.getpwuid(uidWWWRun)[3]
ca_names = opensslcnf.sectionkeys.get('ca',[])
sys.stdout.write("""
#############################################################
# Create directories and various files
#############################################################
""")
for ca_name in ca_names:
sys.stdout.write('\nProcessing %s\n' % ca_name)
ca = opensslcnf.getcadata(ca_name)
# Create sub-directories
CheckedMakeDir(ca.dir,perms=0755,uid=uidCAAdmin,gid=gidCAAdmin)
CheckedMakeDir(ca.certs,perms=0755,uid=uidCAAdmin,gid=gidCAAdmin)
CheckedMakeDir(ca.new_certs_dir,perms=0700,uid=uidCAAdmin,gid=gidCAAdmin)
CheckedMakeDir(ca.crl_dir,perms=0755,uid=uidCAAdmin,gid=gidCAAdmin)
if ca.pend_reqs_dir==ca.new_reqs_dir:
CheckedMakeDir(ca.new_reqs_dir,perms=0370,uid=uidWWWRun,gid=gidCAAdmin)
else:
CheckedMakeDir(ca.pend_reqs_dir,perms=0370,uid=uidWWWRun,gid=gidMailDaemon)
CheckedMakeDir(ca.new_reqs_dir,perms=0370,uid=uidMailDaemon,gid=gidCAAdmin)
CheckedMakeDir(ca.old_reqs_dir,perms=0700,uid=uidCAAdmin,gid=gidCAAdmin)
CheckedMakeDir(os.path.dirname(ca.certificate),perms=0755,uid=uidCAAdmin,gid=gidCAAdmin)
if os.path.isfile(ca.certificate):
# In any case we set permission and ownership of
# CA certificate file if already existent
os.chown(ca.certificate,uidCAAdmin,gidCAAdmin)
os.chmod(ca.certificate,0444)
CheckedMakeDir(os.path.dirname(ca.private_key),perms=0700,uid=uidCAAdmin,gid=gidCAAdmin)
if os.path.isfile(ca.private_key):
# In any case we set permission and ownership of
# CA private key file if existent
os.chown(ca.private_key,uidCAAdmin,gidCAAdmin)
os.chmod(ca.private_key,0400)
# database: database index file
if not os.path.isfile(ca.database):
sys.stdout.write('Creating database file %s\n' % (ca.database))
file=open(ca.database,'w')
file.write('')
file.close()
os.chown(ca.database,uidCAAdmin,gidCAAdmin)
os.chmod(ca.database,0644)
# serial: next serial number for issueing certificates
if filenotvalid(ca.serial):
sys.stdout.write('Creating serial file %s\n' % (ca.serial))
file=open(ca.serial,'w')
file.write('01\n')
file.close()
os.chown(ca.serial,uidCAAdmin,gidCAAdmin)
os.chmod(ca.serial,0600)
os.setgid(gidCAAdmin)
os.setuid(uidCAAdmin)
sys.stdout.write("""
#############################################################
# create self-signed CA certs or certificate requests
#############################################################\n
Give passwords for each CAs here.
""")
subca = []
for ca_name in ca_names:
sys.stdout.write('\nProcessing %s\n' % ca_name)
ca = opensslcnf.getcadata(ca_name)
if ca.signedby:
# Add CA to list of sub-CAs to be signed late
subca.append(ca_name)
if filenotvalid('%s-req' % ca.certificate) and filenotvalid(ca.private_key):
sys.stdout.write('Creating certificate request %s with private key %s.\n' % (ca.certificate,ca.private_key))
if not ca.ca_reqfile:
ca.ca_reqfile = ca.ca_x509_extfile
if not ca.ca_reqfile:
ca.ca_reqfile = opensslcnfname
rc = os.system('%s req -config %s -new -outform pem -out %s-req -keyout %s' % \
(OpenSSLExec,ca.ca_reqfile,ca.certificate,ca.private_key))
os.chmod(ca.private_key,0400)
if rc:
sys.stderr.write('Error %d creating CA cert request %s-req.\n' % (rc,ca.certificate))
if filenotvalid(ca.certificate) and not ca.signedby:
sys.stdout.write('How many days should this certificate be valid (minimum=%d, default=%d days): ' % (ca.default_days+1,2*ca.default_days+1))
days = string.strip(sys.stdin.readline())
if not days:
days = 2*ca.default_days+1
rc = os.system('%s x509 -req -inform pem -in %s-req -outform pem -out %s -signkey %s -days %s -extfile %s' % \
(OpenSSLExec,ca.certificate,ca.certificate,ca.private_key,days,ca.ca_x509_extfile))
if rc:
sys.stderr.write('Error %d self-signing CA cert %s.\n' % (rc,ca.certificate))
if subca:
sys.stdout.write("""
#############################################################
# Create certs of sub-CAs
#############################################################\n
Use passwords of parent CAs here.\n
""")
for ca_name in subca:
sys.stdout.write('\nProcessing %s\n' % ca_name)
# Get the sub-CA's config data
subca = opensslcnf.getcadata(ca_name)
# Check if signedby points to a valid CA section name
if not subca.signedby in ca_names:
sys.stderr.write('CA name "%s" given in signedby parameter of section [%s] not found.\n' % (subca.signedby,subca.sectionname))
sys.exit(1)
# Get the issuer's CA config data
ca = opensslcnf.getcadata(subca.signedby)
# Check if issuer's certificate and key files are present
if filenotvalid(ca.certificate) or filenotvalid(ca.private_key):
sys.stderr.write("""CA certificate or key file of issuer %s not found or zero-length.
Check the files %s and %s.
""" % (subca.signedby,ca.certificate,ca.private_key))
sys.exit(1)
# Check if issuer certificate is valid at current time
gmt = time.time()
ca_cert = openssl.cert.X509CertificateClass(ca.certificate)
if gmt+86400*ca.default_days>ca_cert.notAfter_secs:
sys.stderr.write("""Certificate of issueing parent CA "%s" is not valid until %s.
You can either set parameter default_days<=%d in section [%s] or
issue a new parent CA cert.
""" % (ca.name,time.strftime('%Y-%m-%d %H:%M',time.gmtime(gmt+86400*ca.default_days)),(ca_cert.notAfter_secs-gmt)/86400,ca.sectionname))
sys.exit(1)
# Create the new sub-CA certificate if there's no older file in the way
if filenotvalid(subca.certificate):
sys.stdout.write('Creating sub-CA certificate %s with issuer "%s".\n' % (subca.certificate,ca.name))
rc = os.system('%s x509 -req -inform pem -in %s-req -outform pem -out %s -CA %s -CAkey %s -CAserial %s -days %s -extfile %s' % \
(OpenSSLExec,subca.certificate,subca.certificate,ca.certificate,ca.private_key,ca.serial,ca.default_days,subca.ca_x509_extfile))
if rc:
sys.stderr.write('Error %d issueing CA cert %s.\n' % (rc,ca.certificate))
else:
sys.stdout.write('Sub-CA certificate file %s already exists. Skipping...\n' % (subca.certificate))
sys.stdout.write("""
#############################################################
# Verifying CA certs
#############################################################\n
""")
for ca_name in ca_names:
ca = opensslcnf.getcadata(ca_name)
if ca.signedby:
if ca.signedby in ca_names:
parentca = opensslcnf.getcadata(ca.signedby)
else:
parentca = None
sys.stderr.write('CA name "%s" given in signedby parameter of section [%s] not found.\n' % (subca.signedby,subca.sectionname))
else:
parentca = ca
if not (filenotvalid(ca.certificate) or filenotvalid(parentca.certificate)):
sys.stdout.write('Verifying sub-CA certificate %s with issuer certificate %s.\n' % (ca.certificate,parentca.certificate))
rc = os.system('%s verify -verbose -CAfile %s %s' % \
(OpenSSLExec,parentca.certificate,ca.certificate))
if rc:
sys.stderr.write('Error %d verifying CA cert %s.\n' % (rc,ca.certificate))
ca_cert = openssl.cert.X509CertificateClass(ca.certificate)
if not ca_cert.subject.has_key('CN'):
sys.stderr.write('CA certificate %s has no CN attribute.\nThis might cause weird problems with some software.\n' % (ca.certificate))
for subject_attr in ca_cert.subject.keys():
if not charset.is_ascii(charset.asn12iso(ca_cert.subject[subject_attr])):
sys.stderr.write('CA certificate %s has NON-ASCII attribute %s.\nThis might cause weird problems with some software.\n' % (ca.certificate,subject_attr))
else:
sys.stderr.write('Certificate file %s or %s not found.\n' % (ca.certificate,parentca.certificate))
pyca-20031118/sbin/ca-cycle-priv.py 0100755 0000764 0000144 00000016416 07310470205 016211 0 ustar michael users #!/usr/bin/python
########################################################################
# ca-cycle-priv.py
# (c) by Michael Stroeder, michael@stroeder.com
########################################################################
__version__ = '0.6.6'
########################################################################
# Process some modifications which involve private CA keys.
# This script is typically run by CRON or in a similar manner.
# It does several jobs:
# - Mark expired certificates in OpenSSL certificate database
# - Process certificate requests
# - Process certificate revocation requests
# - Generate new CRLs, move old CRLs to archive
# Special notes:
# The private systems only handles PEM format certificate data
########################################################################
import sys, string, os, stat, time, getopt
def filenotvalid(pathname):
return not os.path.isfile(pathname) or os.stat(pathname)[stat.ST_SIZE]==0
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
--config=[pathname]
Pathname of OpenSSL configuration file.
You may also use env variable OPENSSL_CONF.
Default: /etc/openssl/openssl.cnf
--pycalib=[directory]
Specify directory containing the pyCA modules
Default: /usr/local/pyca/pylib
--issuecrls
Force issuing of new CRLs
Default: CRLs are only created if no valid CRL is present
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
########################################################################
# Main
########################################################################
script_name=sys.argv[0]
try:
options,args=getopt.getopt(sys.argv[1:],'h',['help','config=','pycalib=','issuecrls'])
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage()
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
PrintUsage('Config file %s not found.' % (opensslcnfname))
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
issuecrls = findoption(options,'--issuecrls')!=()
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
PrintUsage('Module directory %s not exists or not a directory.' % (pycalib))
sys.path.append(pycalib)
try:
import openssl
except ImportError:
PrintUsage('Required pyCA modules not found in directory %s!' % (pycalib))
# Read the configuration file
if os.path.isfile('%s.pickle' % (opensslcnfname)):
# Try to read OpenSSL's config file from a pickled copy
f=open('%s.pickle' % (opensslcnfname),'rb')
try:
# first try to use the faster cPickle module
from cPickle import load
except ImportError:
from pickle import load
opensslcnf=load(f)
f.close()
else:
# Parse OpenSSL's config file from source
opensslcnf=openssl.cnf.OpenSSLConfigClass(opensslcnfname)
pyca_section = opensslcnf.data.get('pyca',{})
openssl.bin_filename = pyca_section.get('OpenSSLExec','/usr/local/ssl/bin/openssl')
if not os.path.isfile(openssl.bin_filename):
PrintUsage('Did not find OpenSSL executable %s.' % (openssl.bin_filename))
ca_names = opensslcnf.sectionkeys.get('ca',[])
gmt = time.time()
gmtstr = time.strftime('%Y%m%d%H%M%S',time.gmtime(gmt))
######################################################################
# Spool certificates and certificate revocation lists
# from system holding the private keys
######################################################################
pass
######################################################################
# CA specific actions
######################################################################
ca_names = opensslcnf.sectionkeys.get('ca',[])
# Lists of processed files and dirs to avoid double-processing
processed_ca_databases = []
processed_ca_crls = []
processed_pend_reqs_dirs = []
processed_new_certs_dirs = []
for ca_name in ca_names:
sys.stdout.write("""
#############################################################
# Processing CA "%s"
#############################################################\n\n
""" % (ca_name))
ca = opensslcnf.getcadata(ca_name)
########################################################################
# Processing certificate database
########################################################################
if not ca.database in processed_ca_databases:
if os.path.isfile(ca.database):
processed_ca_databases.append(ca.database)
# Certificate database not processed up to now
ca_db = openssl.db.OpenSSLcaDatabaseClass(ca.database)
# Mark expired certificates in OpenSSL certificate database
ca_db.Expire()
else:
sys.stderr.write('Warning: CA database file %s not found.\n' % (ca.database))
########################################################################
# Process certificate requests
########################################################################
pass
########################################################################
# Process certificate revocation requests
########################################################################
pass
########################################################################
# Generate new CRLs, move old CRLs to archive
########################################################################
sys.stdout.write("""
#############################################################
# Move expired CRLs to archive and generate new CRLs
#############################################################\n
Use password of each CA here.\n
""")
if not ca.crl in processed_ca_crls:
if os.path.isfile(ca.crl):
processed_ca_crls.append(ca.crl)
ca_crl = openssl.cert.CRLClass(ca.crl)
if issuecrls or (ca_crl.nextUpdate_secs<=gmt+ca.crl_treshold*3600):
# CRL is expired => move it to archive
ca_archived_crl = os.path.join(ca.crl_dir,os.path.basename('%s-%s.pem' % (os.path.splitext(ca.crl)[0],gmtstr)))
os.rename(ca.crl,ca_archived_crl)
sys.stdout.write('Archived expired CRL file %s.\n' % (ca.crl))
if filenotvalid(ca.crl):
if os.path.isfile(ca.certificate) and os.path.isfile(ca.private_key):
if os.path.isfile(ca.database):
sys.stdout.write('Issuing new CRL %s.\n' % (ca.crl))
rc = os.system('%s ca -config %s -name %s -gencrl -out %s' % \
(openssl.bin_filename,opensslcnfname,ca.sectionname,ca.crl))
if rc:
sys.stderr.write('Error %d creating CRL %s.\n' % (rc,ca.crl))
else:
sys.stderr.write('Warning: CA database file %s not found.\n' % (ca.database))
else:
sys.stderr.write('CA cert %s or CA key %s missing.\n' % (ca.certificate,ca.private_key))
if filenotvalid(ca.crl):
sys.stderr.write('Warning: No valid CRL file %s after processing.\n' % (ca.crl))
pyca-20031118/sbin/ca-cycle-pub.py 0100755 0000764 0000144 00000032056 07310433641 016020 0 ustar michael users #!/usr/bin/python
########################################################################
# ca-cycle-pub.py
# (c) by Michael Stroeder, michael@stroeder.com
########################################################################
__version__ = '0.6.6'
########################################################################
# This script is typically run by CRON or a similar task manager.
# It does several jobs (some not implemented yet):
# - Mark expired certificates in OpenSSL certificate database
# - Sort in new certificates and inform user via e-mail where to
# download his certificate
# - Spool certificate requests and certificate revocation requests
# - Remove stale certificate requests from caPendCertReqDir
########################################################################
import sys, string, os, smtplib, getopt
from time import time,gmtime,localtime,strftime,mktime
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
--config=[pathname]
Pathname of OpenSSL configuration file.
You may also use env variable OPENSSL_CONF.
Default: /etc/openssl/openssl.cnf
--pycalib=[directory]
Specify directory containing the pyCA modules
Default: /usr/local/pyca/pylib
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
########################################################################
# Main
########################################################################
script_name=sys.argv[0]
try:
options,args=getopt.getopt(sys.argv[1:],'h',['help','config=','pycalib='])
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage()
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
PrintUsage('Config file %s not found.' % (opensslcnfname))
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
PrintUsage('Module directory %s not exists or not a directory.' % (pycalib))
sys.path.append(pycalib)
try:
import openssl,charset
from openssl.db import \
empty_DN_dict, \
DB_type,DB_exp_date,DB_rev_date,DB_serial,DB_file,DB_name,DB_number, \
DB_TYPE_REV,DB_TYPE_EXP,DB_TYPE_VAL, \
dbtime2tuple,GetEntriesbyDN,SplitDN
except ImportError:
PrintUsage('Required pyCA modules not found in directory %s!' % (pycalib))
# Read the configuration file
if os.path.isfile('%s.pickle' % (opensslcnfname)):
# Try to read OpenSSL's config file from a pickled copy
f=open('%s.pickle' % (opensslcnfname),'rb')
try:
# first try to use the faster cPickle module
from cPickle import load
except ImportError:
from pickle import load
opensslcnf=load(f)
f.close()
else:
# Parse OpenSSL's config file from source
opensslcnf=openssl.cnf.OpenSSLConfigClass(opensslcnfname)
pyca_section = opensslcnf.data.get('pyca',{})
openssl.bin_filename = pyca_section.get('OpenSSLExec','/usr/local/ssl/bin/openssl')
if not os.path.isfile(openssl.bin_filename):
PrintUsage('Did not find OpenSSL executable %s.' % (openssl.bin_filename))
MailRelay = pyca_section.get('MailRelay','localhost')
nsGetCertUrl = pyca_section.get('nsGetCertUrl','cgi-bin/get-cert.py')
nsViewCertUrl = pyca_section.get('nsViewCertUrl','cgi-bin/view-cert.py')
caPendCertReqValid = 3600*string.atoi(pyca_section.get('caPendCertReqValid','0'))
newcert_mailtext = r"""From: %s
To: %s
Subject: Your certificate %d
The certificate you requested has been issued and is valid
from %s until %s.
You can retrieve your certificate from here:
%s%s/%s/%s.crt?%x
Please use the same web browser on the same machine, with same
login and configuration data as when you created the certificate
request. Otherwise your software will likely refuse to install
the certificate.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
! It is highly recommended to make a backup copy of your !
! private key and certificate right after installing it. !
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
If you have further questions simply reply to this e-mail.
----------------------------------------------------------
%s
Detail view of your certificate:
%s%s/%s/%s?%x
"""
gmt = time()
gmtstr = strftime('%Y%m%d%H%M%S',gmtime(gmt))
######################################################################
# Spool certificates and certificate revocation lists
# from system holding the private keys
######################################################################
pass
######################################################################
# CA specific actions
######################################################################
ca_names = opensslcnf.sectionkeys.get('ca',[])
# Lists of processed files and dirs to avoid double-processing
processed_ca_databases = []
processed_ca_crls = []
processed_pend_reqs_dirs = []
processed_new_reqs_dirs = []
processed_new_certs_dirs = []
for ca_name in ca_names:
sys.stdout.write('\n\nProcessing certificate authority "%s"\n' % (ca_name))
ca = opensslcnf.getcadata(ca_name)
######################################################################
# Processing certificate database
######################################################################
if not ca.database in processed_ca_databases:
if os.path.isfile(ca.database):
processed_ca_databases.append(ca.database)
# Certificate database not processed up to now
ca_db = openssl.db.OpenSSLcaDatabaseClass(ca.database)
# Mark expired certificates in OpenSSL certificate database
expired_db_entries = ca_db.Expire()
if expired_db_entries:
sys.stdout.write('The following entries were marked as expired:\n')
for db_entry in expired_db_entries:
sys.stdout.write('%s\n' % (charset.asn12iso(db_entry[DB_name])))
# Mark expired certificates in OpenSSL certificate database
expire_treshold=7*86400
expired_db_entries = ca_db.ExpireWarning(expire_treshold)
if expired_db_entries:
sys.stdout.write('The following entries will expire soon:\n')
for db_entry in expired_db_entries:
sys.stdout.write('%s, %s, %s\n' % (
db_entry[DB_serial],
strftime('%Y-%m-%d %H:%M',localtime(mktime(dbtime2tuple(db_entry[DB_exp_date])))),
charset.asn12iso(db_entry[DB_name])
)
)
else:
sys.stderr.write('Warning: CA database file %s not found.\n' % (ca.database))
######################################################################
# Move expired CRLs to archive
######################################################################
if not ca.crl in processed_ca_crls:
if os.path.isfile(ca.crl):
processed_ca_crls.append(ca.crl)
ca_crl = openssl.cert.CRLClass(ca.crl)
if ca_crl.nextUpdate_secs os.path.getmtime(reqpathname):
os.remove(reqpathname)
stalecerts = stalecerts+1
if stalecerts:
sys.stdout.write('Removed %d stale certificate requests from %s.\n' % (stalecerts,ca.pend_reqs_dir))
else:
pendcertfilenames = []
sys.stderr.write('Directory %s not found!\n' % (ca.pend_reqs_dir))
######################################################################
# New certificate requests
######################################################################
if ca.new_reqs_dir and \
(not ca.new_reqs_dir in processed_new_reqs_dirs):
processed_new_reqs_dirs.append(ca.new_reqs_dir)
# new_certs_dir not processed up to now
if os.path.isdir(ca.new_reqs_dir):
newreqfilenames = os.listdir(ca.new_reqs_dir)
newreqcounter = 0
for reqfilename in newreqfilenames:
if os.path.splitext(reqfilename)[1] in ['.spkac','.pem']:
newreqcounter = newreqcounter+1
if newreqcounter:
sys.stdout.write('%d valid certificate requests in %s.\n' % (newreqcounter,ca.new_reqs_dir))
else:
newcertfilenames = []
sys.stderr.write('Directory %s not found!\n' % (ca.new_reqs_dir))
######################################################################
# Publish new client certificates and inform user via e-mail where to
# download his certificate
######################################################################
if (not ca.new_certs_dir in processed_new_certs_dirs) and \
os.path.isfile(ca.certificate):
processed_new_certs_dirs.append(ca.new_certs_dir)
# new_certs_dir not processed up to now
newcertfilenames = os.listdir(ca.new_certs_dir)
if newcertfilenames:
sys.stdout.write('Publish %d new certificates in %s.\n' % (len(newcertfilenames),ca.new_certs_dir))
if ca.isservercert():
certtype = 'server'
elif ca.isclientcert():
certtype = 'user'
else:
certtype = 'user'
for certfilename in newcertfilenames:
newcertpathname = os.path.join(ca.new_certs_dir,certfilename)
cert = openssl.cert.X509CertificateClass(newcertpathname)
if openssl.db.GetEntrybySerial(ca.database,cert.serial):
certpathname = os.path.join(ca.certs,certfilename)
if not os.path.isfile(certpathname):
import mimify
issuername = charset.asn12iso(cert.issuer.get('CN',''))
issueremail = cert.issuer.get('Email','root@localhost')
subjectname = charset.asn12iso(cert.subject.get('CN',''))
subjectemail = cert.subject.get('Email','')
from_addr = mimify.mime_encode_header('%s <%s>' % (issuername,issueremail))
if subjectemail:
to_name,to_email = subjectname,subjectemail
else:
to_name,to_email = issuername,issueremail
to_addr = mimify.mime_encode_header('%s <%s>' % (to_name,to_email))
# Mailbody
mail_msg = newcert_mailtext % (
from_addr,
to_addr,
cert.serial,
strftime('%Y-%m-%d %H:%M',gmtime(cert.notBefore_secs)),
strftime('%Y-%m-%d %H:%M',gmtime(cert.notAfter_secs)),
ca.nsBaseUrl,nsGetCertUrl,ca_name,certtype,cert.serial,
cert.asciiprint(),
ca.nsBaseUrl,nsViewCertUrl,ca_name,certtype,cert.serial,
)
smtpconn=smtplib.SMTP(MailRelay)
smtpconn.set_debuglevel(0)
try:
smtpconn.sendmail(issueremail,to_email,mail_msg)
sys.stderr.write('Sent e-mail to %s <%s>.\n' % (to_name,to_email))
except:
sys.stderr.write('Unable to send an e-mail to %s <%s>.\n' % (to_name,to_email))
smtpconn.quit()
# Move file from newcerts to certs dir
os.rename(newcertpathname,certpathname)
else:
sys.stderr.write('Target file %s already exists. Maybe something went wrong?\n' % (certfilename))
else:
sys.stderr.write('Did not find certificate with serial number %d in file %s! Certificate database up to date?\n' % (cert.serial,ca.database))
######################################################################
# Spool certificate requests and certificate revocation requests
# to system holding the private keys
######################################################################
pass
######################################################################
# Check again if everything is in place and give out summary report
######################################################################
sys.stdout.write('\n\n##### Summary report #####\n\n')
for ca_name in ca_names:
ca = opensslcnf.getcadata(ca_name)
sys.stdout.write('CA definition "%s":\n' % (ca_name))
if not os.path.isfile(ca.crl):
sys.stderr.write('Warning: No valid CRL file %s after processing.\n' % (ca.crl))
else:
ca_crl = openssl.cert.CRLClass(ca.crl)
sys.stdout.write('CRL file %s valid from %s until %s.\n' % (ca.crl,ca_crl.lastUpdate,ca_crl.nextUpdate))
pyca-20031118/sbin/ca-certreq-mail.py 0100755 0000764 0000144 00000020562 07745153414 016532 0 ustar michael users #!/usr/bin/python
"""
ca-certreq-mail.py
(c) by Michael Stroeder, michael@stroeder.com
This script is intended to handle the confirmation mail for a
cert request.
It receives the mail on stdin and moves the certificate request file
from pend_reqs_dir to new_reqs_dir. If the senders from:
address is different of the one in the certificate request the sender
is notified about this by e-mail.
If an error occurs the exit code is still zero to prevent the
mail system from generating a bounce revealing internal informations.
"""
__version__ = '0.6.6'
import sys, os, shutil, time, string, smtplib, rfc822, getopt
from mimify import mime_decode_header, mime_encode_header
# Einen Datensatz in Protokolldatei schreiben
# log Filehandle von bereits geoeffneter Protokolldatei
# Kategorie des Eintrags, z.B. 'Error:'
# Mail Mailheader
# Kommentar klar
def LogWrite(log,Kategorie,Mail,Kommentar):
log.write('%s %s: ' % (time.strftime('%d.%m.%Y %X',time.localtime(time.time())),Kategorie))
if Mail:
for i in ['from','subject','message-id']:
if Mail.has_key(i):
log.write('%s ' % (Mail[i]))
log.write('%s\n' % (Kommentar))
return
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
########################################################################
# Main
########################################################################
script_name=sys.argv[0]
# The log file can only be stderr as long as the config is not read
logfile = sys.stderr
# Parse command-line options
try:
options,args=getopt.getopt(sys.argv[1:],'h',['help','config=','pycalib='])
except getopt.error,e:
LogWrite(logfile,'Error',None,str(e))
# Try to find modules directory
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
LogWrite(logfile,'Error',None,'Module directory %s not exists or not a directory.' % (pycalib))
sys.path.append(pycalib)
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
LogWrite(logfile,'Error',None,'Config file %s not found.' % (opensslcnfname))
import openssl,charset
from openssl.db import \
empty_DN_dict, \
DB_type,DB_exp_date,DB_rev_date,DB_serial,DB_file,DB_name,DB_number, \
DB_TYPE_REV,DB_TYPE_EXP,DB_TYPE_VAL, \
dbtime2tuple,GetEntriesbyDN,SplitDN
# Read the configuration file
if os.path.isfile('%s.pickle' % (opensslcnfname)):
# Try to read OpenSSL's config file from a pickled copy
f=open('%s.pickle' % (opensslcnfname),'rb')
try:
# first try to use the faster cPickle module
from cPickle import load
except ImportError:
from pickle import load
opensslcnf=load(f)
f.close()
else:
# Parse OpenSSL's config file from source
opensslcnf=openssl.cnf.OpenSSLConfigClass(opensslcnfname)
pyca_section = opensslcnf.data.get('pyca',{})
logfile_name = pyca_section.get('caCertConfirmReqLog','/var/log/pyca/ca-certreq-mail.out')
logfile = open(logfile_name,'a')
openssl.bin_filename = pyca_section.get('OpenSSLExec','/usr/local/ssl/bin/openssl')
if not os.path.isfile(openssl.bin_filename):
LogWrite(logfile,'Error',None,'Did not find OpenSSL executable %s.' % (openssl.bin_filename))
ca_names = opensslcnf.sectionkeys.get('ca',[])
MailRelay = pyca_section.get('MailRelay','localhost')
caCertReqMailAdr = pyca_section.get('caCertReqMailAdr','')
caInternalCertTypes = pyca_section.get('caInternalCertTypes',[])
caInternalDomains = pyca_section.get('caInternalDomains','')
if type(caInternalDomains)!=type([]):
caInternalDomains = [caInternalDomains]
#############################################################
# Hauptprogramm
#############################################################
m=rfc822.Message(sys.stdin)
#############################################################
# Format von Subject und Body ueberpruefen
# Wirkt recht paranoid, soll aber gegen Muellmails schuetzen
#############################################################
# Ueberlange Subjects verbieten
if len(m["subject"])>80:
LogWrite(logfile,'Error',m,'Subject too long.')
sys.exit(0)
if m.has_key('from'):
from_addr = mime_decode_header(string.strip(m["from"]))
from_name, from_mail = rfc822.AddressList(from_addr).addresslist[0]
else:
from_mail = ''
subject = string.strip(m["subject"])
subjectstart = string.find(subject,'cert-req-')
# Format dreiteilig?
try:
prefix,ca_name,caChallengeId = string.split(subject[subjectstart:len(subject)],'.',2)
except ValueError:
LogWrite(logfile,'Error',m,'Subject has wrong format.')
sys.exit(0)
# Prefix richtig?
if prefix=='cert-req-SPKAC':
request_filenamesuffix = 'spkac'
elif prefix=='cert-req-PKCS10':
request_filenamesuffix = 'pem'
else:
LogWrite(logfile,'Error',m,'Subject has wrong format.')
sys.exit(0)
# ChallengeID nicht zu lang?
if len(caChallengeId)>30:
LogWrite(logfile,'Error',m,'caChallengeId %s has bad format.' % (caChallengeId))
sys.exit(0)
# CA Name gueltig?
if not (ca_name in ca_names):
LogWrite(logfile,'Error',m,'ca_name "%s" wrong.' % (ca_name))
sys.exit(0)
ca = opensslcnf.getcadata(ca_name)
# Eine Benutzerantwort ist eingetroffen
request_filename = os.path.join(ca.pend_reqs_dir,'%s.%s.%s' % (prefix,ca_name,caChallengeId))
pubkey_filename = '%s.%s' % (request_filename,request_filenamesuffix)
# Existieren die benoetigten Dateien?
if not os.path.isfile(pubkey_filename):
LogWrite(logfile,'Error',m,'Certificate request file %s not found.' % (pubkey_filename))
sys.exit(0)
# Hier sind jetzt alle Angaben gueltig, soweit pruefbar
newrequest_filename = os.path.join(ca.new_reqs_dir,'%s.%s.%s' % (prefix,ca_name,caChallengeId))
target_pubkey_filename = '%s.%s' % (newrequest_filename,request_filenamesuffix)
# Now copy files to target directory, use copy to get new ownership
try:
shutil.copyfile(pubkey_filename,target_pubkey_filename)
os.chmod(target_pubkey_filename,0440)
except IOError:
LogWrite(logfile,'Error',m,'Copying %s to %s failed.' % (pubkey_filename,target_pubkey_filename))
sys.exit(0)
else:
try:
os.remove(pubkey_filename)
except IOError:
LogWrite(logfile,'Error',m,'Removing %s failed.' % (pubkey_filename))
sys.exit(0)
LogWrite(logfile,'Challenge',m,'Request challenge: %s Id=%s' % (ca_name,caChallengeId))
# FIX ME! We also would like to look into PKCS10 requests!
if prefix!='cert-req-SPKAC':
sys.exit(0)
# Read the certificate request file
certreq = openssl.cert.SPKACClass(target_pubkey_filename)
certreq_name_attr = certreq.data.get('commonName','')
certreq_mail_attr = certreq.data.get('emailAddress','')
if (certreq_name_attr and from_name!=certreq_name_attr) or \
(certreq_mail_attr and from_mail!=certreq_mail_attr):
cacert = openssl.cert.X509CertificateClass(ca.certificate)
ca_from_addr = cacert.subject.get('Email',pyca_section.get('caAdminMailAdr',''))
mail_msg = """From: %s <%s>
To: %s
Subject: Your confirmation e-mail with ID %s
We received the correct confirmation e-mail for your
certificate request.
However the from: field of your confirmation e-mail
From: %s
did not match the attributes
commonName = %s
emailAddress = %s
given in your certificate request. Your certificate request will
be processed anyway. But if you intend to use the requested
certificate for signing e-mails you might want to adjust the from
address in your mail clients preferences / options menu to avoid
trouble with other mail users reporting invalid signatures.
If you have further questions simply reply to this e-mail.
""" % (
mime_encode_header(
charset.t612iso(
cacert.subject.get('CN','CA administrator'))
),
ca_from_addr,
certreq_mail_attr,
caChallengeId,
from_addr,
certreq_name_attr,certreq_mail_attr
)
try:
smtpconn=smtplib.SMTP(MailRelay)
try:
try:
smtpconn.set_debuglevel(0)
smtpconn.sendmail(ca_from_addr,certreq_mail_attr,mail_msg)
finally:
smtpconn.quit()
except:
LogWrite(logfile,'Error',m,'Unable to send an e-mail to %s!\n' % (certreq_mail_attr))
else:
LogWrite(logfile,'Error',m,'Sent from address warning to %s!\n' % (certreq_mail_attr))
except socket.error:
LogWrite(logfile,'Error',m,'Unable to contact default mail relay %s!\n' % (MailRelay))
sys.exit(0)
pyca-20031118/sbin/pickle-cnf.py 0100755 0000764 0000144 00000005503 07301173261 015563 0 ustar michael users #!/usr/bin/python
########################################################################
# pickle-cnf.py
# (c) by Michael Stroeder, michael@stroeder.com
########################################################################
__version__ = '0.6.6'
########################################################################
# This short script creates a pickled object file of the
# OpenSSL configuration file.
########################################################################
import sys, string, os, pickle, getopt
def findoption(options,paramname):
for i in options:
if i[0]==paramname:
return i
return ()
def PrintUsage(ErrorMsg='',ErrorCode=1):
script_name = string.split(sys.argv[0],os.sep)[-1]
sys.stderr.write("""*** %s *** (C) by Michael Stroeder, 1999
usage: %s [options]
Options:
-h or --help
Print out this message
--config=[pathname]
Pathname of OpenSSL configuration file.
You may also use env variable OPENSSL_CONF.
Default: /etc/openssl/openssl.cnf
--pycalib=[directory]
Specify directory containing the pyCA modules
You may also use env variable PYCALIB.
Default: /usr/local/pyca/pylib
""" % (script_name,script_name))
if ErrorMsg:
sys.stderr.write('Error: %s\n' % ErrorMsg)
sys.exit(ErrorCode)
########################################################################
# Main
########################################################################
script_name=sys.argv[0]
try:
options,args=getopt.getopt(sys.argv[1:],'h',['help','config=','pycalib='])
except getopt.error,e:
PrintUsage(str(e))
if findoption(options,'-h')!=() or findoption(options,'--help')!=():
PrintUsage()
if findoption(options,'--config')!=():
opensslcnfname = findoption(options,'--config')[1]
else:
opensslcnfname = os.environ.get('OPENSSL_CONF','/etc/openssl/openssl.cnf')
if not os.path.isfile(opensslcnfname):
PrintUsage('Config file %s not found.' % (opensslcnfname))
if findoption(options,'--pycalib')!=():
pycalib = findoption(options,'--pycalib')[1]
else:
pycalib = os.environ.get('PYCALIB','/usr/local/pyca/pylib')
if not os.path.exists(pycalib) or not os.path.isdir(pycalib):
PrintUsage('Module directory %s not exists or not a directory.' % (pycalib))
sys.path.append(pycalib)
try:
import openssl
except ImportError:
PrintUsage('Module openssl not found in directory %s!' % (pycalib))
print 'Reading source file %s...' % (opensslcnfname)
opensslcnf = openssl.cnf.OpenSSLConfigClass(opensslcnfname)
pickle_opensslcnfname = '%s.pickle' % (opensslcnfname)
#if os.path.isfile(pickle_opensslcnfname):
# print 'Removing old pickle file %s' % (pickle_opensslcnfname)
# os.remove(pickle_opensslcnfname)
print 'Write new pickled file %s...' % (pickle_opensslcnfname)
f=open(pickle_opensslcnfname,'wb')
pickle.dump(opensslcnf, f,1)
f.close()
pyca-20031118/pylib/ 0040755 0000764 0000144 00000000000 07756443113 013371 5 ustar michael users pyca-20031118/pylib/ipadr.py 0100644 0000764 0000144 00000001476 07005664045 015043 0 ustar michael users import string
# IP-Adresse in Stringform zu 4er-Tupel konvertieren
def ipadrstr2tuple(IPAdrStr=''):
return map(string.atoi,string.split(IPAdrStr,'.',3))
# IP-Adresse mit Netzwerkadresse/Netzwerkmaske vergleichen
def MatchIPAdr(IPAdress,NetworkAdress,Mask):
IPAdressT=ipadrstr2tuple(IPAdress)
MaskT=ipadrstr2tuple(Mask)
NetworkAdressT=ipadrstr2tuple(NetworkAdress)
return (IPAdressT[0]&MaskT[0] == NetworkAdressT[0]&MaskT[0]) and \
(IPAdressT[1]&MaskT[1] == NetworkAdressT[1]&MaskT[1]) and \
(IPAdressT[2]&MaskT[2] == NetworkAdressT[2]&MaskT[2]) and \
(IPAdressT[3]&MaskT[3] == NetworkAdressT[3]&MaskT[3])
def MatchIPAdrList(IPAdr,subnetlist):
if IPAdr and subnetlist:
for subnet in subnetlist:
net, mask = string.split(subnet,'/',1)
if MatchIPAdr(IPAdr,net,mask):
return 1
return 0
pyca-20031118/pylib/ldapbase.py 0100644 0000764 0000144 00000006046 07025154247 015515 0 ustar michael users ##############################################################################
# ldapbase.py Version 0.1.2
# (c) by Michael Stroeder, michael.stroeder@propack-data.de
##############################################################################
import sys, string, re
dn_pattern = r'([\w;.]+[\s]*=[^,]+)(,[ ]*[\w;.]+[\s]*=[^,]+)*'
dn_regex = re.compile(dn_pattern)
# returns 1 if s is a LDAP DN
def is_dn(s):
rm = dn_regex.match(s)
return rm!=None and rm.group(0)==s
def normalize_dn(dn):
result = string.split(dn,',')
result = map(string.strip,result)
return string.join(result,',')
# returns parent-DN of dn
def ParentDN(dn):
return string.join(string.split(dn,',')[1:],',')
# returns a list of parent-DNs of dn
def ParentDNList(dn):
result = []
DNComponentList = string.split(dn,',')
for i in range(1,len(DNComponentList)):
result.append(string.join(DNComponentList[i:],','))
return result
# parse a LDAP URL and return (host,dn,attributes,scope,filter)
# host LDAP host
# dn distinguished name
# attributes list with attributes
# scope search scope string
# filter LDAP search filter
def parse_ldap_url(ldap_url):
dummy,rest = string.split(ldap_url,'://',1)
try:
host,rest = string.split(rest,'/',1)
except ValueError:
host='' ; dn=rest
paramlist=string.split(rest,'?')
dn = paramlist[0]
try:
attributes = string.split(paramlist[1],',')
except IndexError:
attributes = []
try:
scope = paramlist[2]
except IndexError:
scope = ''
try:
filter = paramlist[3]
except IndexError:
filter = ''
return (host,dn,attributes,scope,filter)
class Attribute:
def __init__(self):
self.name=''
def put(self,name,oid='',syntax='',alias=[],notes=''):
self.name=name
self.oid=oid
self.alias=alias
self.notes=notes
def parse(self,attr_schemastr):
pass
class ObjectClass:
def __init__(self):
self.name=''
def put(self,name,oid='',syntax='',sup='',must=[],may=[],notes=''):
self.name=name
self.oid=oid
self.abstract=abstract
self.sup=sup
self.must=must
self.may=may
self.syntax=syntax
self.notes=notes
def parse(self,oc_schemastr):
pass
class Schema:
def __init__(self,host):
self.host=host
self.oc_def = {}
self.oc_list = []
self.attr_def = {}
self.attr_list = []
def AddObjectClass(self,name,oid='',sup='',must=['objectClass'],may=[],syntax='',notes=''):
if not name in self.oc_list:
self.oc_list.append(name)
self.oc_def['name']=ObjectClass()
self.oc_def['name'].put(name,oid,sup,must,may,syntax,notes)
def AddAttribute(self,name,oid='',syntax='',alias=[],notes=''):
if not name in self.attr_list:
self.attr_list.append(name)
self.attr_def['name']=Attribute()
self.attr_def['name'].put(name,oid,syntax,alias,notes)
def v3SchemaQuery(self,ldapconn,basedn='cn=schema',searchfilter='objectclass=subschema'):
schema = ldapconn.search_s()
def ReadOpenLDAPConf(self,slapdconf):
f = open(slapdconf,'r')
pyca-20031118/pylib/ldif.py 0100644 0000764 0000144 00000010777 07156165370 014672 0 ustar michael users """
ldif.py - Various routines for handling LDIF data
This module is distributed under the terms of the
GPL (GNU GENERAL PUBLIC LICENSE) Version 2
(see http://www.gnu.org/copyleft/gpl.html)
"""
__version__ = '0.2.5'
import sys,string,binascii,re
try:
from cStringIO import StringIO
except ImportError:
from StringIO import StringIO
attr_pattern = r'[\w;.]+(;[\w_-]+)*'
data_pattern = '([^,]+|".*?")'
rdn_pattern = attr_pattern + r'[\s]*=[\s]*' + data_pattern
dn_pattern = rdn_pattern + r'([\s]*,[\s]*' + rdn_pattern + r')*'
#rdn_regex = re.compile('^%s$' % rdn_pattern)
dn_regex = re.compile('^%s$' % dn_pattern)
ldif_pattern = '^((dn(:|::) %(dn_pattern)s)|(%(attr_pattern)s(:|::) %(data_pattern)s)$)+' % vars()
ldif_regex = re.compile('^%s$' % ldif_pattern,re.M)
def is_dn(s):
"""
returns 1 if s is a LDAP DN
"""
rm = dn_regex.match(s)
return rm!=None and rm.group(0)==s
def is_ascii(s):
"""
returns 1 if s is plain ASCII
"""
if s:
pos=0 ; s_len = len(s)
while ((ord(s[pos]) & 0x80) == 0) and (pos binary data assumed
data = data[1:]
binary = 1
else:
# Read attr: data line
binary = 0
s = f.readline()
s = string.rstrip(s)
# Reading continued multi-line data
while s and s[0]==' ':
data = data + string.strip(s)
# Read next line
s = f.readline()
s = string.rstrip(s)
attr = string.lower(string.strip(attr))
if not attr in ignored_attrs:
if binary:
# binary data has to be BASE64 decoded
data = binascii.a2b_base64(data)
else:
data = string.strip(data)
# Add attr: data to entry
if attr=='dn':
dn = string.strip(data) ; attr = '' ; data = ''
if not is_dn(dn):
raise ValueError, 'No valid string-representation of distinguished name.'
else:
if entry.has_key(attr):
entry[attr].append(data)
else:
entry[attr]=[data]
# end of entry reached marked by newline character(s)
if entry:
# append entry to result list
result.append((dn,entry))
entries_read = entries_read+1
# Start reading next entry
s = f.readline()
return result
pyca-20031118/pylib/cgihelper.py 0100644 0000764 0000144 00000004451 07047337543 015710 0 ustar michael users ##############################################################################
# cgihelper.py Version 0.1.4
# (c) by Michael Stroeder, michael.stroeder@propack-data.de
##############################################################################
# Misc. stuff useful in CGI-BINs
##############################################################################
import sys, os, string, re
known_browsers = {
'MSIE':'Microsoft Internet Explorer',
'Mozilla':'Netscape Navigator',
'Lynx':'Lynx',
'Opera':'Opera',
'StarOffice':'StarOffice',
'NCSA_Mosaic':'NCSA Mosaic',
'NetPositive':'Net Positive'
}
known_browsers_rev = {}
for b in known_browsers.keys():
known_browsers_rev[known_browsers[b]]=b
compatible_browsers = known_browsers.keys()
compatible_browsers.remove('Mozilla')
compatible_browsers_re = re.compile('(%s)[/ ]+([0-9.]*)' % string.join(compatible_browsers,'|'))
mozilla_re = re.compile('(Mozilla)[/ ]+([0-9.]*)')
# This function trys to parse the HTTP_USER_AGENT environment variable
# set in CGI-BINs and returns the tuple (Browser,Version). I am not sure
# if this succeeds in every situation since most browsers have very obscure
# HTTP_USER_AGENT entries for compability reasons.
# The following browsers are known by name:
# Netscape Netscape Navigator, Netscape Communicator)
# MSIE MS Internet Explorer
# Opera Opera browser from http://www.operasoftware.com/
# StarOffice built-in browser of Star Office
# Lynx the text-based browser Lynx
# NetPositive Net Positive (BeOS)
def BrowserType(http_user_agent):
if not http_user_agent:
return ('','')
else:
browserrm = compatible_browsers_re.search(http_user_agent)
if browserrm:
return browserrm.groups()
else:
browserrm = mozilla_re.search(http_user_agent)
if browserrm:
return browserrm.groups()
else:
return ('','')
# Main
# Read and parse some CGI-BIN environment variables
http_user_agent = os.environ.get('HTTP_USER_AGENT','')
if http_user_agent:
http_user_agent_type,http_user_agent_version = BrowserType(http_user_agent)
script_name = os.environ.get('SCRIPT_NAME','')
request_method = os.environ.get('REQUEST_METHOD')
remote_addr = os.environ.get('REMOTE_ADDR')
path_info = os.environ.get('PATH_INFO','')
pyca-20031118/pylib/charset.py 0100644 0000764 0000144 00000011746 07534626353 015405 0 ustar michael users """
charset.py - Module for converting characters sets
(c) by Michael Stroeder
This module is distributed under the terms of the
GPL (GNU GENERAL PUBLIC LICENSE) Version 2
(see http://www.gnu.org/copyleft/gpl.html)
"""
__version__ = '0.4.1'
import sys, string
# Alphabet for encrypted passwords (see module crypt)
crypt_alphabet = './0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
crypt_alphabet_len = len(crypt_alphabet)
def is_ascii(s):
"""
returns 1 if s is plain ASCII
"""
if s:
pos=0 ; s_len = len(s)
while ((ord(s[pos]) & 0x80) == 0) and (pos> 6)))+chr(0x80 | (0x3F & c))
return new
UTF8len= ( 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
2, 2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 5, 6 )
UTF8mask = (0x3F,0x7F,0x1F,0x0F,0x07,0x03,0x01)
def utf2iso(s):
"""
Convert UTF-8 encoded Unicode to ISO-8859-1
"""
new = ''
ind = 0
slen = len(s)
while ind < slen:
c=ord(s[ind])
ind = ind+1
clen = UTF8len[(c >> 2) & 0x3F]
u = c & UTF8mask[clen]
if clen==0:
clen = 4
else:
clen = clen-1
while clen and ind < slen:
c=ord(s[ind])
ind = ind+1
if (c & 0xC0) == 0x80:
u = (u << 6) | (c & 0x3F)
else:
ind = ind-1
break
clen = clen-1
if (u <= 0xFF):
new = new+chr(u)
else:
new = new+'?'
return new
def utf2html4(s):
"""
Convert UTF-8 encoded Unicode to HTML-4 character representation
"""
new = ''
ind = 0
slen = len(s)
while ind < slen:
c=ord(s[ind])
ind = ind+1
clen = UTF8len[(c >> 2) & 0x3F]
u = c & UTF8mask[clen]
if clen==0:
clen = 4
else:
clen = clen-1
while clen and ind < slen:
c=ord(s[ind])
ind = ind+1
if (c & 0xC0) == 0x80:
u = (u << 6) | (c & 0x3F)
else:
ind = ind-1
break
clen = clen-1
if u<128:
new = new + chr(u)
else:
new = new + '&#%d;' % u
return new
def iso2html4(s):
"""
Convert ISO-8859-1 to HTML-4 character representation
"""
new = ''
for ch in s:
c=ord(ch)
if (c & 0x80)==0:
new = new + ch
else:
new = new + '&#%d;' % (c)
return new
def iso2t61(s):
"""
Convert ISO-8859-1 to T.61 character representation
"""
new = ''
for ch in s:
c=ord(ch)
if (c & 0x80) == 0:
new = new+ch
else:
new = '%s\\x%X' % (new,ord(ch))
return new
def t612iso(s):
"""
Convert T.61 character representation to ISO-8859-1
"""
new = ''
slashpos = string.find(s,'\\x')
while slashpos!=-1:
if (s[slashpos]==0) or (s[slashpos]>0 and s[slashpos-1]!='\\'):
new = new+s[0:slashpos]+chr(string.atoi(s[slashpos+2:slashpos+4],16))
s = s[slashpos+4:]
else:
new = new+s[0:slashpos-1]
s = s[slashpos+1:]
slashpos = string.find(s,'\\x')
return new+s
def t612html4(s):
"""
Convert T.61 character representation to HTML-4 character representation
"""
new = ''
slashpos = string.find(s,'\\x')
while slashpos!=-1:
if (s[slashpos]==0) or (s[slashpos]>0 and s[slashpos-1]!='\\'):
new = new+s[0:slashpos]+'&#%d;' % string.atoi(s[slashpos+2:slashpos+4],16)
s = s[slashpos+4:]
else:
new = new+s[0:slashpos-1]
s = s[slashpos+1:]
slashpos = string.find(s,'\\x')
return new+s
def iso2asn1(s):
"""
Convert ISO-8859-1 to BMPString
"""
new = ''
for ch in s:
c=ord(ch)
if (c & 0x80) == 0:
new = '%s\\x00%s' % (new,ch)
else:
new = '%s\\x00\\x%X%s' % (new,ord(ch),ch)
return new
def asn12iso(s):
"""
Convert BMPString to ISO-8859-1
"""
return t612iso(string.replace(s,'\\x00',''))
def asn12html4(s):
"""
Convert BMPString to HTML-4 character representation
"""
return t612html4(string.replace(s,'\\x00',''))
recode_func = {
'ISO-8859-1': {
'UTF-8' : iso2utf,
'HTML4' : iso2html4
},
'ISO-8859-15': {
'UTF-8' : iso2utf,
'HTML4' : iso2html4
},
'UTF-8': {
'HTML4' : utf2html4,
'ISO-8859-1' : utf2iso
}
}
def recode(s,source,target):
"""
Convert from/to known character set / encoding
"""
if source==target:
return s
return recode_func[string.upper(source)][string.upper(target)](s)
pyca-20031118/pylib/htmlbase.py 0100644 0000764 0000144 00000002605 07321124447 015534 0 ustar michael users ########################################################################
# Funktionen fuer immer wiederkehrende HTML-Ausgaben
########################################################################
########################################################################
# Hier einige Variablen zur Konfiguration
########################################################################
# Parameter fuers -Tag
bodyPARAM=''
import os, string
# Ausgabe einer Ueberschrift
def PrintHeading(Msg,Type=1):
print '%s' % (Type,Msg,Type)
# Ausdrucken eines HTML-Kopfes mit Titelzeile
def PrintHeader(TitleMsg,HTTP_charset='iso-8859-1'):
print """Content-type: text/html;charset=%s
pragma: no-cache
%s
""" % (HTTP_charset,TitleMsg,bodyPARAM)
return
# Ausdrucken eines HTML-Endes
def PrintFooter():
print """
""" % (Msg)
server_admin = os.environ.get('SERVER_ADMIN','')
if server_admin:
print 'Please contact %s.' % (
server_admin,server_admin
)
PrintFooter()
return
pyca-20031118/pylib/certhelper.py 0100644 0000764 0000144 00000004032 07165050244 016065 0 ustar michael users ########################################################################
# certhelper.py
# (c) by Michael Stroeder, michael@stroeder.com
########################################################################
# Deal with X.509 certificates and cert requests with
# plain Python 1.5.2 lib
########################################################################
import string, re, base64, md5, sha
pem_re = re.compile('-----BEGIN (CERTIFICATE|X509 CRL|CERTIFICATE REQUEST)-----([ \w+/=\r\n]+?)-----END (CERTIFICATE|X509 CRL|CERTIFICATE REQUEST)-----',re.S+re.M)
def MD5Fingerprint(cert_der='',delimiter=':'):
"""
MD5 fingerprint in dotted notation (delimiter between bytes)
"""
cert_md5 = md5.new(cert_der).digest()
cert_fingerprint = []
for i in cert_md5:
cert_fingerprint.append(string.upper('%02x' % (ord(i))))
return string.join(cert_fingerprint,delimiter)
def SHA1Fingerprint(cert_der='',delimiter=':'):
"""
Return SHA-1 fingerprint in dotted notation (delimiter between bytes)
"""
cert_sha1 = sha.new(cert_der).digest()
cert_fingerprint = []
for i in cert_sha1:
cert_fingerprint.append(string.upper('%02x' % (ord(i))))
return string.join(cert_fingerprint,delimiter)
def extract_pem(cert_text):
"""
Extract all base64 encoded certs in a text file to a list of strings
"""
result = []
for begin_type,cert_base64,end_type in pem_re.findall(cert_text):
if begin_type!=end_type:
raise ValueError,"-----BEGIN %s----- and -----END %s----- does not match" % (begin_type,end_type)
result.append((begin_type,string.strip(cert_base64)))
return result
def der2pem(cert_der,cert_type='CERTIFICATE'):
"""
Convert single binary DER-encoded certificate to base64 encoded format
"""
return """-----BEGIN %s-----
%s-----END %s-----
""" % (cert_type,base64.encodestring(cert_der),cert_type)
def pem2der(cert_text):
"""
Convert single base64 encoded certificate to binary DER-encoded format
"""
cert_type,cert_base64 = extract_pem(cert_text)[0]
return base64.decodestring(string.strip(cert_base64))
pyca-20031118/pylib/vbs.py 0100644 0000764 0000144 00000012532 07756113147 014536 0 ustar michael users """
vbs.py - generate VBScript for cert enrollment with M$ Internet Explorer
c) by Michael Stroeder, michael@stroeder.com
Special thanks to:
- inspired code contributed by Jordi Floriach ,
- VBScript function PrintVBSCryptoProvider() appears by courtesy of
Michael Konietzka
"""
__version__='0.6.6'
import sys, string
def PrintVBSXenrollObject(codebase='xenroll.dll'):
"""