infra/samba-pki-tools
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[IMP] Some improvements

Browse Source
This commit is contained in:
Kevin GUERINEAU
2024-05-07 19:28:47 +02:00
parent e6c725fedc
commit c3f3944525
1 changed files with 18 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common.py
+18 -16
View File
@@ -202,8 +202,8 @@ def create_openssl_intermediate(name, force=False,verbose=False):
check_directories(path=TisPKI.pki_intermediate_dir(name),verbose=verbose)
intermediate_ca_config = os.path.join(TisPKI.intermediate_config_path(name),'create_intermediate_ca.ini')
intermediate_ca_keyfile = os.path.join(TisPKI.intermediate_keyout_path(name),'intermediate_ca.key')
intermediate_crl_file = os.path.join(TisPKI.intermediate_crl_path(name),'intermediate_ca.crl')
intermediate_ca_keyfile = os.path.join(TisPKI.intermediate_keyout_path(name),f'{name}_intermediate_ca.key')
intermediate_crl_file = os.path.join(TisPKI.intermediate_crl_path(name),f'{name}_intermediate_ca.crl')
root_ca_sign_intermediate = os.path.join(TisPKI.root_config_path(),'openssl_root_ca_sign_intermediate.ini')
if not os.path.isfile(root_ca_sign_intermediate):
@@ -224,10 +224,10 @@ def create_openssl_intermediate(name, force=False,verbose=False):
with open(root_ca_sign_intermediate,'wt') as file:
file.write(config_string)
if os.path.isfile(root_ca_sign_intermediate):
print('Root CA OpenSSL sign intermediate config file is correctly generated !')
Printing.success('Root CA OpenSSL sign intermediate config file is correctly generated !')
if not os.path.isfile(intermediate_ca_config):
print('Intermediate CA OpenSSL configfile not exist. Creating...')
Printing.information('Intermediate CA OpenSSL configfile not exist. Creating...')
template_dir = os.path.join('templates')
jinja_env = jinja2.Environment(loader=jinja2.FileSystemLoader(template_dir))
intermediate_ca_tmpl = jinja_env.get_template('openssl_create_intermediate_ca.tmpl')
@@ -237,31 +237,33 @@ def create_openssl_intermediate(name, force=False,verbose=False):
'city': config.get('openssl_config','city'),
'organization_name': config.get('openssl_config','organization_name'),
'organization_ou': config.get('openssl_config','organization_ou'),
'intermediate_organization_cn': config.get('openssl_config','intermediate_organization_cn'),
'intermediate_organization_cn': name,
'intermediate_crl_uri': config.get('openssl_config','intermediate_crl_uri')
}
config_string = intermediate_ca_tmpl.render(intermediate_ca_tmpl_var)
with open(intermediate_ca_config,'wt') as file:
file.write(config_string)
if os.path.isfile(intermediate_ca_config):
print('Intermediate CA OpenSSL configfile is correctly generated !')
Printing.success('Intermediate CA OpenSSL configfile is correctly generated !')
else:
print('Intermediate CA OpenSSL config already exist. Skip.')
Printing.information('Intermediate CA OpenSSL config already exist. Skip.')
if not os.path.isfile(intermediate_ca_keyfile) and not os.path.isfile(TisPKI.intermediate_ca_certfile()):
print('Generate Intermediate CA private key and CSR')
gen_intermediate_ca = subprocess.run(f'/usr/bin/openssl req -config {intermediate_ca_config} -new -sha512 -keyout {intermediate_ca_keyfile} -out {TisPKI.intermediate_csr_path(name)}/intermediate_ca.csr', shell=True, check=True, executable='/bin/bash')
print('Sign Intermediate CA with Root CA')
sign_intermediate_ca = subprocess.run(f"/usr/bin/openssl ca -config {os.path.join(TisPKI.pki_dir(),'config','openssl_root_ca_sign_intermediate.ini')} -extensions v3_intermediate_ca -days 1825 -notext -md sha512 -create_serial -in {TisPKI.intermediate_csr_path(name)}/intermediate_ca.csr -out {TisPKI.intermediate_ca_certfile(name)}", shell=True, check=True, executable='/bin/bash' )
if not os.path.isfile(intermediate_ca_keyfile) and not os.path.isfile(TisPKI.intermediate_ca_certfile(name)):
Printing.information('Generate Intermediate CA private key and CSR')
gen_intermediate_ca = subprocess.run(f'/usr/bin/openssl req -config {intermediate_ca_config} -new -sha512 -keyout {intermediate_ca_keyfile} -out {TisPKI.intermediate_csr_path(name)}/{name}_intermediate_ca.csr', shell=True, check=True, executable='/bin/bash')
Printing.information('Sign Intermediate CA with Root CA')
sign_intermediate_ca = subprocess.run(f"/usr/bin/openssl ca -config {os.path.join(TisPKI.pki_dir(),'config','openssl_root_ca_sign_intermediate.ini')} -extensions v3_intermediate_ca -days 1825 -notext -md sha512 -create_serial -in {TisPKI.intermediate_csr_path(name)}/{name}_intermediate_ca.csr -out {TisPKI.intermediate_ca_certfile(name)}", shell=True, check=True, executable='/bin/bash' )
if sign_intermediate_ca.returncode == 0:
print(f'Intermediate CA Certfile is stored in : {TisPKI.intermediate_ca_certfile(name)}')
print(subprocess.run(f'openssl x509 -in {TisPKI.intermediate_ca_certfile(name)} -text -noout', shell=True, check=True, executable='/bin/bash'))
if verbose:
subprocess.run(f'openssl x509 -in {TisPKI.intermediate_ca_certfile(name)} -text', shell=True, check=True, executable='/bin/bash')
Printing.success(f'Intermediate CA Certfile is stored in : {TisPKI.intermediate_ca_certfile(name)}')
input("Press Enter to continue...")
else:
print('Error on generating Intermediate CA private key')
Printing.error('Error on generating Intermediate CA private key')
sys.exit(1)
else:
print('Intermediate CA private key and certificate already exist. Skip.')
Printing.warning('Intermediate CA private key and certificate already exist. Skip.')
## if not os.path.isfile(intermediate_crl_file):
## print('Generate CRL')