diff options
author | Rob Austein <sra@hactrn.net> | 2009-08-28 19:58:08 +0000 |
---|---|---|
committer | Rob Austein <sra@hactrn.net> | 2009-08-28 19:58:08 +0000 |
commit | 9f4bc84a8be52b5fc838f2bf52d37bd8d6ecd112 (patch) | |
tree | 9d5aca21ff0dc1a92210e785a783225f55dd1ee4 /rpkid.stable/cross_certify.py | |
parent | 65dd0c1eebf86559508ac24a8200fa4194dec8c0 (diff) |
Clean up old "stable" branch that is now badly out of date
svn path=/rpkid.stable; revision=2714
Diffstat (limited to 'rpkid.stable/cross_certify.py')
-rw-r--r-- | rpkid.stable/cross_certify.py | 108 |
1 files changed, 0 insertions, 108 deletions
diff --git a/rpkid.stable/cross_certify.py b/rpkid.stable/cross_certify.py deleted file mode 100644 index 88c5718f..00000000 --- a/rpkid.stable/cross_certify.py +++ /dev/null @@ -1,108 +0,0 @@ -""" -Cross-certification tool to issue a new certificate based on an old -one that was issued by somebody else. The point of the exercise is to -end up with a valid certificate in our own BPKI which has the same -subject name and subject public key as the one we're replacing. - -Much of this code lifted from rpki.x509.X509.issue(), but this is a -sufficiently different purpose that it's probably not worth -refactoring. - -Usage: python cross_certify.py { -i | --in } input_cert - { -c | --ca } issuing_cert - { -k | --key } issuing_cert_key - { -s | --serial } serial_filename - [ { -h | --help } ] - [ { -o | --out } filename (default: stdout) ] - [ { -l | --lifetime } timedelta (default: 30 days) ] - -$Id$ - -Copyright (C) 2007--2008 American Registry for Internet Numbers ("ARIN") - -Permission to use, copy, modify, and distribute this software for any -purpose with or without fee is hereby granted, provided that the above -copyright notice and this permission notice appear in all copies. - -THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH -REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -AND FITNESS. IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT, -INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -PERFORMANCE OF THIS SOFTWARE. -""" - -import os, time, getopt, sys, POW -import rpki.x509, rpki.sundial - -os.environ["TZ"] = "UTC" -time.tzset() - -def usage(code): - print __doc__ - sys.exit(code) - -output = None -lifetime = rpki.sundial.timedelta(days = 30) - -opts,argv = getopt.getopt(sys.argv[1:], "h?i:o:c:k:s:l:", - ["help", "in=", "out=", "ca=", "key=", "serial=", "lifetime="]) -for o,a in opts: - if o in ("-h", "--help", "-?"): - usage(0) - elif o in ("-i", "--in"): - child = rpki.x509.X509(Auto_file = a) - elif o in ("-o", "--out"): - output = a - elif o in ("-c", "--ca"): - parent = rpki.x509.X509(Auto_file = a) - elif o in ("-k", "--key"): - keypair = rpki.x509.RSA(Auto_file = a) - elif o in ("-s", "--serial"): - serial_file = a - elif o in ("-l", "--lifetime"): - lifetime = rpki.sundial.timedelta.parse(a) -if argv: - usage(1) - -now = rpki.sundial.now() -notAfter = now + lifetime - -try: - f = open(serial_file, "r") - serial = f.read() - f.close() - serial = int(serial.splitlines()[0], 16) -except IOError: - serial = 1 - -x = POW.pkix.Certificate() -x.setVersion(2) -x.setSerial(serial) -x.setIssuer(parent.get_POWpkix().getSubject()) -x.setSubject(child.get_POWpkix().getSubject()) -x.setNotBefore(now.toASN1tuple()) -x.setNotAfter(notAfter.toASN1tuple()) -x.tbs.subjectPublicKeyInfo.set(child.get_POWpkix().tbs.subjectPublicKeyInfo.get()) -x.setExtensions(((rpki.oids.name2oid["subjectKeyIdentifier"], False, - child.get_SKI()), - (rpki.oids.name2oid["authorityKeyIdentifier"], False, - (parent.get_SKI(), (), None)), - (rpki.oids.name2oid["basicConstraints"], True, - (1, 0)))) -x.sign(keypair.get_POW(), POW.SHA256_DIGEST) - -cert = rpki.x509.X509(POWpkix = x) - -f = open(serial_file, "w") -f.write("%02x\n" % (serial + 1)) -f.close() - -if output is None: - print cert.get_PEM() -else: - f = open(output, "w") - f.write(cert.get_PEM()) - f.close() - |