PKCS #10 generation

svn path=/pow/POW-0.7/lib/pkix.py; revision=1096

2 files changed, 15 insertions, 1 deletions

diff --git a/scripts/rpki/up_down.py b/scripts/rpki/up_down.py
index f831abb1..1fd28d5f 100644
--- a/scripts/rpki/up_down.py
+++ b/scripts/rpki/up_down.py
@@ -302,7 +302,7 @@ class issue_pdu(base_elt):
       ca_detail = rpki.sql.ca_detail_obj.create(gctx, ca)
     self = cls()
     self.class_name = ca.parent_resource_class
-    self.pkcs10 = rpki.x509.PKCS10(ca_detail.private_key_id, sia)
+    self.pkcs10 = rpki.x509.PKCS10.create(ca_detail.private_key_id, sia)
     return parent.query_up_down(gctx, self)
 
 class issue_response_pdu(class_response_syntax):
diff --git a/scripts/rpki/x509.py b/scripts/rpki/x509.py
index 4aaeb695..6a030490 100644
--- a/scripts/rpki/x509.py
+++ b/scripts/rpki/x509.py
@@ -417,6 +417,20 @@ class PKCS10(DER_object):
     # understand what the spec is telling me to do in this case.
     assert "subjectInfoAccess" in req_exts, "Can't (yet) handle PKCS #10 without an SIA extension"
 
+  @classmethod
+  def create(cls, keypair, sia):
+    """Create a new request for a given keypair, including given SIA value."""
+    req = POW.pkix.CertificationRequest()
+    req.version.set(0)
+    exts = [ ("basicConstraints",  True,  (1, None)),
+             ("keyUsage",          True,  (0, 0, 0, 0, 0, 1, 1)),
+             ("subjectInfoAccess", False, sia) ]
+    for x in exts:
+      x[0] = POW.pkix.obj2oid(x[0])
+    req.setExtension(exts)
+    req.sign(keypair)
+    return cls(POWpkix = req)
+
 class RSA_Keypair(DER_object):
   """Class to hold an RSA key pair."""