1 """Create example self-signed X.509 certificate
4 from base64 import standard_b64encode
5 from datetime import datetime
6 from datetime import timedelta
9 from sys import exit as sys_exit
10 from textwrap import fill
12 from pyderasn import Any
13 from pyderasn import BitString
14 from pyderasn import Integer
15 from pyderasn import OctetString
16 from pyderasn import PrintableString
17 from pyderasn import UTCTime
19 from pygost.asn1schemas.oids import id_at_commonName
20 from pygost.asn1schemas.oids import id_ce_subjectKeyIdentifier
21 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_512
22 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_512_paramSetA
23 from pygost.asn1schemas.oids import id_tc26_gost3411_2012_512
24 from pygost.asn1schemas.oids import id_tc26_signwithdigest_gost3410_2012_512
25 from pygost.asn1schemas.prvkey import PrivateKey
26 from pygost.asn1schemas.prvkey import PrivateKeyAlgorithmIdentifier
27 from pygost.asn1schemas.prvkey import PrivateKeyInfo
28 from pygost.asn1schemas.x509 import AlgorithmIdentifier
29 from pygost.asn1schemas.x509 import AttributeType
30 from pygost.asn1schemas.x509 import AttributeTypeAndValue
31 from pygost.asn1schemas.x509 import AttributeValue
32 from pygost.asn1schemas.x509 import Certificate
33 from pygost.asn1schemas.x509 import CertificateSerialNumber
34 from pygost.asn1schemas.x509 import Extension
35 from pygost.asn1schemas.x509 import Extensions
36 from pygost.asn1schemas.x509 import GostR34102012PublicKeyParameters
37 from pygost.asn1schemas.x509 import Name
38 from pygost.asn1schemas.x509 import RDNSequence
39 from pygost.asn1schemas.x509 import RelativeDistinguishedName
40 from pygost.asn1schemas.x509 import SubjectKeyIdentifier
41 from pygost.asn1schemas.x509 import SubjectPublicKeyInfo
42 from pygost.asn1schemas.x509 import TBSCertificate
43 from pygost.asn1schemas.x509 import Time
44 from pygost.asn1schemas.x509 import Validity
45 from pygost.asn1schemas.x509 import Version
46 from pygost.gost3410 import CURVES
47 from pygost.gost3410 import prv_unmarshal
48 from pygost.gost3410 import pub_marshal
49 from pygost.gost3410 import public_key
50 from pygost.gost3410 import sign
51 from pygost.gost34112012512 import GOST34112012512
54 sys_exit("Usage: cert-selfsigned-example.py COMMON-NAME")
58 return fill(standard_b64encode(obj.encode()).decode('ascii'), 64)
61 key_params = GostR34102012PublicKeyParameters((
62 ("publicKeyParamSet", id_tc26_gost3410_2012_512_paramSetA),
63 ("digestParamSet", id_tc26_gost3411_2012_512),
67 print("-----BEGIN PRIVATE KEY-----")
68 print(pem(PrivateKeyInfo((
69 ("version", Integer(0)),
70 ("privateKeyAlgorithm", PrivateKeyAlgorithmIdentifier((
71 ("algorithm", id_tc26_gost3410_2012_512),
72 ("parameters", Any(key_params)),
74 ("privateKey", PrivateKey(prv_raw)),
76 print("-----END PRIVATE KEY-----")
78 prv = prv_unmarshal(prv_raw)
79 curve = CURVES["id-tc26-gost-3410-12-512-paramSetA"]
80 pub_raw = pub_marshal(public_key(curve, prv), mode=2012)
81 subj = Name(("rdnSequence", RDNSequence([
82 RelativeDistinguishedName((
83 AttributeTypeAndValue((
84 ("type", AttributeType(id_at_commonName)),
85 ("value", AttributeValue(PrintableString(argv[1]))),
89 not_before = datetime.utcnow()
90 not_after = not_before + timedelta(days=365)
91 ai_sign = AlgorithmIdentifier((
92 ("algorithm", id_tc26_signwithdigest_gost3410_2012_512),
94 tbs = TBSCertificate((
95 ("version", Version("v3")),
96 ("serialNumber", CertificateSerialNumber(12345)),
97 ("signature", ai_sign),
99 ("validity", Validity((
100 ("notBefore", Time(("utcTime", UTCTime(not_before)))),
101 ("notAfter", Time(("utcTime", UTCTime(not_after)))),
104 ("subjectPublicKeyInfo", SubjectPublicKeyInfo((
105 ("algorithm", AlgorithmIdentifier((
106 ("algorithm", id_tc26_gost3410_2012_512),
107 ("parameters", Any(key_params)),
109 ("subjectPublicKey", BitString(OctetString(pub_raw).encode())),
111 ("extensions", Extensions((
113 ("extnID", id_ce_subjectKeyIdentifier),
114 ("extnValue", OctetString(
115 SubjectKeyIdentifier(GOST34112012512(pub_raw).digest()[:20]).encode()
121 ("tbsCertificate", tbs),
122 ("signatureAlgorithm", ai_sign),
123 ("signatureValue", BitString(sign(
126 GOST34112012512(tbs.encode()).digest(),
130 print("-----BEGIN CERTIFICATE-----")
132 print("-----END CERTIFICATE-----")