2 """Create example self-signed X.509 certificate
5 from argparse import ArgumentParser
6 from base64 import standard_b64decode
7 from base64 import standard_b64encode
8 from datetime import datetime
9 from datetime import timedelta
10 from os import urandom
11 from textwrap import fill
13 from pyderasn import Any
14 from pyderasn import BitString
15 from pyderasn import Boolean
16 from pyderasn import IA5String
17 from pyderasn import Integer
18 from pyderasn import OctetString
19 from pyderasn import PrintableString
20 from pyderasn import UTCTime
22 from pygost.asn1schemas.oids import id_at_commonName
23 from pygost.asn1schemas.oids import id_ce_basicConstraints
24 from pygost.asn1schemas.oids import id_ce_subjectAltName
25 from pygost.asn1schemas.oids import id_ce_subjectKeyIdentifier
26 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_256
27 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_256_paramSetA
28 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_256_paramSetB
29 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_256_paramSetC
30 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_256_paramSetD
31 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_512
32 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_512_paramSetA
33 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_512_paramSetB
34 from pygost.asn1schemas.oids import id_tc26_gost3410_2012_512_paramSetC
35 from pygost.asn1schemas.oids import id_tc26_signwithdigest_gost3410_2012_256
36 from pygost.asn1schemas.oids import id_tc26_signwithdigest_gost3410_2012_512
37 from pygost.asn1schemas.prvkey import PrivateKey
38 from pygost.asn1schemas.prvkey import PrivateKeyAlgorithmIdentifier
39 from pygost.asn1schemas.prvkey import PrivateKeyInfo
40 from pygost.asn1schemas.x509 import AlgorithmIdentifier
41 from pygost.asn1schemas.x509 import AttributeType
42 from pygost.asn1schemas.x509 import AttributeTypeAndValue
43 from pygost.asn1schemas.x509 import AttributeValue
44 from pygost.asn1schemas.x509 import BasicConstraints
45 from pygost.asn1schemas.x509 import Certificate
46 from pygost.asn1schemas.x509 import CertificateSerialNumber
47 from pygost.asn1schemas.x509 import Extension
48 from pygost.asn1schemas.x509 import Extensions
49 from pygost.asn1schemas.x509 import GeneralName
50 from pygost.asn1schemas.x509 import GostR34102012PublicKeyParameters
51 from pygost.asn1schemas.x509 import Name
52 from pygost.asn1schemas.x509 import RDNSequence
53 from pygost.asn1schemas.x509 import RelativeDistinguishedName
54 from pygost.asn1schemas.x509 import SubjectAltName
55 from pygost.asn1schemas.x509 import SubjectKeyIdentifier
56 from pygost.asn1schemas.x509 import SubjectPublicKeyInfo
57 from pygost.asn1schemas.x509 import TBSCertificate
58 from pygost.asn1schemas.x509 import Time
59 from pygost.asn1schemas.x509 import Validity
60 from pygost.asn1schemas.x509 import Version
61 from pygost.gost3410 import CURVES
62 from pygost.gost3410 import prv_unmarshal
63 from pygost.gost3410 import pub_marshal
64 from pygost.gost3410 import public_key
65 from pygost.gost3410 import sign
66 from pygost.gost34112012256 import GOST34112012256
67 from pygost.gost34112012512 import GOST34112012512
69 parser = ArgumentParser(description="Self-signed X.509 certificate creator")
73 help="Enable BasicConstraints.cA",
78 help="Subject's CommonName",
83 help="Signing algorithm: {256[ABCD],512[ABC]}",
87 help="Path to PEM with CA to issue the child",
89 args = parser.parse_args()
92 "publicKeyParamSet": id_tc26_gost3410_2012_256_paramSetA,
93 "key_algorithm": id_tc26_gost3410_2012_256,
95 "curve": CURVES["id-tc26-gost-3410-2012-256-paramSetA"],
96 "sign_algorithm": id_tc26_signwithdigest_gost3410_2012_256,
97 "hasher": GOST34112012256,
100 "publicKeyParamSet": id_tc26_gost3410_2012_256_paramSetB,
101 "key_algorithm": id_tc26_gost3410_2012_256,
103 "curve": CURVES["id-tc26-gost-3410-2012-256-paramSetB"],
104 "sign_algorithm": id_tc26_signwithdigest_gost3410_2012_256,
105 "hasher": GOST34112012256,
108 "publicKeyParamSet": id_tc26_gost3410_2012_256_paramSetC,
109 "key_algorithm": id_tc26_gost3410_2012_256,
111 "curve": CURVES["id-tc26-gost-3410-2012-256-paramSetC"],
112 "sign_algorithm": id_tc26_signwithdigest_gost3410_2012_256,
113 "hasher": GOST34112012256,
116 "publicKeyParamSet": id_tc26_gost3410_2012_256_paramSetD,
117 "key_algorithm": id_tc26_gost3410_2012_256,
119 "curve": CURVES["id-tc26-gost-3410-2012-256-paramSetD"],
120 "sign_algorithm": id_tc26_signwithdigest_gost3410_2012_256,
121 "hasher": GOST34112012256,
124 "publicKeyParamSet": id_tc26_gost3410_2012_512_paramSetA,
125 "key_algorithm": id_tc26_gost3410_2012_512,
127 "curve": CURVES["id-tc26-gost-3410-12-512-paramSetA"],
128 "sign_algorithm": id_tc26_signwithdigest_gost3410_2012_512,
129 "hasher": GOST34112012512,
132 "publicKeyParamSet": id_tc26_gost3410_2012_512_paramSetB,
133 "key_algorithm": id_tc26_gost3410_2012_512,
135 "curve": CURVES["id-tc26-gost-3410-12-512-paramSetB"],
136 "sign_algorithm": id_tc26_signwithdigest_gost3410_2012_512,
137 "hasher": GOST34112012512,
140 "publicKeyParamSet": id_tc26_gost3410_2012_512_paramSetC,
141 "key_algorithm": id_tc26_gost3410_2012_512,
143 "curve": CURVES["id-tc26-gost-3410-2012-512-paramSetC"],
144 "sign_algorithm": id_tc26_signwithdigest_gost3410_2012_512,
145 "hasher": GOST34112012512,
153 if args.issue_with is not None:
154 with open(args.issue_with, "rb") as fd:
155 lines = fd.read().decode("ascii").split("-----")
156 idx = lines.index("BEGIN PRIVATE KEY")
158 raise ValueError("PEM has no PRIVATE KEY")
159 prv_raw = standard_b64decode(lines[idx + 1])
160 idx = lines.index("BEGIN CERTIFICATE")
162 raise ValueError("PEM has no CERTIFICATE")
163 cert_raw = standard_b64decode(lines[idx + 1])
164 pki = PrivateKeyInfo().decod(prv_raw)
165 ca_prv = prv_unmarshal(bytes(OctetString().decod(bytes(pki["privateKey"]))))
166 tbs = Certificate().decod(cert_raw)["tbsCertificate"]
167 ca_subj = tbs["subject"]
168 curve_oid = GostR34102012PublicKeyParameters().decod(bytes(
169 tbs["subjectPublicKeyInfo"]["algorithm"]["parameters"]
170 ))["publicKeyParamSet"]
172 params for params in AIs.values()
173 if params["publicKeyParamSet"] == curve_oid
178 return fill(standard_b64encode(obj.encode()).decode("ascii"), 64)
181 key_params = GostR34102012PublicKeyParameters((
182 ("publicKeyParamSet", ai["publicKeyParamSet"]),
185 prv_raw = urandom(ai["prv_len"])
186 print("-----BEGIN PRIVATE KEY-----")
187 print(pem(PrivateKeyInfo((
188 ("version", Integer(0)),
189 ("privateKeyAlgorithm", PrivateKeyAlgorithmIdentifier((
190 ("algorithm", ai["key_algorithm"]),
191 ("parameters", Any(key_params)),
193 ("privateKey", PrivateKey(OctetString(prv_raw).encode())),
195 print("-----END PRIVATE KEY-----")
197 prv = prv_unmarshal(prv_raw)
199 pub_raw = pub_marshal(public_key(curve, prv))
200 subj = Name(("rdnSequence", RDNSequence([
201 RelativeDistinguishedName((
202 AttributeTypeAndValue((
203 ("type", AttributeType(id_at_commonName)),
204 ("value", AttributeValue(PrintableString(args.cn))),
208 not_before = datetime.utcnow()
209 not_after = not_before + timedelta(days=365)
210 ai_sign = AlgorithmIdentifier((
211 ("algorithm", (ai if ca_ai is None else ca_ai)["sign_algorithm"]),
215 ("extnID", id_ce_subjectKeyIdentifier),
217 ("extnValue", OctetString(
218 SubjectKeyIdentifier(GOST34112012256(pub_raw).digest()[:20]).encode()
222 ("extnID", id_ce_subjectAltName),
223 ("extnValue", OctetString(
225 GeneralName(("dNSName", IA5String(args.cn))),
231 exts.append(Extension((
232 ("extnID", id_ce_basicConstraints),
233 ("extnValue", OctetString(BasicConstraints((("cA", Boolean(True)),)).encode())),
235 tbs = TBSCertificate((
236 ("version", Version("v3")),
237 ("serialNumber", CertificateSerialNumber(12345)),
238 ("signature", ai_sign),
239 ("issuer", subj if ca_ai is None else ca_subj),
240 ("validity", Validity((
241 ("notBefore", Time(("utcTime", UTCTime(not_before)))),
242 ("notAfter", Time(("utcTime", UTCTime(not_after)))),
245 ("subjectPublicKeyInfo", SubjectPublicKeyInfo((
246 ("algorithm", AlgorithmIdentifier((
247 ("algorithm", ai["key_algorithm"]),
248 ("parameters", Any(key_params)),
250 ("subjectPublicKey", BitString(OctetString(pub_raw).encode())),
252 ("extensions", Extensions(exts)),
255 ("tbsCertificate", tbs),
256 ("signatureAlgorithm", ai_sign),
257 ("signatureValue", BitString(
258 sign(curve, prv, ai["hasher"](tbs.encode()).digest()[::-1])
259 if ca_ai is None else
260 sign(ca_ai["curve"], ca_prv, ca_ai["hasher"](tbs.encode()).digest()[::-1])
263 print("-----BEGIN CERTIFICATE-----")
265 print("-----END CERTIFICATE-----")