From 25872b36de18a857b1ef36450980f52c8e08e97d Mon Sep 17 00:00:00 2001 From: Takashi Kajinami Date: Mon, 6 Nov 2023 22:03:14 +0900 Subject: [PATCH] Drop implementation to use pyOpenSSL to manage pkcs12 certs The cryptography library has been bumped to 3.1 in upper-constraints file during Ussuri, which is quite old. So we no longer have to maintain logic for cryptography < 3.0. Change-Id: I1a463e320b94b0e99e92541581e1ee5feffd356a --- octavia_tempest_plugin/common/cert_utils.py | 32 ++------------------- requirements.txt | 2 +- 2 files changed, 4 insertions(+), 30 deletions(-) diff --git a/octavia_tempest_plugin/common/cert_utils.py b/octavia_tempest_plugin/common/cert_utils.py index 753da6b4..34d0d7d3 100644 --- a/octavia_tempest_plugin/common/cert_utils.py +++ b/octavia_tempest_plugin/common/cert_utils.py @@ -21,7 +21,6 @@ from cryptography.hazmat.primitives.serialization import NoEncryption from cryptography.hazmat.primitives.serialization import pkcs12 from cryptography import x509 from cryptography.x509.oid import NameOID -import OpenSSL def generate_ca_cert_and_key(): @@ -176,38 +175,13 @@ def generate_client_cert_and_key(ca_cert, ca_key, client_uuid): def generate_pkcs12_bundle(server_cert, server_key): """Creates a pkcs12 formated bundle. - Note: This uses pyOpenSSL as the cryptography package does not yet - support creating pkcs12 bundles. The currently un-released - 2.5 version of cryptography supports reading pkcs12, but not - creation. This method should be updated to only use - cryptography once it supports creating pkcs12 bundles. - :param server_cert: A cryptography certificate (x509) object. :param server_key: A cryptography key (x509) object. :returns: A pkcs12 bundle. """ - # Use the PKCS12 serialization function from cryptography if it exists - # (>=3.0), otherwise use the pyOpenSSL module. - # - # The PKCS12 class of the pyOpenSSL module is not compliant with FIPS. - # It uses the SHA1 function [0] which is not allowed when generating - # digital signatures [1] - # - # [0] https://github.com/pyca/pyopenssl/blob/ - # 65ca53a7a06a7c78c1749200a6b3a007e47d3214/src/OpenSSL/ - # crypto.py#L2748-L2749 - # [1] https://nvlpubs.nist.gov/nistpubs/SpecialPublications/ - # NIST.SP.800-131Ar1.pdf - if hasattr(pkcs12, 'serialize_key_and_certificates'): - p12 = pkcs12.serialize_key_and_certificates( - b'', server_key, server_cert, - cas=None, encryption_algorithm=NoEncryption()) - else: - p12 = OpenSSL.crypto.PKCS12() - p12.set_privatekey( - OpenSSL.crypto.PKey.from_cryptography_key(server_key)) - p12.set_certificate(OpenSSL.crypto.X509.from_cryptography(server_cert)) - p12 = p12.export() + p12 = pkcs12.serialize_key_and_certificates( + b'', server_key, server_cert, + cas=None, encryption_algorithm=NoEncryption()) return p12 diff --git a/requirements.txt b/requirements.txt index 7b2f0a2c..afa05656 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,7 +2,7 @@ # of appearance. Changing the order has an impact on the overall integration # process, which may cause wedges in the gate later. -cryptography>=2.1 # BSD/Apache-2.0 +cryptography>=3.0 # BSD/Apache-2.0 python-dateutil>=2.5.3 # BSD pbr!=2.1.0,>=2.0.0 # Apache-2.0 oslo.config>=5.2.0 # Apache-2.0