X509Certificate

X509Certificate is a class for managing X509 certificates

Proxy RFC: https://tools.ietf.org/html/rfc38200

X509RFC: https://tools.ietf.org/html/rfc5280

class DIRAC.Core.Security.m2crypto.X509Certificate.X509Certificate(x509Obj=None, certString=None)

Bases: object

The X509Certificate object represents … a X509Certificate.

It is a wrapper around a lower level implementation (M2Crypto in this case) of a certificate. In theory, tt can be a host or user certificate. Also, a proxy certificate is a X509Certificate, however it is useless without all the chain of issuers. That’s why one has the X509Chain.

In practice, X509Certificate is just used for checking if the host certificate has expired. This class will most probably disappear once we get ride of pyGSI. After all, a X509Certificate is nothing but a X509Chain of length 1.

Note that the SSL connection itself does not use this class, it gives directly the certificate to the library

__init__(x509Obj=None, certString=None)

Constructor. You can give either nothing, or the x509Obj or the certString

Parameters

  • x509Obj (M2Crypto.X509.X509) – (optional) certificate instance

  • certString (String) – text representation of certificate

asPem()

Return certificate as PEM string

Returns

pem string

classmethod generateProxyCertFromIssuer(x509Issuer, x509ExtensionStack, proxyKey, lifetime=3600)

This class method is meant to generate a new X509Certificate out of an existing one. Basically, it generates a proxy… However, you can’t have a proxy certificate working on its own, you need all the chain of certificates. This method is meant to be called only by the X509Chain class.

Inspired from https://github.com/eventbrite/m2crypto/blob/master/demo/x509/ca.py#L45

Parameters

  • x509Issuer – X509Certificate instance from which we generate the next one

  • x509ExtensionStack – M2Crypto.X509.X509_Extension_Stack object to add to the new certificate. It contains all the X509 extensions needed for the proxy (e.g. DIRAC group). See ~X509Chain.__getProxyExtensionList

  • proxyKey – a M2Crypto.EVP.PKey instance with private and public key

  • lifetime – duration of the proxy in second. Default 3600

Returns

a new X509Certificate

generateProxyRequest(bitStrength=2048, limited=False)

Generate a proxy request. See DIRAC.Core.Security.m2crypto.X509Request.X509Request

In principle, there is no reason to have this here, since a the X509Request is independant of the 509Certificate when generating it. The only reason is to check whether the current Certificate is limited or not.

Parameters

  • bitStrength – strength of the key

  • limited – if True or if the current certificate is limited (see proxy RFC), creates a request for a limited proxy

Returns

S_OK( DIRAC.Core.Security.m2crypto.X509Request.X509Request ) / S_ERROR

getDIRACGroup(ignoreDefault=False)

Get the dirac group if present

If no group is found in the certificate, we query the CS to get the default group for the given user. This can be disabled using the ignoreDefault parameter

Note that the lookup in the CS only can work for a proxy of first generation, since we search based on the issuer DN

Parameters

ignoreDefault – if True, do not lookup the CS

Returns

S_OK(group name/bool)

getExtension(name)

Return X509 Extension with given name

Parameters

name – name of the extension

Returns

S_OK with M2Crypto.X509.X509_Extension object, or S_ERROR

getExtensions()

Get a decoded list of extensions

Returns

S_OK( list of tuple (extensionName, extensionValue))

getIssuerDN()

Get issuer DN

Returns

S_OK( string )/S_ERROR

getNotAfterDate()

Get not after date of a certificate

Returns

S_OK( datetime )/S_ERROR

getNotBeforeDate()

Get not before date of a certificate

Returns

S_OK( datetime )/S_ERROR

getPublicKey()

Get the public key of the certificate

Returns

S_OK(M2crypto.EVP.PKey)

getRemainingSecs()

Get remaining lifetime in secs

Returns

S_OK(remaining seconds)

getSerialNumber()

Get certificate serial number

Returns

S_OK( serial )/S_ERROR

getStrength()

Get the length of the key of the certificate in bit

Returns

S_OK( size )/S_ERROR

getSubjectDN()

Get subject DN

Returns

S_OK( string )/S_ERROR

getSubjectNameObject()

Get subject name object

Returns

S_OK( X509Name )/S_ERROR

getVOMSData()

Get voms extensions data

Returns

S_ERROR/S_OK(dict). For the content of the dict, see decodeVOMSExtension()

hasExpired()

Check if the loaded certificate is still valid

Returns

S_OK( True/False )/S_ERROR

hasVOMSExtensions()

Has voms extensions

Returns

S_OK(bool) if voms extensions are found

load(certificate)

Load an x509 certificate either from a file or from a string

Parameters

certificate – path to the file or PEM encoded string

Returns

S_OK on success, otherwise S_ERROR

loadFromFile(certLocation)

Load a x509 cert from a pem file

param certLocation

path to the certificate file

Returns

S_OK / S_ERROR.

loadFromString(pemData)

Load a x509 cert from a string containing the pem data

Parameters

pemData – pem encoded string

Returns

S_OK / S_ERROR

sign(key, algo)

Sign the cerificate using provided key and algorithm.

Parameters

  • key – M2crypto.EVP.PKey object with private and public key

  • algo – algorithm to sign the certificate

Returns

S_OK/S_ERROR

verify(pkey)

Verify the signature of the certificate using the public key provided

Parameters

pkey – ~M2Crypto.EVP.PKey object

Returns

S_OK(bool) where the boolean shows the success of the verification