Commit 8091e113 authored by Alex Kakiris's avatar Alex Kakiris
Browse files

extract keypair and CSR generation into utils/certs

parent dab59c59

capif_backend/backoffice_service/__main__.py

+3 −29
Changes for capif_backend/backoffice_service/__main__.py: 3 added lines, 29 removed lines.
Original line number Diff line number Diff line
@@ -4,10 +4,6 @@ from .configs.config import Config 
import json

import requests

import os

from cryptography import x509

from cryptography.hazmat.primitives import hashes, serialization

from cryptography.hazmat.primitives.asymmetric import rsa

from cryptography.x509.oid import NameOID

from .controllers.default_controller import backoffice_routes

from .controllers.invokers_controller import invokers_routes

from .controllers.providers_controller import providers_routes
@@ -17,6 +13,8 @@ from .controllers.login import access_routes 
from .controllers.configuration_controller import configuration_routes

from flask_cors import CORS



from .utils.certs import generate_keypair_and_csr



# Create Flask app

app = Flask(__name__)
@@ -55,31 +53,7 @@ def handle_options(): 
app.config["JWT_SECRET_KEY"] = "super-secret"

jwt = JWTManager(app)



# create public/private key

key = rsa.generate_private_key(public_exponent=65537, key_size=2048)



# Generate CSR

subject = x509.Name([

    x509.NameAttribute(NameOID.ORGANIZATION_NAME, 'Telefonica I+D'),

    x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, 'Innovation'),

    x509.NameAttribute(NameOID.LOCALITY_NAME, 'Madrid'),

    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, 'Madrid'),

    x509.NameAttribute(NameOID.COUNTRY_NAME, 'ES'),

    x509.NameAttribute(NameOID.EMAIL_ADDRESS, 'inno@tid.es'),

])

csr_request = (

    x509.CertificateSigningRequestBuilder()

    .subject_name(subject)

    .sign(key, hashes.SHA256())

    .public_bytes(serialization.Encoding.PEM)

)



# Get private key

private_key = key.private_bytes(

    encoding=serialization.Encoding.PEM,

    format=serialization.PrivateFormat.PKCS8,

    encryption_algorithm=serialization.NoEncryption(),

)

csr_request, private_key = generate_keypair_and_csr()



# Read environment variable to determine whether to load from Vault or from environment variables

LOAD_FROM_VAULT = os.getenv('LOAD_FROM_VAULT', 'true').lower() == 'true'

capif_backend/backoffice_service/utils/certs.py

0 → 100644
+33 −0
Changes for capif_backend/backoffice_service/utils/certs.py: 33 added lines, 0 removed lines.
Original line number Diff line number Diff line 
from cryptography import x509

from cryptography.hazmat.primitives import hashes, serialization

from cryptography.hazmat.primitives.asymmetric import rsa

from cryptography.x509.oid import NameOID



def generate_keypair_and_csr():

    # create public/private key

    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)



    # Generate CSR

    subject = x509.Name([

        x509.NameAttribute(NameOID.ORGANIZATION_NAME, 'Telefonica I+D'),

        x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, 'Innovation'),

        x509.NameAttribute(NameOID.LOCALITY_NAME, 'Madrid'),

        x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, 'Madrid'),

        x509.NameAttribute(NameOID.COUNTRY_NAME, 'ES'),

        x509.NameAttribute(NameOID.EMAIL_ADDRESS, 'inno@tid.es'),

    ])

    csr_request = (

        x509.CertificateSigningRequestBuilder()

        .subject_name(subject)

        .sign(key, hashes.SHA256())

        .public_bytes(serialization.Encoding.PEM)

    )



    # Get private key

    private_key = key.private_bytes(

        encoding=serialization.Encoding.PEM,

        format=serialization.PrivateFormat.PKCS8,

        encryption_algorithm=serialization.NoEncryption(),

    )



    return csr_request, private_key
 
 No newline at end of file