2015-06-22 22:47:27 +02:00
|
|
|
"""
|
2016-12-08 01:24:59 +01:00
|
|
|
.. module: lemur.certificate.service
|
2015-06-22 22:47:27 +02:00
|
|
|
:platform: Unix
|
2018-05-29 19:18:16 +02:00
|
|
|
:copyright: (c) 2018 by Netflix Inc., see AUTHORS for more
|
2015-06-22 22:47:27 +02:00
|
|
|
:license: Apache, see LICENSE for more details.
|
|
|
|
.. moduleauthor:: Kevin Glisson <kglisson@netflix.com>
|
|
|
|
"""
|
|
|
|
import arrow
|
|
|
|
|
2016-11-18 20:27:46 +01:00
|
|
|
from flask import current_app
|
2018-04-02 17:33:51 +02:00
|
|
|
from sqlalchemy import func, or_, not_, cast, Integer
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2016-11-21 20:28:11 +01:00
|
|
|
from cryptography import x509
|
|
|
|
from cryptography.hazmat.backends import default_backend
|
|
|
|
from cryptography.hazmat.primitives import hashes, serialization
|
|
|
|
|
2015-06-22 22:47:27 +02:00
|
|
|
from lemur import database
|
2018-07-20 19:47:19 +02:00
|
|
|
from lemur.extensions import metrics, sentry, signals
|
2015-07-04 21:47:57 +02:00
|
|
|
from lemur.plugins.base import plugins
|
2018-04-02 17:33:51 +02:00
|
|
|
from lemur.common.utils import generate_private_key, truthiness
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2016-12-08 01:24:59 +01:00
|
|
|
from lemur.roles.models import Role
|
|
|
|
from lemur.domains.models import Domain
|
|
|
|
from lemur.authorities.models import Authority
|
2015-07-11 02:06:57 +02:00
|
|
|
from lemur.destinations.models import Destination
|
2016-12-08 01:24:59 +01:00
|
|
|
from lemur.certificates.models import Certificate
|
2015-07-30 02:13:06 +02:00
|
|
|
from lemur.notifications.models import Notification
|
Async Certificate Issuing using Pending Certificates (#1037)
* Add PendingCertificate model
This change creates a DB table called pending_certificates and
associated mapping relationship tables from pending certificate to
roles, rotation policy, destination, sources, etc.
The table is generated on initialization of Lemur. A pending
certificate holds most of the information of a Certificate, while it has
not be issued so that it can later backfill the information when the CA
has issued the certificate.
Change-Id: I277c16b776a71fe5edaf0fa0e76bbedc88924db0
Tickets: PBL-36499
* Create a PendingCertificate if cert is empty
IssuePlugins should return empty cert bodies if the request failed to
complete immediately (such as Digicert). This way, we can immediately
return the certificate, or if not just place into PendingCertificates
for later processing.
+ Fix relation from Certificate to Pending Certificate, as view only.
There is no real need for anything more than that since Pending cert
only needs to know the cert to replace when it is issued later.
+ Made PendingCertificate private key be empty: UI does not allow
private key on 'Create' but only on 'Import'. For Instart, we require
the private key but upstream does not necessarily need it. Thus, if
someone at Instart wants to create a CSR / key combo, they should
manually issue the cert themselves and import later. Otherwise you
should let Lemur generate that. This keeps the workflow transparent for
upstream Lemur users.
Change-Id: Ib74722a5ed5792d4b10ca702659422739c95ae26
Tickets: PBL-36343
* Fix empty private_key when create Pending Cert
On creation of a certificate with a CSR, there is no option for private
key. In this case, we actually have a dictionary with private_key as
key, but the value is None. This fixes the strip() called on NoneType.
Change-Id: I7b265564d8095bfc83d9d4cd14ae13fea3c03199
Tickets: PBL-36499
* Source sync finds and uses pending certificate
When a source syncs certificates, it will check for a pending
certificate. If that is found via external_id (given by digicert as
order_id) then it will use the found Pending Certificate's fields to
create a new certificate. Then the pending certificate is deleted.
Tickets: PBL-36343
Change-Id: I4f7959da29275ebc47a3996741f7e98d3e2d29d9
* Add Lemur static files and views for pending certs
This adds the basic static files to view pending certificates in a
table.
Tickets: PBL-36343
Change-Id: Ia4362e6664ec730d05d280c5ef5c815a6feda0d9
* Add CLI and plugin based pending fetch
This change uses the adds a new function to issuer plugins to fetch
certificates like source, but for one order. This way, we can control
which pending certificates to try and populate instead of getting all
certificates from source.
Tickets: PBL-36343
Change-Id: Ifc1747ccdc2cba09a81f298b31ddddebfee1b1d6
* Revert source using Pending Certificate
Tickets: PBL-36343
Change-Id: I05121bc951e0530d804070afdb9c9e09baa0bc51
* Fix PendingCertificate init getting authority id
Should get authority id from authority.id instead of the authority_id
key in kwargs.
Change-Id: Ie56df1a5fb0ab2729e91050f3ad1a831853e0623
Tickets: n/a
* Add fixtures and basic test for PendingCertificate
Change-Id: I4cca34105544d40dac1cc50a87bba93d8af9ab34
Tickets: PBL-36343
* Add User to create_certificate parameters
create_certificate now takes a User, which will be used to populate the
'creator' field in certificates.service.upload(). This allows the UI
populate with the current user if the owner does not exist in Lemur.
+ Fix chain being replaced with version from pending certificate, which
may be empty (depends on plugin implementation).
Change-Id: I516027b36bc643c4978b9c4890060569e03f3049
Tickets: n/a
* Fix permalink and filters to pending certs
Fixes the permalink button to get a single pending certificate
Add argument filter parsing for the pending certificate API
Fix comment on API usage
Added get_by_name for pending_certificate (currently unused, but useful
for CLI, instead of using IDs)
Change-Id: Iaa48909c45606bec65dfb193c13d6bd0e816f6db
Tickets: PBL-36910
* Update displayed fields for Pending Certificates
There are a number of unused / unpopulated fields from Certificate UI
that does apply to Pending Certificates. Those ones were removed, and
added other useful fields:
Owner, number of attempts to fetch and date created
Change-Id: I3010a715f0357ba149cf539a19fdb5974c5ce08b
Tickets: PBL-36910
* Add common name (cn) to Pending Certificate model
Fixes the UI missing the CN for Pending Certificate, as it was
originally being parsed from the generated certificate. In the case of
pending certificate, the CN from the user generates the request, which
means a pending cert can trust the original user putting in the CN
instead of having to parse the not-yet-generated certificate. There is
no real possibility to return a certificate from a pending certificate
where the CN has changed since it was initially ordered.
Change-Id: I88a4fa28116d5d8d293e58970d9777ce73fbb2ab
Tickets: PBL-36910
* Fix missing imports for service filter
+ Removed duplicate get_by_name function from old merge
Change-Id: I04ae6852533aa42988433338de74390e2868d69b
Tickets: PBL-36910
* Add private key viewing to Pending Certificates
Add private key API for Pending Certificates, with the same
authorization as Certificates (only owner, creator or owner-roles can
view private key).
Change-Id: Ie5175154a10fe0007cc0e9f35b80c0a01ed48d5b
Tickets: PBL-36910
* Add edit capability to pending certificates
Like editing certificates, we should be able to modify some parts of a
pending certificate so the resulting certificate has the right
references, owner, etc.
+ Added API to update pending certificate
+ Fix UI to use pending certificate scope instead of reusing Certificate
+ Change pending_certificate.replaces to non-passive association, so
that updates do affect it (similar to roles/notifications/etc)
Tickets: PBL-36910
Change-Id: Ibbcb166a33f0337e1b14f426472261222f790ce6
* Add common_name parsing instead using kwargs
To fix tests where common name may not be passed in, use the CSR
generated to find the official common name.
Change-Id: I09f9258fa92c2762d095798676ce210c5d7a3da4
Tickets: PBL-36343
* Add Cancel to pending certificates and plugins
This allows pending certificates to be cancelled, which will be handled
by the issuer plugin.
Change-Id: Ibd6b5627c3977e33aca7860690cfb7f677236ca9
Tickets: PBL-36910
* Add API for Cancelling Pending Certificate
Added the DELETE handler for pending_certificates, which will cancel and
delete the pending certificate from the pending certs table on
successful cancellation via Issuer Plugin.
+ Add UT for testing cancel API
Change-Id: I11b1d87872e4284f6e4f9c366a15da4ddba38bc4
Tickets: PBL-36910
* Remove Export from Pending Certificates
Pending Certificates doesn't need an export since it should just be
fetched by Lemur via plugins, and the CSR is viewable via the UI.
Change-Id: I9a3e65ea11ac5a85316f6428e7f526c3c09178ae
Tickets: PBL-36910
* Add cancel button functionality to UI
This adds the Cancel option to the dropdown of pending certificates.
+ Adds modal window for Note (may not be required for all issuers, just
Digicert)
+ Add schema for cancel input
+ Fix Digitcert plugin for non-existant orders
When an order is actually issued, then attempting to cancel will return
a 403 from Digicert. This is a case where it should only be done once
we know the pending cert has been sitting for too long.
Change-Id: I256c81ecd142dd51dcf8e38802d2c202829887b0
Tickets: PBL-36910
* Fix test_pending_cancel UT
This change creates and injects a pending cert, which will then be used
for the ID so it can be canceled by the unit test.
Change-Id: I686e7e0fafd68cdaeb26438fb8504d79de77c346
Tickets: PBL-36343
* Fix test_digicert on non-existent order
cancelling a non-existent order is fine since we're cancelling it
Change-Id: I70c0e82ba2f4b8723a7f65b113c19e6eeff7e68c
Tickets: PBL-36343
* Add migrations for PendingCertificates
Added revision for Pending Certificates table and foreign key mapping
tables.
Change-Id: Ife8202cef1e6b99db377851264639ba540b749db
Tickets: n/a
* Fix relationship copy from Pending to Certificate
When a Pending Certificate is changed to a full Certificate, the
relationship fields are not copied via vars() function, as it's not a
column but mapped via association table. This adds an explicit copy for
these relations. Which will properly copy them to the new Certificate,
and thus also update destinations.
Change-Id: I322032ce4a9e3e67773f7cf39ee4971054c92685
Tickets: PBL-36343
* Fix renaming of certificates and unit tests
The rename flag was not used to rename certificates on creation as
expected.
Fixed unit test, instead of expunging the session, just copy the
pending_certificate so we don't have a weird reference to the object
that can't be copied via vars() function.
Change-Id: I962943272ed92386ab6eab2af4ed6d074d4cffa0
Tickets: PBL-36343
* Updated developer docs for async certs
Added blurb for implementing new issuer functions.
Change-Id: I1caed6e914bcd73214eae2d241e4784e1b8a0c4c
Tickets: n/a
2018-02-22 17:13:16 +01:00
|
|
|
from lemur.pending_certificates.models import PendingCertificate
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2017-02-03 20:21:53 +01:00
|
|
|
from lemur.certificates.schemas import CertificateOutputSchema, CertificateInputSchema
|
|
|
|
|
2016-05-25 02:10:19 +02:00
|
|
|
from lemur.roles import service as role_service
|
2015-06-22 22:47:27 +02:00
|
|
|
|
|
|
|
|
2017-08-29 02:35:56 +02:00
|
|
|
csr_created = signals.signal('csr_created', "CSR generated")
|
|
|
|
csr_imported = signals.signal('csr_imported', "CSR imported from external source")
|
|
|
|
certificate_issued = signals.signal('certificate_issued', "Authority issued a certificate")
|
|
|
|
certificate_imported = signals.signal('certificate_imported', "Certificate imported from external source")
|
|
|
|
|
|
|
|
|
2015-06-22 22:47:27 +02:00
|
|
|
def get(cert_id):
|
|
|
|
"""
|
2016-12-14 18:29:04 +01:00
|
|
|
Retrieves certificate by its ID.
|
2015-06-22 22:47:27 +02:00
|
|
|
|
|
|
|
:param cert_id:
|
|
|
|
:return:
|
|
|
|
"""
|
|
|
|
return database.get(Certificate, cert_id)
|
|
|
|
|
|
|
|
|
|
|
|
def get_by_name(name):
|
|
|
|
"""
|
2016-12-14 18:29:04 +01:00
|
|
|
Retrieves certificate by its Name.
|
2015-06-22 22:47:27 +02:00
|
|
|
|
|
|
|
:param name:
|
|
|
|
:return:
|
|
|
|
"""
|
|
|
|
return database.get(Certificate, name, field='name')
|
|
|
|
|
|
|
|
|
2017-10-05 01:56:01 +02:00
|
|
|
def get_by_serial(serial):
|
|
|
|
"""
|
|
|
|
Retrieves certificate by it's Serial.
|
|
|
|
:param serial:
|
|
|
|
:return:
|
|
|
|
"""
|
Async Certificate Issuing using Pending Certificates (#1037)
* Add PendingCertificate model
This change creates a DB table called pending_certificates and
associated mapping relationship tables from pending certificate to
roles, rotation policy, destination, sources, etc.
The table is generated on initialization of Lemur. A pending
certificate holds most of the information of a Certificate, while it has
not be issued so that it can later backfill the information when the CA
has issued the certificate.
Change-Id: I277c16b776a71fe5edaf0fa0e76bbedc88924db0
Tickets: PBL-36499
* Create a PendingCertificate if cert is empty
IssuePlugins should return empty cert bodies if the request failed to
complete immediately (such as Digicert). This way, we can immediately
return the certificate, or if not just place into PendingCertificates
for later processing.
+ Fix relation from Certificate to Pending Certificate, as view only.
There is no real need for anything more than that since Pending cert
only needs to know the cert to replace when it is issued later.
+ Made PendingCertificate private key be empty: UI does not allow
private key on 'Create' but only on 'Import'. For Instart, we require
the private key but upstream does not necessarily need it. Thus, if
someone at Instart wants to create a CSR / key combo, they should
manually issue the cert themselves and import later. Otherwise you
should let Lemur generate that. This keeps the workflow transparent for
upstream Lemur users.
Change-Id: Ib74722a5ed5792d4b10ca702659422739c95ae26
Tickets: PBL-36343
* Fix empty private_key when create Pending Cert
On creation of a certificate with a CSR, there is no option for private
key. In this case, we actually have a dictionary with private_key as
key, but the value is None. This fixes the strip() called on NoneType.
Change-Id: I7b265564d8095bfc83d9d4cd14ae13fea3c03199
Tickets: PBL-36499
* Source sync finds and uses pending certificate
When a source syncs certificates, it will check for a pending
certificate. If that is found via external_id (given by digicert as
order_id) then it will use the found Pending Certificate's fields to
create a new certificate. Then the pending certificate is deleted.
Tickets: PBL-36343
Change-Id: I4f7959da29275ebc47a3996741f7e98d3e2d29d9
* Add Lemur static files and views for pending certs
This adds the basic static files to view pending certificates in a
table.
Tickets: PBL-36343
Change-Id: Ia4362e6664ec730d05d280c5ef5c815a6feda0d9
* Add CLI and plugin based pending fetch
This change uses the adds a new function to issuer plugins to fetch
certificates like source, but for one order. This way, we can control
which pending certificates to try and populate instead of getting all
certificates from source.
Tickets: PBL-36343
Change-Id: Ifc1747ccdc2cba09a81f298b31ddddebfee1b1d6
* Revert source using Pending Certificate
Tickets: PBL-36343
Change-Id: I05121bc951e0530d804070afdb9c9e09baa0bc51
* Fix PendingCertificate init getting authority id
Should get authority id from authority.id instead of the authority_id
key in kwargs.
Change-Id: Ie56df1a5fb0ab2729e91050f3ad1a831853e0623
Tickets: n/a
* Add fixtures and basic test for PendingCertificate
Change-Id: I4cca34105544d40dac1cc50a87bba93d8af9ab34
Tickets: PBL-36343
* Add User to create_certificate parameters
create_certificate now takes a User, which will be used to populate the
'creator' field in certificates.service.upload(). This allows the UI
populate with the current user if the owner does not exist in Lemur.
+ Fix chain being replaced with version from pending certificate, which
may be empty (depends on plugin implementation).
Change-Id: I516027b36bc643c4978b9c4890060569e03f3049
Tickets: n/a
* Fix permalink and filters to pending certs
Fixes the permalink button to get a single pending certificate
Add argument filter parsing for the pending certificate API
Fix comment on API usage
Added get_by_name for pending_certificate (currently unused, but useful
for CLI, instead of using IDs)
Change-Id: Iaa48909c45606bec65dfb193c13d6bd0e816f6db
Tickets: PBL-36910
* Update displayed fields for Pending Certificates
There are a number of unused / unpopulated fields from Certificate UI
that does apply to Pending Certificates. Those ones were removed, and
added other useful fields:
Owner, number of attempts to fetch and date created
Change-Id: I3010a715f0357ba149cf539a19fdb5974c5ce08b
Tickets: PBL-36910
* Add common name (cn) to Pending Certificate model
Fixes the UI missing the CN for Pending Certificate, as it was
originally being parsed from the generated certificate. In the case of
pending certificate, the CN from the user generates the request, which
means a pending cert can trust the original user putting in the CN
instead of having to parse the not-yet-generated certificate. There is
no real possibility to return a certificate from a pending certificate
where the CN has changed since it was initially ordered.
Change-Id: I88a4fa28116d5d8d293e58970d9777ce73fbb2ab
Tickets: PBL-36910
* Fix missing imports for service filter
+ Removed duplicate get_by_name function from old merge
Change-Id: I04ae6852533aa42988433338de74390e2868d69b
Tickets: PBL-36910
* Add private key viewing to Pending Certificates
Add private key API for Pending Certificates, with the same
authorization as Certificates (only owner, creator or owner-roles can
view private key).
Change-Id: Ie5175154a10fe0007cc0e9f35b80c0a01ed48d5b
Tickets: PBL-36910
* Add edit capability to pending certificates
Like editing certificates, we should be able to modify some parts of a
pending certificate so the resulting certificate has the right
references, owner, etc.
+ Added API to update pending certificate
+ Fix UI to use pending certificate scope instead of reusing Certificate
+ Change pending_certificate.replaces to non-passive association, so
that updates do affect it (similar to roles/notifications/etc)
Tickets: PBL-36910
Change-Id: Ibbcb166a33f0337e1b14f426472261222f790ce6
* Add common_name parsing instead using kwargs
To fix tests where common name may not be passed in, use the CSR
generated to find the official common name.
Change-Id: I09f9258fa92c2762d095798676ce210c5d7a3da4
Tickets: PBL-36343
* Add Cancel to pending certificates and plugins
This allows pending certificates to be cancelled, which will be handled
by the issuer plugin.
Change-Id: Ibd6b5627c3977e33aca7860690cfb7f677236ca9
Tickets: PBL-36910
* Add API for Cancelling Pending Certificate
Added the DELETE handler for pending_certificates, which will cancel and
delete the pending certificate from the pending certs table on
successful cancellation via Issuer Plugin.
+ Add UT for testing cancel API
Change-Id: I11b1d87872e4284f6e4f9c366a15da4ddba38bc4
Tickets: PBL-36910
* Remove Export from Pending Certificates
Pending Certificates doesn't need an export since it should just be
fetched by Lemur via plugins, and the CSR is viewable via the UI.
Change-Id: I9a3e65ea11ac5a85316f6428e7f526c3c09178ae
Tickets: PBL-36910
* Add cancel button functionality to UI
This adds the Cancel option to the dropdown of pending certificates.
+ Adds modal window for Note (may not be required for all issuers, just
Digicert)
+ Add schema for cancel input
+ Fix Digitcert plugin for non-existant orders
When an order is actually issued, then attempting to cancel will return
a 403 from Digicert. This is a case where it should only be done once
we know the pending cert has been sitting for too long.
Change-Id: I256c81ecd142dd51dcf8e38802d2c202829887b0
Tickets: PBL-36910
* Fix test_pending_cancel UT
This change creates and injects a pending cert, which will then be used
for the ID so it can be canceled by the unit test.
Change-Id: I686e7e0fafd68cdaeb26438fb8504d79de77c346
Tickets: PBL-36343
* Fix test_digicert on non-existent order
cancelling a non-existent order is fine since we're cancelling it
Change-Id: I70c0e82ba2f4b8723a7f65b113c19e6eeff7e68c
Tickets: PBL-36343
* Add migrations for PendingCertificates
Added revision for Pending Certificates table and foreign key mapping
tables.
Change-Id: Ife8202cef1e6b99db377851264639ba540b749db
Tickets: n/a
* Fix relationship copy from Pending to Certificate
When a Pending Certificate is changed to a full Certificate, the
relationship fields are not copied via vars() function, as it's not a
column but mapped via association table. This adds an explicit copy for
these relations. Which will properly copy them to the new Certificate,
and thus also update destinations.
Change-Id: I322032ce4a9e3e67773f7cf39ee4971054c92685
Tickets: PBL-36343
* Fix renaming of certificates and unit tests
The rename flag was not used to rename certificates on creation as
expected.
Fixed unit test, instead of expunging the session, just copy the
pending_certificate so we don't have a weird reference to the object
that can't be copied via vars() function.
Change-Id: I962943272ed92386ab6eab2af4ed6d074d4cffa0
Tickets: PBL-36343
* Updated developer docs for async certs
Added blurb for implementing new issuer functions.
Change-Id: I1caed6e914bcd73214eae2d241e4784e1b8a0c4c
Tickets: n/a
2018-02-22 17:13:16 +01:00
|
|
|
if isinstance(serial, int):
|
|
|
|
# although serial is a number, the DB column is String(128)
|
|
|
|
serial = str(serial)
|
2017-10-06 22:22:03 +02:00
|
|
|
return Certificate.query.filter(Certificate.serial == serial).all()
|
2017-10-05 01:56:01 +02:00
|
|
|
|
|
|
|
|
2015-06-22 22:47:27 +02:00
|
|
|
def delete(cert_id):
|
|
|
|
"""
|
|
|
|
Delete's a certificate.
|
|
|
|
|
|
|
|
:param cert_id:
|
|
|
|
"""
|
|
|
|
database.delete(get(cert_id))
|
|
|
|
|
|
|
|
|
|
|
|
def get_all_certs():
|
|
|
|
"""
|
|
|
|
Retrieves all certificates within Lemur.
|
|
|
|
|
|
|
|
:return:
|
|
|
|
"""
|
|
|
|
return Certificate.query.all()
|
|
|
|
|
|
|
|
|
2016-12-27 19:31:33 +01:00
|
|
|
def get_all_pending_cleaning(source):
|
2016-07-12 17:40:49 +02:00
|
|
|
"""
|
2016-12-27 19:31:33 +01:00
|
|
|
Retrieves all certificates that are available for cleaning.
|
2016-07-12 17:40:49 +02:00
|
|
|
|
2016-12-27 19:31:33 +01:00
|
|
|
:param source:
|
2016-07-12 17:40:49 +02:00
|
|
|
:return:
|
|
|
|
"""
|
2016-12-27 19:31:33 +01:00
|
|
|
return Certificate.query.filter(Certificate.sources.any(id=source.id))\
|
|
|
|
.filter(not_(Certificate.endpoints.any())).all()
|
2016-07-12 17:40:49 +02:00
|
|
|
|
|
|
|
|
2016-12-23 22:18:42 +01:00
|
|
|
def get_all_pending_reissue():
|
2016-12-08 01:24:59 +01:00
|
|
|
"""
|
|
|
|
Retrieves all certificates that need to be rotated.
|
|
|
|
|
2017-07-13 01:46:11 +02:00
|
|
|
Must be X days from expiration, uses the certificates rotation
|
|
|
|
policy to determine how many days from expiration the certificate must be
|
2016-12-08 01:24:59 +01:00
|
|
|
for rotation to be pending.
|
|
|
|
|
|
|
|
:return:
|
|
|
|
"""
|
|
|
|
return Certificate.query.filter(Certificate.rotation == True)\
|
2016-12-23 22:18:42 +01:00
|
|
|
.filter(not_(Certificate.replaced.any()))\
|
2017-07-13 01:46:11 +02:00
|
|
|
.filter(Certificate.in_rotation_window == True).all() # noqa
|
2016-12-08 01:24:59 +01:00
|
|
|
|
|
|
|
|
2016-07-28 22:08:24 +02:00
|
|
|
def find_duplicates(cert):
|
2015-06-22 22:47:27 +02:00
|
|
|
"""
|
|
|
|
Finds certificates that already exist within Lemur. We do this by looking for
|
|
|
|
certificate bodies that are the same. This is the most reliable way to determine
|
|
|
|
if a certificate is already being tracked by Lemur.
|
|
|
|
|
2016-07-28 22:08:24 +02:00
|
|
|
:param cert:
|
2015-06-22 22:47:27 +02:00
|
|
|
:return:
|
|
|
|
"""
|
2016-12-06 21:05:18 +01:00
|
|
|
if cert['chain']:
|
|
|
|
return Certificate.query.filter_by(body=cert['body'].strip(), chain=cert['chain'].strip()).all()
|
2016-11-17 23:47:10 +01:00
|
|
|
else:
|
2016-12-06 21:05:18 +01:00
|
|
|
return Certificate.query.filter_by(body=cert['body'].strip(), chain=None).all()
|
2015-06-22 22:47:27 +02:00
|
|
|
|
|
|
|
|
2015-11-27 22:27:14 +01:00
|
|
|
def export(cert, export_plugin):
|
2015-11-25 23:54:08 +01:00
|
|
|
"""
|
|
|
|
Exports a certificate to the requested format. This format
|
|
|
|
may be a binary format.
|
2015-11-27 22:27:14 +01:00
|
|
|
|
|
|
|
:param export_plugin:
|
|
|
|
:param cert:
|
2015-11-25 23:54:08 +01:00
|
|
|
:return:
|
|
|
|
"""
|
2015-11-27 22:27:14 +01:00
|
|
|
plugin = plugins.get(export_plugin['slug'])
|
|
|
|
return plugin.export(cert.body, cert.chain, cert.private_key, export_plugin['pluginOptions'])
|
2015-11-25 23:54:08 +01:00
|
|
|
|
|
|
|
|
2016-12-27 00:55:11 +01:00
|
|
|
def update(cert_id, **kwargs):
|
2015-06-22 22:47:27 +02:00
|
|
|
"""
|
2015-11-24 23:53:22 +01:00
|
|
|
Updates a certificate
|
2015-06-22 22:47:27 +02:00
|
|
|
:param cert_id:
|
|
|
|
:return:
|
|
|
|
"""
|
|
|
|
cert = get(cert_id)
|
2016-12-27 00:55:11 +01:00
|
|
|
|
|
|
|
for key, value in kwargs.items():
|
|
|
|
setattr(cert, key, value)
|
2015-08-29 22:07:30 +02:00
|
|
|
|
2015-06-22 22:47:27 +02:00
|
|
|
return database.update(cert)
|
|
|
|
|
|
|
|
|
2016-05-25 02:10:19 +02:00
|
|
|
def create_certificate_roles(**kwargs):
|
|
|
|
# create an role for the owner and assign it
|
|
|
|
owner_role = role_service.get_by_name(kwargs['owner'])
|
2016-11-26 05:35:07 +01:00
|
|
|
|
2016-05-25 02:10:19 +02:00
|
|
|
if not owner_role:
|
|
|
|
owner_role = role_service.create(
|
|
|
|
kwargs['owner'],
|
|
|
|
description="Auto generated role based on owner: {0}".format(kwargs['owner'])
|
|
|
|
)
|
|
|
|
|
2016-11-26 05:35:07 +01:00
|
|
|
# ensure that the authority's owner is also associated with the certificate
|
|
|
|
if kwargs.get('authority'):
|
|
|
|
authority_owner_role = role_service.get_by_name(kwargs['authority'].owner)
|
|
|
|
return [owner_role, authority_owner_role]
|
|
|
|
|
2016-06-01 20:18:00 +02:00
|
|
|
return [owner_role]
|
2016-05-25 02:10:19 +02:00
|
|
|
|
|
|
|
|
2016-05-20 18:03:34 +02:00
|
|
|
def mint(**kwargs):
|
2015-06-22 22:47:27 +02:00
|
|
|
"""
|
|
|
|
Minting is slightly different for each authority.
|
|
|
|
Support for multiple authorities is handled by individual plugins.
|
|
|
|
|
|
|
|
"""
|
2016-05-20 18:03:34 +02:00
|
|
|
authority = kwargs['authority']
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2015-07-04 21:47:57 +02:00
|
|
|
issuer = plugins.get(authority.plugin_name)
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2015-12-29 04:00:29 +01:00
|
|
|
# allow the CSR to be specified by the user
|
2016-05-20 18:03:34 +02:00
|
|
|
if not kwargs.get('csr'):
|
|
|
|
csr, private_key = create_csr(**kwargs)
|
2017-08-29 02:35:56 +02:00
|
|
|
csr_created.send(authority=authority, csr=csr)
|
2015-12-29 04:00:29 +01:00
|
|
|
else:
|
2016-05-20 18:03:34 +02:00
|
|
|
csr = str(kwargs.get('csr'))
|
2015-12-29 04:00:29 +01:00
|
|
|
private_key = None
|
2017-08-29 02:35:56 +02:00
|
|
|
csr_imported.send(authority=authority, csr=csr)
|
2015-07-02 21:10:09 +02:00
|
|
|
|
2017-09-29 03:27:56 +02:00
|
|
|
cert_body, cert_chain, external_id = issuer.create_certificate(csr, kwargs)
|
Async Certificate Issuing using Pending Certificates (#1037)
* Add PendingCertificate model
This change creates a DB table called pending_certificates and
associated mapping relationship tables from pending certificate to
roles, rotation policy, destination, sources, etc.
The table is generated on initialization of Lemur. A pending
certificate holds most of the information of a Certificate, while it has
not be issued so that it can later backfill the information when the CA
has issued the certificate.
Change-Id: I277c16b776a71fe5edaf0fa0e76bbedc88924db0
Tickets: PBL-36499
* Create a PendingCertificate if cert is empty
IssuePlugins should return empty cert bodies if the request failed to
complete immediately (such as Digicert). This way, we can immediately
return the certificate, or if not just place into PendingCertificates
for later processing.
+ Fix relation from Certificate to Pending Certificate, as view only.
There is no real need for anything more than that since Pending cert
only needs to know the cert to replace when it is issued later.
+ Made PendingCertificate private key be empty: UI does not allow
private key on 'Create' but only on 'Import'. For Instart, we require
the private key but upstream does not necessarily need it. Thus, if
someone at Instart wants to create a CSR / key combo, they should
manually issue the cert themselves and import later. Otherwise you
should let Lemur generate that. This keeps the workflow transparent for
upstream Lemur users.
Change-Id: Ib74722a5ed5792d4b10ca702659422739c95ae26
Tickets: PBL-36343
* Fix empty private_key when create Pending Cert
On creation of a certificate with a CSR, there is no option for private
key. In this case, we actually have a dictionary with private_key as
key, but the value is None. This fixes the strip() called on NoneType.
Change-Id: I7b265564d8095bfc83d9d4cd14ae13fea3c03199
Tickets: PBL-36499
* Source sync finds and uses pending certificate
When a source syncs certificates, it will check for a pending
certificate. If that is found via external_id (given by digicert as
order_id) then it will use the found Pending Certificate's fields to
create a new certificate. Then the pending certificate is deleted.
Tickets: PBL-36343
Change-Id: I4f7959da29275ebc47a3996741f7e98d3e2d29d9
* Add Lemur static files and views for pending certs
This adds the basic static files to view pending certificates in a
table.
Tickets: PBL-36343
Change-Id: Ia4362e6664ec730d05d280c5ef5c815a6feda0d9
* Add CLI and plugin based pending fetch
This change uses the adds a new function to issuer plugins to fetch
certificates like source, but for one order. This way, we can control
which pending certificates to try and populate instead of getting all
certificates from source.
Tickets: PBL-36343
Change-Id: Ifc1747ccdc2cba09a81f298b31ddddebfee1b1d6
* Revert source using Pending Certificate
Tickets: PBL-36343
Change-Id: I05121bc951e0530d804070afdb9c9e09baa0bc51
* Fix PendingCertificate init getting authority id
Should get authority id from authority.id instead of the authority_id
key in kwargs.
Change-Id: Ie56df1a5fb0ab2729e91050f3ad1a831853e0623
Tickets: n/a
* Add fixtures and basic test for PendingCertificate
Change-Id: I4cca34105544d40dac1cc50a87bba93d8af9ab34
Tickets: PBL-36343
* Add User to create_certificate parameters
create_certificate now takes a User, which will be used to populate the
'creator' field in certificates.service.upload(). This allows the UI
populate with the current user if the owner does not exist in Lemur.
+ Fix chain being replaced with version from pending certificate, which
may be empty (depends on plugin implementation).
Change-Id: I516027b36bc643c4978b9c4890060569e03f3049
Tickets: n/a
* Fix permalink and filters to pending certs
Fixes the permalink button to get a single pending certificate
Add argument filter parsing for the pending certificate API
Fix comment on API usage
Added get_by_name for pending_certificate (currently unused, but useful
for CLI, instead of using IDs)
Change-Id: Iaa48909c45606bec65dfb193c13d6bd0e816f6db
Tickets: PBL-36910
* Update displayed fields for Pending Certificates
There are a number of unused / unpopulated fields from Certificate UI
that does apply to Pending Certificates. Those ones were removed, and
added other useful fields:
Owner, number of attempts to fetch and date created
Change-Id: I3010a715f0357ba149cf539a19fdb5974c5ce08b
Tickets: PBL-36910
* Add common name (cn) to Pending Certificate model
Fixes the UI missing the CN for Pending Certificate, as it was
originally being parsed from the generated certificate. In the case of
pending certificate, the CN from the user generates the request, which
means a pending cert can trust the original user putting in the CN
instead of having to parse the not-yet-generated certificate. There is
no real possibility to return a certificate from a pending certificate
where the CN has changed since it was initially ordered.
Change-Id: I88a4fa28116d5d8d293e58970d9777ce73fbb2ab
Tickets: PBL-36910
* Fix missing imports for service filter
+ Removed duplicate get_by_name function from old merge
Change-Id: I04ae6852533aa42988433338de74390e2868d69b
Tickets: PBL-36910
* Add private key viewing to Pending Certificates
Add private key API for Pending Certificates, with the same
authorization as Certificates (only owner, creator or owner-roles can
view private key).
Change-Id: Ie5175154a10fe0007cc0e9f35b80c0a01ed48d5b
Tickets: PBL-36910
* Add edit capability to pending certificates
Like editing certificates, we should be able to modify some parts of a
pending certificate so the resulting certificate has the right
references, owner, etc.
+ Added API to update pending certificate
+ Fix UI to use pending certificate scope instead of reusing Certificate
+ Change pending_certificate.replaces to non-passive association, so
that updates do affect it (similar to roles/notifications/etc)
Tickets: PBL-36910
Change-Id: Ibbcb166a33f0337e1b14f426472261222f790ce6
* Add common_name parsing instead using kwargs
To fix tests where common name may not be passed in, use the CSR
generated to find the official common name.
Change-Id: I09f9258fa92c2762d095798676ce210c5d7a3da4
Tickets: PBL-36343
* Add Cancel to pending certificates and plugins
This allows pending certificates to be cancelled, which will be handled
by the issuer plugin.
Change-Id: Ibd6b5627c3977e33aca7860690cfb7f677236ca9
Tickets: PBL-36910
* Add API for Cancelling Pending Certificate
Added the DELETE handler for pending_certificates, which will cancel and
delete the pending certificate from the pending certs table on
successful cancellation via Issuer Plugin.
+ Add UT for testing cancel API
Change-Id: I11b1d87872e4284f6e4f9c366a15da4ddba38bc4
Tickets: PBL-36910
* Remove Export from Pending Certificates
Pending Certificates doesn't need an export since it should just be
fetched by Lemur via plugins, and the CSR is viewable via the UI.
Change-Id: I9a3e65ea11ac5a85316f6428e7f526c3c09178ae
Tickets: PBL-36910
* Add cancel button functionality to UI
This adds the Cancel option to the dropdown of pending certificates.
+ Adds modal window for Note (may not be required for all issuers, just
Digicert)
+ Add schema for cancel input
+ Fix Digitcert plugin for non-existant orders
When an order is actually issued, then attempting to cancel will return
a 403 from Digicert. This is a case where it should only be done once
we know the pending cert has been sitting for too long.
Change-Id: I256c81ecd142dd51dcf8e38802d2c202829887b0
Tickets: PBL-36910
* Fix test_pending_cancel UT
This change creates and injects a pending cert, which will then be used
for the ID so it can be canceled by the unit test.
Change-Id: I686e7e0fafd68cdaeb26438fb8504d79de77c346
Tickets: PBL-36343
* Fix test_digicert on non-existent order
cancelling a non-existent order is fine since we're cancelling it
Change-Id: I70c0e82ba2f4b8723a7f65b113c19e6eeff7e68c
Tickets: PBL-36343
* Add migrations for PendingCertificates
Added revision for Pending Certificates table and foreign key mapping
tables.
Change-Id: Ife8202cef1e6b99db377851264639ba540b749db
Tickets: n/a
* Fix relationship copy from Pending to Certificate
When a Pending Certificate is changed to a full Certificate, the
relationship fields are not copied via vars() function, as it's not a
column but mapped via association table. This adds an explicit copy for
these relations. Which will properly copy them to the new Certificate,
and thus also update destinations.
Change-Id: I322032ce4a9e3e67773f7cf39ee4971054c92685
Tickets: PBL-36343
* Fix renaming of certificates and unit tests
The rename flag was not used to rename certificates on creation as
expected.
Fixed unit test, instead of expunging the session, just copy the
pending_certificate so we don't have a weird reference to the object
that can't be copied via vars() function.
Change-Id: I962943272ed92386ab6eab2af4ed6d074d4cffa0
Tickets: PBL-36343
* Updated developer docs for async certs
Added blurb for implementing new issuer functions.
Change-Id: I1caed6e914bcd73214eae2d241e4784e1b8a0c4c
Tickets: n/a
2018-02-22 17:13:16 +01:00
|
|
|
return cert_body, private_key, cert_chain, external_id, csr
|
2015-06-22 22:47:27 +02:00
|
|
|
|
|
|
|
|
|
|
|
def import_certificate(**kwargs):
|
|
|
|
"""
|
|
|
|
Uploads already minted certificates and pulls the required information into Lemur.
|
|
|
|
|
2015-07-03 19:30:17 +02:00
|
|
|
This is to be used for certificates that are created outside of Lemur but
|
2015-06-22 22:47:27 +02:00
|
|
|
should still be tracked.
|
|
|
|
|
|
|
|
Internally this is used to bootstrap Lemur with external
|
|
|
|
certificates, and used when certificates are 'discovered' through various discovery
|
|
|
|
techniques. was still in aws.
|
|
|
|
|
|
|
|
:param kwargs:
|
|
|
|
"""
|
2016-05-20 18:03:34 +02:00
|
|
|
if not kwargs.get('owner'):
|
|
|
|
kwargs['owner'] = current_app.config.get('LEMUR_SECURITY_TEAM_EMAIL')[0]
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2016-05-20 18:03:34 +02:00
|
|
|
return upload(**kwargs)
|
2015-06-22 22:47:27 +02:00
|
|
|
|
|
|
|
|
|
|
|
def upload(**kwargs):
|
|
|
|
"""
|
|
|
|
Allows for pre-made certificates to be imported into Lemur.
|
|
|
|
"""
|
2016-06-01 20:18:00 +02:00
|
|
|
roles = create_certificate_roles(**kwargs)
|
|
|
|
|
|
|
|
if kwargs.get('roles'):
|
|
|
|
kwargs['roles'] += roles
|
|
|
|
else:
|
|
|
|
kwargs['roles'] = roles
|
2016-05-25 02:10:19 +02:00
|
|
|
|
2016-10-09 02:04:54 +02:00
|
|
|
if kwargs.get('private_key'):
|
|
|
|
private_key = kwargs['private_key']
|
|
|
|
if not isinstance(private_key, bytes):
|
|
|
|
kwargs['private_key'] = private_key.encode('utf-8')
|
|
|
|
|
2016-05-20 18:03:34 +02:00
|
|
|
cert = Certificate(**kwargs)
|
2015-06-22 22:47:27 +02:00
|
|
|
|
|
|
|
cert = database.create(cert)
|
2015-08-02 14:57:26 +02:00
|
|
|
|
2016-11-18 20:27:46 +01:00
|
|
|
kwargs['creator'].certificates.append(cert)
|
2017-08-29 02:35:56 +02:00
|
|
|
|
|
|
|
cert = database.update(cert)
|
|
|
|
certificate_imported.send(certificate=cert, authority=cert.authority)
|
|
|
|
return cert
|
2015-06-22 22:47:27 +02:00
|
|
|
|
|
|
|
|
|
|
|
def create(**kwargs):
|
|
|
|
"""
|
|
|
|
Creates a new certificate.
|
|
|
|
"""
|
2018-07-20 19:47:19 +02:00
|
|
|
try:
|
|
|
|
cert_body, private_key, cert_chain, external_id, csr = mint(**kwargs)
|
|
|
|
except:
|
|
|
|
current_app.logger.error("Exception minting certificate", exc_info=True)
|
|
|
|
sentry.captureException()
|
|
|
|
raise
|
2016-05-20 18:03:34 +02:00
|
|
|
kwargs['body'] = cert_body
|
|
|
|
kwargs['private_key'] = private_key
|
|
|
|
kwargs['chain'] = cert_chain
|
2017-09-29 03:27:56 +02:00
|
|
|
kwargs['external_id'] = external_id
|
Async Certificate Issuing using Pending Certificates (#1037)
* Add PendingCertificate model
This change creates a DB table called pending_certificates and
associated mapping relationship tables from pending certificate to
roles, rotation policy, destination, sources, etc.
The table is generated on initialization of Lemur. A pending
certificate holds most of the information of a Certificate, while it has
not be issued so that it can later backfill the information when the CA
has issued the certificate.
Change-Id: I277c16b776a71fe5edaf0fa0e76bbedc88924db0
Tickets: PBL-36499
* Create a PendingCertificate if cert is empty
IssuePlugins should return empty cert bodies if the request failed to
complete immediately (such as Digicert). This way, we can immediately
return the certificate, or if not just place into PendingCertificates
for later processing.
+ Fix relation from Certificate to Pending Certificate, as view only.
There is no real need for anything more than that since Pending cert
only needs to know the cert to replace when it is issued later.
+ Made PendingCertificate private key be empty: UI does not allow
private key on 'Create' but only on 'Import'. For Instart, we require
the private key but upstream does not necessarily need it. Thus, if
someone at Instart wants to create a CSR / key combo, they should
manually issue the cert themselves and import later. Otherwise you
should let Lemur generate that. This keeps the workflow transparent for
upstream Lemur users.
Change-Id: Ib74722a5ed5792d4b10ca702659422739c95ae26
Tickets: PBL-36343
* Fix empty private_key when create Pending Cert
On creation of a certificate with a CSR, there is no option for private
key. In this case, we actually have a dictionary with private_key as
key, but the value is None. This fixes the strip() called on NoneType.
Change-Id: I7b265564d8095bfc83d9d4cd14ae13fea3c03199
Tickets: PBL-36499
* Source sync finds and uses pending certificate
When a source syncs certificates, it will check for a pending
certificate. If that is found via external_id (given by digicert as
order_id) then it will use the found Pending Certificate's fields to
create a new certificate. Then the pending certificate is deleted.
Tickets: PBL-36343
Change-Id: I4f7959da29275ebc47a3996741f7e98d3e2d29d9
* Add Lemur static files and views for pending certs
This adds the basic static files to view pending certificates in a
table.
Tickets: PBL-36343
Change-Id: Ia4362e6664ec730d05d280c5ef5c815a6feda0d9
* Add CLI and plugin based pending fetch
This change uses the adds a new function to issuer plugins to fetch
certificates like source, but for one order. This way, we can control
which pending certificates to try and populate instead of getting all
certificates from source.
Tickets: PBL-36343
Change-Id: Ifc1747ccdc2cba09a81f298b31ddddebfee1b1d6
* Revert source using Pending Certificate
Tickets: PBL-36343
Change-Id: I05121bc951e0530d804070afdb9c9e09baa0bc51
* Fix PendingCertificate init getting authority id
Should get authority id from authority.id instead of the authority_id
key in kwargs.
Change-Id: Ie56df1a5fb0ab2729e91050f3ad1a831853e0623
Tickets: n/a
* Add fixtures and basic test for PendingCertificate
Change-Id: I4cca34105544d40dac1cc50a87bba93d8af9ab34
Tickets: PBL-36343
* Add User to create_certificate parameters
create_certificate now takes a User, which will be used to populate the
'creator' field in certificates.service.upload(). This allows the UI
populate with the current user if the owner does not exist in Lemur.
+ Fix chain being replaced with version from pending certificate, which
may be empty (depends on plugin implementation).
Change-Id: I516027b36bc643c4978b9c4890060569e03f3049
Tickets: n/a
* Fix permalink and filters to pending certs
Fixes the permalink button to get a single pending certificate
Add argument filter parsing for the pending certificate API
Fix comment on API usage
Added get_by_name for pending_certificate (currently unused, but useful
for CLI, instead of using IDs)
Change-Id: Iaa48909c45606bec65dfb193c13d6bd0e816f6db
Tickets: PBL-36910
* Update displayed fields for Pending Certificates
There are a number of unused / unpopulated fields from Certificate UI
that does apply to Pending Certificates. Those ones were removed, and
added other useful fields:
Owner, number of attempts to fetch and date created
Change-Id: I3010a715f0357ba149cf539a19fdb5974c5ce08b
Tickets: PBL-36910
* Add common name (cn) to Pending Certificate model
Fixes the UI missing the CN for Pending Certificate, as it was
originally being parsed from the generated certificate. In the case of
pending certificate, the CN from the user generates the request, which
means a pending cert can trust the original user putting in the CN
instead of having to parse the not-yet-generated certificate. There is
no real possibility to return a certificate from a pending certificate
where the CN has changed since it was initially ordered.
Change-Id: I88a4fa28116d5d8d293e58970d9777ce73fbb2ab
Tickets: PBL-36910
* Fix missing imports for service filter
+ Removed duplicate get_by_name function from old merge
Change-Id: I04ae6852533aa42988433338de74390e2868d69b
Tickets: PBL-36910
* Add private key viewing to Pending Certificates
Add private key API for Pending Certificates, with the same
authorization as Certificates (only owner, creator or owner-roles can
view private key).
Change-Id: Ie5175154a10fe0007cc0e9f35b80c0a01ed48d5b
Tickets: PBL-36910
* Add edit capability to pending certificates
Like editing certificates, we should be able to modify some parts of a
pending certificate so the resulting certificate has the right
references, owner, etc.
+ Added API to update pending certificate
+ Fix UI to use pending certificate scope instead of reusing Certificate
+ Change pending_certificate.replaces to non-passive association, so
that updates do affect it (similar to roles/notifications/etc)
Tickets: PBL-36910
Change-Id: Ibbcb166a33f0337e1b14f426472261222f790ce6
* Add common_name parsing instead using kwargs
To fix tests where common name may not be passed in, use the CSR
generated to find the official common name.
Change-Id: I09f9258fa92c2762d095798676ce210c5d7a3da4
Tickets: PBL-36343
* Add Cancel to pending certificates and plugins
This allows pending certificates to be cancelled, which will be handled
by the issuer plugin.
Change-Id: Ibd6b5627c3977e33aca7860690cfb7f677236ca9
Tickets: PBL-36910
* Add API for Cancelling Pending Certificate
Added the DELETE handler for pending_certificates, which will cancel and
delete the pending certificate from the pending certs table on
successful cancellation via Issuer Plugin.
+ Add UT for testing cancel API
Change-Id: I11b1d87872e4284f6e4f9c366a15da4ddba38bc4
Tickets: PBL-36910
* Remove Export from Pending Certificates
Pending Certificates doesn't need an export since it should just be
fetched by Lemur via plugins, and the CSR is viewable via the UI.
Change-Id: I9a3e65ea11ac5a85316f6428e7f526c3c09178ae
Tickets: PBL-36910
* Add cancel button functionality to UI
This adds the Cancel option to the dropdown of pending certificates.
+ Adds modal window for Note (may not be required for all issuers, just
Digicert)
+ Add schema for cancel input
+ Fix Digitcert plugin for non-existant orders
When an order is actually issued, then attempting to cancel will return
a 403 from Digicert. This is a case where it should only be done once
we know the pending cert has been sitting for too long.
Change-Id: I256c81ecd142dd51dcf8e38802d2c202829887b0
Tickets: PBL-36910
* Fix test_pending_cancel UT
This change creates and injects a pending cert, which will then be used
for the ID so it can be canceled by the unit test.
Change-Id: I686e7e0fafd68cdaeb26438fb8504d79de77c346
Tickets: PBL-36343
* Fix test_digicert on non-existent order
cancelling a non-existent order is fine since we're cancelling it
Change-Id: I70c0e82ba2f4b8723a7f65b113c19e6eeff7e68c
Tickets: PBL-36343
* Add migrations for PendingCertificates
Added revision for Pending Certificates table and foreign key mapping
tables.
Change-Id: Ife8202cef1e6b99db377851264639ba540b749db
Tickets: n/a
* Fix relationship copy from Pending to Certificate
When a Pending Certificate is changed to a full Certificate, the
relationship fields are not copied via vars() function, as it's not a
column but mapped via association table. This adds an explicit copy for
these relations. Which will properly copy them to the new Certificate,
and thus also update destinations.
Change-Id: I322032ce4a9e3e67773f7cf39ee4971054c92685
Tickets: PBL-36343
* Fix renaming of certificates and unit tests
The rename flag was not used to rename certificates on creation as
expected.
Fixed unit test, instead of expunging the session, just copy the
pending_certificate so we don't have a weird reference to the object
that can't be copied via vars() function.
Change-Id: I962943272ed92386ab6eab2af4ed6d074d4cffa0
Tickets: PBL-36343
* Updated developer docs for async certs
Added blurb for implementing new issuer functions.
Change-Id: I1caed6e914bcd73214eae2d241e4784e1b8a0c4c
Tickets: n/a
2018-02-22 17:13:16 +01:00
|
|
|
kwargs['csr'] = csr
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2016-06-01 20:18:00 +02:00
|
|
|
roles = create_certificate_roles(**kwargs)
|
|
|
|
|
|
|
|
if kwargs.get('roles'):
|
|
|
|
kwargs['roles'] += roles
|
|
|
|
else:
|
|
|
|
kwargs['roles'] = roles
|
2016-05-25 02:10:19 +02:00
|
|
|
|
Async Certificate Issuing using Pending Certificates (#1037)
* Add PendingCertificate model
This change creates a DB table called pending_certificates and
associated mapping relationship tables from pending certificate to
roles, rotation policy, destination, sources, etc.
The table is generated on initialization of Lemur. A pending
certificate holds most of the information of a Certificate, while it has
not be issued so that it can later backfill the information when the CA
has issued the certificate.
Change-Id: I277c16b776a71fe5edaf0fa0e76bbedc88924db0
Tickets: PBL-36499
* Create a PendingCertificate if cert is empty
IssuePlugins should return empty cert bodies if the request failed to
complete immediately (such as Digicert). This way, we can immediately
return the certificate, or if not just place into PendingCertificates
for later processing.
+ Fix relation from Certificate to Pending Certificate, as view only.
There is no real need for anything more than that since Pending cert
only needs to know the cert to replace when it is issued later.
+ Made PendingCertificate private key be empty: UI does not allow
private key on 'Create' but only on 'Import'. For Instart, we require
the private key but upstream does not necessarily need it. Thus, if
someone at Instart wants to create a CSR / key combo, they should
manually issue the cert themselves and import later. Otherwise you
should let Lemur generate that. This keeps the workflow transparent for
upstream Lemur users.
Change-Id: Ib74722a5ed5792d4b10ca702659422739c95ae26
Tickets: PBL-36343
* Fix empty private_key when create Pending Cert
On creation of a certificate with a CSR, there is no option for private
key. In this case, we actually have a dictionary with private_key as
key, but the value is None. This fixes the strip() called on NoneType.
Change-Id: I7b265564d8095bfc83d9d4cd14ae13fea3c03199
Tickets: PBL-36499
* Source sync finds and uses pending certificate
When a source syncs certificates, it will check for a pending
certificate. If that is found via external_id (given by digicert as
order_id) then it will use the found Pending Certificate's fields to
create a new certificate. Then the pending certificate is deleted.
Tickets: PBL-36343
Change-Id: I4f7959da29275ebc47a3996741f7e98d3e2d29d9
* Add Lemur static files and views for pending certs
This adds the basic static files to view pending certificates in a
table.
Tickets: PBL-36343
Change-Id: Ia4362e6664ec730d05d280c5ef5c815a6feda0d9
* Add CLI and plugin based pending fetch
This change uses the adds a new function to issuer plugins to fetch
certificates like source, but for one order. This way, we can control
which pending certificates to try and populate instead of getting all
certificates from source.
Tickets: PBL-36343
Change-Id: Ifc1747ccdc2cba09a81f298b31ddddebfee1b1d6
* Revert source using Pending Certificate
Tickets: PBL-36343
Change-Id: I05121bc951e0530d804070afdb9c9e09baa0bc51
* Fix PendingCertificate init getting authority id
Should get authority id from authority.id instead of the authority_id
key in kwargs.
Change-Id: Ie56df1a5fb0ab2729e91050f3ad1a831853e0623
Tickets: n/a
* Add fixtures and basic test for PendingCertificate
Change-Id: I4cca34105544d40dac1cc50a87bba93d8af9ab34
Tickets: PBL-36343
* Add User to create_certificate parameters
create_certificate now takes a User, which will be used to populate the
'creator' field in certificates.service.upload(). This allows the UI
populate with the current user if the owner does not exist in Lemur.
+ Fix chain being replaced with version from pending certificate, which
may be empty (depends on plugin implementation).
Change-Id: I516027b36bc643c4978b9c4890060569e03f3049
Tickets: n/a
* Fix permalink and filters to pending certs
Fixes the permalink button to get a single pending certificate
Add argument filter parsing for the pending certificate API
Fix comment on API usage
Added get_by_name for pending_certificate (currently unused, but useful
for CLI, instead of using IDs)
Change-Id: Iaa48909c45606bec65dfb193c13d6bd0e816f6db
Tickets: PBL-36910
* Update displayed fields for Pending Certificates
There are a number of unused / unpopulated fields from Certificate UI
that does apply to Pending Certificates. Those ones were removed, and
added other useful fields:
Owner, number of attempts to fetch and date created
Change-Id: I3010a715f0357ba149cf539a19fdb5974c5ce08b
Tickets: PBL-36910
* Add common name (cn) to Pending Certificate model
Fixes the UI missing the CN for Pending Certificate, as it was
originally being parsed from the generated certificate. In the case of
pending certificate, the CN from the user generates the request, which
means a pending cert can trust the original user putting in the CN
instead of having to parse the not-yet-generated certificate. There is
no real possibility to return a certificate from a pending certificate
where the CN has changed since it was initially ordered.
Change-Id: I88a4fa28116d5d8d293e58970d9777ce73fbb2ab
Tickets: PBL-36910
* Fix missing imports for service filter
+ Removed duplicate get_by_name function from old merge
Change-Id: I04ae6852533aa42988433338de74390e2868d69b
Tickets: PBL-36910
* Add private key viewing to Pending Certificates
Add private key API for Pending Certificates, with the same
authorization as Certificates (only owner, creator or owner-roles can
view private key).
Change-Id: Ie5175154a10fe0007cc0e9f35b80c0a01ed48d5b
Tickets: PBL-36910
* Add edit capability to pending certificates
Like editing certificates, we should be able to modify some parts of a
pending certificate so the resulting certificate has the right
references, owner, etc.
+ Added API to update pending certificate
+ Fix UI to use pending certificate scope instead of reusing Certificate
+ Change pending_certificate.replaces to non-passive association, so
that updates do affect it (similar to roles/notifications/etc)
Tickets: PBL-36910
Change-Id: Ibbcb166a33f0337e1b14f426472261222f790ce6
* Add common_name parsing instead using kwargs
To fix tests where common name may not be passed in, use the CSR
generated to find the official common name.
Change-Id: I09f9258fa92c2762d095798676ce210c5d7a3da4
Tickets: PBL-36343
* Add Cancel to pending certificates and plugins
This allows pending certificates to be cancelled, which will be handled
by the issuer plugin.
Change-Id: Ibd6b5627c3977e33aca7860690cfb7f677236ca9
Tickets: PBL-36910
* Add API for Cancelling Pending Certificate
Added the DELETE handler for pending_certificates, which will cancel and
delete the pending certificate from the pending certs table on
successful cancellation via Issuer Plugin.
+ Add UT for testing cancel API
Change-Id: I11b1d87872e4284f6e4f9c366a15da4ddba38bc4
Tickets: PBL-36910
* Remove Export from Pending Certificates
Pending Certificates doesn't need an export since it should just be
fetched by Lemur via plugins, and the CSR is viewable via the UI.
Change-Id: I9a3e65ea11ac5a85316f6428e7f526c3c09178ae
Tickets: PBL-36910
* Add cancel button functionality to UI
This adds the Cancel option to the dropdown of pending certificates.
+ Adds modal window for Note (may not be required for all issuers, just
Digicert)
+ Add schema for cancel input
+ Fix Digitcert plugin for non-existant orders
When an order is actually issued, then attempting to cancel will return
a 403 from Digicert. This is a case where it should only be done once
we know the pending cert has been sitting for too long.
Change-Id: I256c81ecd142dd51dcf8e38802d2c202829887b0
Tickets: PBL-36910
* Fix test_pending_cancel UT
This change creates and injects a pending cert, which will then be used
for the ID so it can be canceled by the unit test.
Change-Id: I686e7e0fafd68cdaeb26438fb8504d79de77c346
Tickets: PBL-36343
* Fix test_digicert on non-existent order
cancelling a non-existent order is fine since we're cancelling it
Change-Id: I70c0e82ba2f4b8723a7f65b113c19e6eeff7e68c
Tickets: PBL-36343
* Add migrations for PendingCertificates
Added revision for Pending Certificates table and foreign key mapping
tables.
Change-Id: Ife8202cef1e6b99db377851264639ba540b749db
Tickets: n/a
* Fix relationship copy from Pending to Certificate
When a Pending Certificate is changed to a full Certificate, the
relationship fields are not copied via vars() function, as it's not a
column but mapped via association table. This adds an explicit copy for
these relations. Which will properly copy them to the new Certificate,
and thus also update destinations.
Change-Id: I322032ce4a9e3e67773f7cf39ee4971054c92685
Tickets: PBL-36343
* Fix renaming of certificates and unit tests
The rename flag was not used to rename certificates on creation as
expected.
Fixed unit test, instead of expunging the session, just copy the
pending_certificate so we don't have a weird reference to the object
that can't be copied via vars() function.
Change-Id: I962943272ed92386ab6eab2af4ed6d074d4cffa0
Tickets: PBL-36343
* Updated developer docs for async certs
Added blurb for implementing new issuer functions.
Change-Id: I1caed6e914bcd73214eae2d241e4784e1b8a0c4c
Tickets: n/a
2018-02-22 17:13:16 +01:00
|
|
|
if cert_body:
|
|
|
|
cert = Certificate(**kwargs)
|
|
|
|
kwargs['creator'].certificates.append(cert)
|
|
|
|
else:
|
|
|
|
cert = PendingCertificate(**kwargs)
|
|
|
|
kwargs['creator'].pending_certificates.append(cert)
|
2015-07-30 02:13:06 +02:00
|
|
|
|
2016-06-01 20:18:00 +02:00
|
|
|
cert.authority = kwargs['authority']
|
2017-08-29 02:35:56 +02:00
|
|
|
|
2016-05-20 18:03:34 +02:00
|
|
|
database.commit()
|
2015-08-02 14:57:26 +02:00
|
|
|
|
Async Certificate Issuing using Pending Certificates (#1037)
* Add PendingCertificate model
This change creates a DB table called pending_certificates and
associated mapping relationship tables from pending certificate to
roles, rotation policy, destination, sources, etc.
The table is generated on initialization of Lemur. A pending
certificate holds most of the information of a Certificate, while it has
not be issued so that it can later backfill the information when the CA
has issued the certificate.
Change-Id: I277c16b776a71fe5edaf0fa0e76bbedc88924db0
Tickets: PBL-36499
* Create a PendingCertificate if cert is empty
IssuePlugins should return empty cert bodies if the request failed to
complete immediately (such as Digicert). This way, we can immediately
return the certificate, or if not just place into PendingCertificates
for later processing.
+ Fix relation from Certificate to Pending Certificate, as view only.
There is no real need for anything more than that since Pending cert
only needs to know the cert to replace when it is issued later.
+ Made PendingCertificate private key be empty: UI does not allow
private key on 'Create' but only on 'Import'. For Instart, we require
the private key but upstream does not necessarily need it. Thus, if
someone at Instart wants to create a CSR / key combo, they should
manually issue the cert themselves and import later. Otherwise you
should let Lemur generate that. This keeps the workflow transparent for
upstream Lemur users.
Change-Id: Ib74722a5ed5792d4b10ca702659422739c95ae26
Tickets: PBL-36343
* Fix empty private_key when create Pending Cert
On creation of a certificate with a CSR, there is no option for private
key. In this case, we actually have a dictionary with private_key as
key, but the value is None. This fixes the strip() called on NoneType.
Change-Id: I7b265564d8095bfc83d9d4cd14ae13fea3c03199
Tickets: PBL-36499
* Source sync finds and uses pending certificate
When a source syncs certificates, it will check for a pending
certificate. If that is found via external_id (given by digicert as
order_id) then it will use the found Pending Certificate's fields to
create a new certificate. Then the pending certificate is deleted.
Tickets: PBL-36343
Change-Id: I4f7959da29275ebc47a3996741f7e98d3e2d29d9
* Add Lemur static files and views for pending certs
This adds the basic static files to view pending certificates in a
table.
Tickets: PBL-36343
Change-Id: Ia4362e6664ec730d05d280c5ef5c815a6feda0d9
* Add CLI and plugin based pending fetch
This change uses the adds a new function to issuer plugins to fetch
certificates like source, but for one order. This way, we can control
which pending certificates to try and populate instead of getting all
certificates from source.
Tickets: PBL-36343
Change-Id: Ifc1747ccdc2cba09a81f298b31ddddebfee1b1d6
* Revert source using Pending Certificate
Tickets: PBL-36343
Change-Id: I05121bc951e0530d804070afdb9c9e09baa0bc51
* Fix PendingCertificate init getting authority id
Should get authority id from authority.id instead of the authority_id
key in kwargs.
Change-Id: Ie56df1a5fb0ab2729e91050f3ad1a831853e0623
Tickets: n/a
* Add fixtures and basic test for PendingCertificate
Change-Id: I4cca34105544d40dac1cc50a87bba93d8af9ab34
Tickets: PBL-36343
* Add User to create_certificate parameters
create_certificate now takes a User, which will be used to populate the
'creator' field in certificates.service.upload(). This allows the UI
populate with the current user if the owner does not exist in Lemur.
+ Fix chain being replaced with version from pending certificate, which
may be empty (depends on plugin implementation).
Change-Id: I516027b36bc643c4978b9c4890060569e03f3049
Tickets: n/a
* Fix permalink and filters to pending certs
Fixes the permalink button to get a single pending certificate
Add argument filter parsing for the pending certificate API
Fix comment on API usage
Added get_by_name for pending_certificate (currently unused, but useful
for CLI, instead of using IDs)
Change-Id: Iaa48909c45606bec65dfb193c13d6bd0e816f6db
Tickets: PBL-36910
* Update displayed fields for Pending Certificates
There are a number of unused / unpopulated fields from Certificate UI
that does apply to Pending Certificates. Those ones were removed, and
added other useful fields:
Owner, number of attempts to fetch and date created
Change-Id: I3010a715f0357ba149cf539a19fdb5974c5ce08b
Tickets: PBL-36910
* Add common name (cn) to Pending Certificate model
Fixes the UI missing the CN for Pending Certificate, as it was
originally being parsed from the generated certificate. In the case of
pending certificate, the CN from the user generates the request, which
means a pending cert can trust the original user putting in the CN
instead of having to parse the not-yet-generated certificate. There is
no real possibility to return a certificate from a pending certificate
where the CN has changed since it was initially ordered.
Change-Id: I88a4fa28116d5d8d293e58970d9777ce73fbb2ab
Tickets: PBL-36910
* Fix missing imports for service filter
+ Removed duplicate get_by_name function from old merge
Change-Id: I04ae6852533aa42988433338de74390e2868d69b
Tickets: PBL-36910
* Add private key viewing to Pending Certificates
Add private key API for Pending Certificates, with the same
authorization as Certificates (only owner, creator or owner-roles can
view private key).
Change-Id: Ie5175154a10fe0007cc0e9f35b80c0a01ed48d5b
Tickets: PBL-36910
* Add edit capability to pending certificates
Like editing certificates, we should be able to modify some parts of a
pending certificate so the resulting certificate has the right
references, owner, etc.
+ Added API to update pending certificate
+ Fix UI to use pending certificate scope instead of reusing Certificate
+ Change pending_certificate.replaces to non-passive association, so
that updates do affect it (similar to roles/notifications/etc)
Tickets: PBL-36910
Change-Id: Ibbcb166a33f0337e1b14f426472261222f790ce6
* Add common_name parsing instead using kwargs
To fix tests where common name may not be passed in, use the CSR
generated to find the official common name.
Change-Id: I09f9258fa92c2762d095798676ce210c5d7a3da4
Tickets: PBL-36343
* Add Cancel to pending certificates and plugins
This allows pending certificates to be cancelled, which will be handled
by the issuer plugin.
Change-Id: Ibd6b5627c3977e33aca7860690cfb7f677236ca9
Tickets: PBL-36910
* Add API for Cancelling Pending Certificate
Added the DELETE handler for pending_certificates, which will cancel and
delete the pending certificate from the pending certs table on
successful cancellation via Issuer Plugin.
+ Add UT for testing cancel API
Change-Id: I11b1d87872e4284f6e4f9c366a15da4ddba38bc4
Tickets: PBL-36910
* Remove Export from Pending Certificates
Pending Certificates doesn't need an export since it should just be
fetched by Lemur via plugins, and the CSR is viewable via the UI.
Change-Id: I9a3e65ea11ac5a85316f6428e7f526c3c09178ae
Tickets: PBL-36910
* Add cancel button functionality to UI
This adds the Cancel option to the dropdown of pending certificates.
+ Adds modal window for Note (may not be required for all issuers, just
Digicert)
+ Add schema for cancel input
+ Fix Digitcert plugin for non-existant orders
When an order is actually issued, then attempting to cancel will return
a 403 from Digicert. This is a case where it should only be done once
we know the pending cert has been sitting for too long.
Change-Id: I256c81ecd142dd51dcf8e38802d2c202829887b0
Tickets: PBL-36910
* Fix test_pending_cancel UT
This change creates and injects a pending cert, which will then be used
for the ID so it can be canceled by the unit test.
Change-Id: I686e7e0fafd68cdaeb26438fb8504d79de77c346
Tickets: PBL-36343
* Fix test_digicert on non-existent order
cancelling a non-existent order is fine since we're cancelling it
Change-Id: I70c0e82ba2f4b8723a7f65b113c19e6eeff7e68c
Tickets: PBL-36343
* Add migrations for PendingCertificates
Added revision for Pending Certificates table and foreign key mapping
tables.
Change-Id: Ife8202cef1e6b99db377851264639ba540b749db
Tickets: n/a
* Fix relationship copy from Pending to Certificate
When a Pending Certificate is changed to a full Certificate, the
relationship fields are not copied via vars() function, as it's not a
column but mapped via association table. This adds an explicit copy for
these relations. Which will properly copy them to the new Certificate,
and thus also update destinations.
Change-Id: I322032ce4a9e3e67773f7cf39ee4971054c92685
Tickets: PBL-36343
* Fix renaming of certificates and unit tests
The rename flag was not used to rename certificates on creation as
expected.
Fixed unit test, instead of expunging the session, just copy the
pending_certificate so we don't have a weird reference to the object
that can't be copied via vars() function.
Change-Id: I962943272ed92386ab6eab2af4ed6d074d4cffa0
Tickets: PBL-36343
* Updated developer docs for async certs
Added blurb for implementing new issuer functions.
Change-Id: I1caed6e914bcd73214eae2d241e4784e1b8a0c4c
Tickets: n/a
2018-02-22 17:13:16 +01:00
|
|
|
if isinstance(cert, Certificate):
|
|
|
|
certificate_issued.send(certificate=cert, authority=cert.authority)
|
|
|
|
metrics.send('certificate_issued', 'counter', 1, metric_tags=dict(owner=cert.owner, issuer=cert.issuer))
|
2015-06-22 22:47:27 +02:00
|
|
|
return cert
|
|
|
|
|
|
|
|
|
|
|
|
def render(args):
|
|
|
|
"""
|
|
|
|
Helper function that allows use to render our REST Api.
|
|
|
|
|
|
|
|
:param args:
|
|
|
|
:return:
|
|
|
|
"""
|
|
|
|
query = database.session_query(Certificate)
|
|
|
|
|
|
|
|
time_range = args.pop('time_range')
|
2015-07-11 02:06:57 +02:00
|
|
|
destination_id = args.pop('destination_id')
|
2015-07-30 02:13:06 +02:00
|
|
|
notification_id = args.pop('notification_id', None)
|
2015-06-22 22:47:27 +02:00
|
|
|
show = args.pop('show')
|
2015-07-21 22:06:13 +02:00
|
|
|
# owner = args.pop('owner')
|
|
|
|
# creator = args.pop('creator') # TODO we should enabling filtering by owner
|
2015-06-22 22:47:27 +02:00
|
|
|
|
|
|
|
filt = args.pop('filter')
|
|
|
|
|
|
|
|
if filt:
|
|
|
|
terms = filt.split(';')
|
2018-03-28 17:33:43 +02:00
|
|
|
term = '%{0}%'.format(terms[1])
|
|
|
|
# Exact matches for quotes. Only applies to name, issuer, and cn
|
|
|
|
if terms[1].startswith('"') and terms[1].endswith('"'):
|
|
|
|
term = terms[1][1:-1]
|
2015-11-25 01:07:44 +01:00
|
|
|
|
2015-06-22 22:47:27 +02:00
|
|
|
if 'issuer' in terms:
|
|
|
|
# we can't rely on issuer being correct in the cert directly so we combine queries
|
|
|
|
sub_query = database.session_query(Authority.id)\
|
2018-03-28 17:33:43 +02:00
|
|
|
.filter(Authority.name.ilike(term))\
|
2015-06-22 22:47:27 +02:00
|
|
|
.subquery()
|
|
|
|
|
|
|
|
query = query.filter(
|
|
|
|
or_(
|
2018-03-28 17:33:43 +02:00
|
|
|
Certificate.issuer.ilike(term),
|
2015-06-22 22:47:27 +02:00
|
|
|
Certificate.authority_id.in_(sub_query)
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
2015-11-25 01:07:44 +01:00
|
|
|
elif 'destination' in terms:
|
2015-07-11 02:06:57 +02:00
|
|
|
query = query.filter(Certificate.destinations.any(Destination.id == terms[1]))
|
2016-12-20 23:26:29 +01:00
|
|
|
elif 'notify' in filt:
|
2018-04-02 17:33:51 +02:00
|
|
|
query = query.filter(Certificate.notify == truthiness(terms[1]))
|
2016-10-15 09:12:11 +02:00
|
|
|
elif 'active' in filt:
|
2018-04-02 17:33:51 +02:00
|
|
|
query = query.filter(Certificate.active == truthiness(terms[1]))
|
2015-11-25 01:07:44 +01:00
|
|
|
elif 'cn' in terms:
|
|
|
|
query = query.filter(
|
|
|
|
or_(
|
2018-03-28 17:33:43 +02:00
|
|
|
Certificate.cn.ilike(term),
|
|
|
|
Certificate.domains.any(Domain.name.ilike(term))
|
2015-11-25 01:07:44 +01:00
|
|
|
)
|
|
|
|
)
|
2017-03-04 00:07:26 +01:00
|
|
|
elif 'id' in terms:
|
|
|
|
query = query.filter(Certificate.id == cast(terms[1], Integer))
|
2018-03-28 17:33:43 +02:00
|
|
|
elif 'name' in terms:
|
|
|
|
query = query.filter(
|
|
|
|
or_(
|
|
|
|
Certificate.name.ilike(term),
|
|
|
|
Certificate.domains.any(Domain.name.ilike(term)),
|
|
|
|
Certificate.cn.ilike(term),
|
|
|
|
)
|
|
|
|
)
|
2015-06-22 22:47:27 +02:00
|
|
|
else:
|
|
|
|
query = database.filter(query, Certificate, terms)
|
|
|
|
|
|
|
|
if show:
|
2016-11-18 20:27:46 +01:00
|
|
|
sub_query = database.session_query(Role.name).filter(Role.user_id == args['user'].id).subquery()
|
2015-06-22 22:47:27 +02:00
|
|
|
query = query.filter(
|
|
|
|
or_(
|
2016-11-18 20:27:46 +01:00
|
|
|
Certificate.user_id == args['user'].id,
|
2015-06-22 22:47:27 +02:00
|
|
|
Certificate.owner.in_(sub_query)
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
2015-07-11 02:06:57 +02:00
|
|
|
if destination_id:
|
|
|
|
query = query.filter(Certificate.destinations.any(Destination.id == destination_id))
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2015-07-30 02:13:06 +02:00
|
|
|
if notification_id:
|
|
|
|
query = query.filter(Certificate.notifications.any(Notification.id == notification_id))
|
|
|
|
|
2015-06-22 22:47:27 +02:00
|
|
|
if time_range:
|
|
|
|
to = arrow.now().replace(weeks=+time_range).format('YYYY-MM-DD')
|
|
|
|
now = arrow.now().format('YYYY-MM-DD')
|
|
|
|
query = query.filter(Certificate.not_after <= to).filter(Certificate.not_after >= now)
|
|
|
|
|
|
|
|
return database.sort_and_page(query, Certificate, args)
|
|
|
|
|
|
|
|
|
2016-05-20 18:03:34 +02:00
|
|
|
def create_csr(**csr_config):
|
2015-06-22 22:47:27 +02:00
|
|
|
"""
|
|
|
|
Given a list of domains create the appropriate csr
|
|
|
|
for those domains
|
|
|
|
|
|
|
|
:param csr_config:
|
|
|
|
"""
|
2016-12-02 19:54:18 +01:00
|
|
|
private_key = generate_private_key(csr_config.get('key_type'))
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2015-07-02 21:10:09 +02:00
|
|
|
builder = x509.CertificateSigningRequestBuilder()
|
2017-09-26 00:32:08 +02:00
|
|
|
name_list = [x509.NameAttribute(x509.OID_COMMON_NAME, csr_config['common_name'])]
|
|
|
|
if current_app.config.get('LEMUR_OWNER_EMAIL_IN_SUBJECT', True):
|
|
|
|
name_list.append(x509.NameAttribute(x509.OID_EMAIL_ADDRESS, csr_config['owner']))
|
2017-02-16 22:21:52 +01:00
|
|
|
if 'organization' in csr_config and csr_config['organization'].strip():
|
|
|
|
name_list.append(x509.NameAttribute(x509.OID_ORGANIZATION_NAME, csr_config['organization']))
|
|
|
|
if 'organizational_unit' in csr_config and csr_config['organizational_unit'].strip():
|
|
|
|
name_list.append(x509.NameAttribute(x509.OID_ORGANIZATIONAL_UNIT_NAME, csr_config['organizational_unit']))
|
|
|
|
if 'country' in csr_config and csr_config['country'].strip():
|
|
|
|
name_list.append(x509.NameAttribute(x509.OID_COUNTRY_NAME, csr_config['country']))
|
|
|
|
if 'state' in csr_config and csr_config['state'].strip():
|
|
|
|
name_list.append(x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, csr_config['state']))
|
|
|
|
if 'location' in csr_config and csr_config['location'].strip():
|
|
|
|
name_list.append(x509.NameAttribute(x509.OID_LOCALITY_NAME, csr_config['location']))
|
|
|
|
builder = builder.subject_name(x509.Name(name_list))
|
2015-07-02 21:10:09 +02:00
|
|
|
|
2017-01-27 21:31:29 +01:00
|
|
|
extensions = csr_config.get('extensions', {})
|
|
|
|
critical_extensions = ['basic_constraints', 'sub_alt_names', 'key_usage']
|
|
|
|
noncritical_extensions = ['extended_key_usage']
|
|
|
|
for k, v in extensions.items():
|
2017-01-28 06:05:25 +01:00
|
|
|
if v:
|
|
|
|
if k in critical_extensions:
|
|
|
|
current_app.logger.debug('Adding Critical Extension: {0} {1}'.format(k, v))
|
|
|
|
if k == 'sub_alt_names':
|
2017-08-18 18:10:56 +02:00
|
|
|
if v['names']:
|
|
|
|
builder = builder.add_extension(v['names'], critical=True)
|
2017-01-28 06:05:25 +01:00
|
|
|
else:
|
|
|
|
builder = builder.add_extension(v, critical=True)
|
|
|
|
|
|
|
|
if k in noncritical_extensions:
|
|
|
|
current_app.logger.debug('Adding Extension: {0} {1}'.format(k, v))
|
|
|
|
builder = builder.add_extension(v, critical=False)
|
2017-01-27 21:31:29 +01:00
|
|
|
|
|
|
|
ski = extensions.get('subject_key_identifier', {})
|
|
|
|
if ski.get('include_ski', False):
|
|
|
|
builder = builder.add_extension(
|
|
|
|
x509.SubjectKeyIdentifier.from_public_key(private_key.public_key()),
|
|
|
|
critical=False
|
|
|
|
)
|
2015-07-02 21:10:09 +02:00
|
|
|
|
|
|
|
request = builder.sign(
|
|
|
|
private_key, hashes.SHA256(), default_backend()
|
|
|
|
)
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2015-07-03 19:30:17 +02:00
|
|
|
# serialize our private key and CSR
|
2016-05-20 18:03:34 +02:00
|
|
|
private_key = private_key.private_bytes(
|
2015-07-03 19:30:17 +02:00
|
|
|
encoding=serialization.Encoding.PEM,
|
2015-07-09 01:37:48 +02:00
|
|
|
format=serialization.PrivateFormat.TraditionalOpenSSL, # would like to use PKCS8 but AWS ELBs don't like it
|
2015-07-03 19:30:17 +02:00
|
|
|
encryption_algorithm=serialization.NoEncryption()
|
|
|
|
)
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2016-11-17 00:05:25 +01:00
|
|
|
if isinstance(private_key, bytes):
|
|
|
|
private_key = private_key.decode('utf-8')
|
|
|
|
|
2015-07-03 19:30:17 +02:00
|
|
|
csr = request.public_bytes(
|
|
|
|
encoding=serialization.Encoding.PEM
|
2016-11-30 02:15:39 +01:00
|
|
|
).decode('utf-8')
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2016-05-20 18:03:34 +02:00
|
|
|
return csr, private_key
|
2015-06-22 22:47:27 +02:00
|
|
|
|
2015-07-21 22:06:13 +02:00
|
|
|
|
2015-06-22 22:47:27 +02:00
|
|
|
def stats(**kwargs):
|
|
|
|
"""
|
|
|
|
Helper that defines some useful statistics about certifications.
|
|
|
|
|
|
|
|
:param kwargs:
|
|
|
|
:return:
|
|
|
|
"""
|
|
|
|
if kwargs.get('metric') == 'not_after':
|
|
|
|
start = arrow.utcnow()
|
|
|
|
end = start.replace(weeks=+32)
|
|
|
|
items = database.db.session.query(Certificate.issuer, func.count(Certificate.id))\
|
|
|
|
.group_by(Certificate.issuer)\
|
|
|
|
.filter(Certificate.not_after <= end.format('YYYY-MM-DD')) \
|
|
|
|
.filter(Certificate.not_after >= start.format('YYYY-MM-DD')).all()
|
|
|
|
|
|
|
|
else:
|
|
|
|
attr = getattr(Certificate, kwargs.get('metric'))
|
|
|
|
query = database.db.session.query(attr, func.count(attr))
|
|
|
|
|
|
|
|
items = query.group_by(attr).all()
|
|
|
|
|
|
|
|
keys = []
|
|
|
|
values = []
|
|
|
|
for key, count in items:
|
|
|
|
keys.append(key)
|
|
|
|
values.append(count)
|
|
|
|
|
|
|
|
return {'labels': keys, 'values': values}
|
2016-05-19 22:37:05 +02:00
|
|
|
|
|
|
|
|
|
|
|
def get_account_number(arn):
|
|
|
|
"""
|
|
|
|
Extract the account number from an arn.
|
|
|
|
|
|
|
|
:param arn: IAM SSL arn
|
|
|
|
:return: account number associated with ARN
|
|
|
|
"""
|
|
|
|
return arn.split(":")[4]
|
|
|
|
|
|
|
|
|
|
|
|
def get_name_from_arn(arn):
|
|
|
|
"""
|
|
|
|
Extract the certificate name from an arn.
|
|
|
|
|
|
|
|
:param arn: IAM SSL arn
|
|
|
|
:return: name of the certificate as uploaded to AWS
|
|
|
|
"""
|
|
|
|
return arn.split("/", 1)[1]
|
2016-10-31 19:00:15 +01:00
|
|
|
|
|
|
|
|
|
|
|
def calculate_reissue_range(start, end):
|
|
|
|
"""
|
|
|
|
Determine what the new validity_start and validity_end dates should be.
|
|
|
|
:param start:
|
|
|
|
:param end:
|
|
|
|
:return:
|
|
|
|
"""
|
|
|
|
span = end - start
|
|
|
|
|
2016-12-15 02:30:13 +01:00
|
|
|
new_start = arrow.utcnow()
|
2016-10-31 19:00:15 +01:00
|
|
|
new_end = new_start + span
|
|
|
|
|
2016-11-18 20:27:46 +01:00
|
|
|
return new_start, arrow.get(new_end)
|
2016-10-31 19:00:15 +01:00
|
|
|
|
|
|
|
|
|
|
|
def get_certificate_primitives(certificate):
|
|
|
|
"""
|
|
|
|
Retrieve key primitive from a certificate such that the certificate
|
|
|
|
could be recreated with new expiration or be used to build upon.
|
|
|
|
:param certificate:
|
|
|
|
:return: dict of certificate primitives, should be enough to effectively re-issue
|
|
|
|
certificate via `create`.
|
|
|
|
"""
|
|
|
|
start, end = calculate_reissue_range(certificate.not_before, certificate.not_after)
|
2017-02-03 20:21:53 +01:00
|
|
|
data = CertificateInputSchema().load(CertificateOutputSchema().dump(certificate).data).data
|
2017-03-09 22:09:20 +01:00
|
|
|
|
|
|
|
# we can't quite tell if we are using a custom name, as this is an automated process (typically)
|
|
|
|
# we will rely on the Lemur generated name
|
|
|
|
data.pop('name', None)
|
|
|
|
|
2017-06-02 17:59:42 +02:00
|
|
|
# TODO this can be removed once we migrate away from cn
|
|
|
|
data['cn'] = data['common_name']
|
2017-07-14 18:24:59 +02:00
|
|
|
|
|
|
|
# needed until we move off not_*
|
2017-06-02 17:59:42 +02:00
|
|
|
data['not_before'] = start
|
|
|
|
data['not_after'] = end
|
2017-07-14 18:24:59 +02:00
|
|
|
data['validity_start'] = start
|
|
|
|
data['validity_end'] = end
|
2017-02-03 20:21:53 +01:00
|
|
|
return data
|
2016-11-18 20:27:46 +01:00
|
|
|
|
|
|
|
|
|
|
|
def reissue_certificate(certificate, replace=None, user=None):
|
|
|
|
"""
|
|
|
|
Reissue certificate with the same properties of the given certificate.
|
|
|
|
:param certificate:
|
2016-12-15 02:30:13 +01:00
|
|
|
:param replace:
|
|
|
|
:param user:
|
2016-11-18 20:27:46 +01:00
|
|
|
:return:
|
|
|
|
"""
|
|
|
|
primitives = get_certificate_primitives(certificate)
|
2017-03-09 22:09:20 +01:00
|
|
|
|
2016-11-18 20:27:46 +01:00
|
|
|
if not user:
|
|
|
|
primitives['creator'] = certificate.user
|
2017-02-03 20:21:53 +01:00
|
|
|
|
2016-11-18 20:27:46 +01:00
|
|
|
else:
|
|
|
|
primitives['creator'] = user
|
|
|
|
|
|
|
|
if replace:
|
2016-12-27 00:55:11 +01:00
|
|
|
primitives['replaces'] = [certificate]
|
2016-12-08 01:24:59 +01:00
|
|
|
|
|
|
|
new_cert = create(**primitives)
|
2016-11-18 20:27:46 +01:00
|
|
|
|
|
|
|
return new_cert
|