From c1b02cc8a5a5536e63131b3045eb79b391021e17 Mon Sep 17 00:00:00 2001
From: Jose Plana <jplana@tuenti.com>
Date: Fri, 15 Feb 2019 14:31:16 +0100
Subject: [PATCH 1/7] Allow uploading csr along with certificates

---
 lemur/certificates/schemas.py                       |  1 +
 .../certificates/certificate/upload.tpl.html        | 13 +++++++++++++
 lemur/tests/test_certificates.py                    |  1 +
 3 files changed, 15 insertions(+)

diff --git a/lemur/certificates/schemas.py b/lemur/certificates/schemas.py
index 78217de0..5795e71a 100644
--- a/lemur/certificates/schemas.py
+++ b/lemur/certificates/schemas.py
@@ -255,6 +255,7 @@ class CertificateUploadInputSchema(CertificateCreationSchema):
     private_key = fields.String()
     body = fields.String(required=True)
     chain = fields.String(missing=None, allow_none=True)
+    csr = fields.String(required=False,valudate=validators.csr)
 
     destinations = fields.Nested(AssociatedDestinationSchema, missing=[], many=True)
     notifications = fields.Nested(AssociatedNotificationSchema, missing=[], many=True)
diff --git a/lemur/static/app/angular/certificates/certificate/upload.tpl.html b/lemur/static/app/angular/certificates/certificate/upload.tpl.html
index c3339051..bf897a60 100644
--- a/lemur/static/app/angular/certificates/certificate/upload.tpl.html
+++ b/lemur/static/app/angular/certificates/certificate/upload.tpl.html
@@ -62,6 +62,19 @@
           a valid certificate.</p>
       </div>
     </div>
+    <div class="form-group"
+         ng-class="{'has-error': uploadForm.csr.$invalid&&uploadForm.csr.$dirty, 'has-success': !uploadForm.csr.$invalid&&uploadForm.csr.$dirty}">
+      <label class="control-label col-sm-2">
+        Certificate Signing Request (CSR)
+      </label>
+      <div class="col-sm-10">
+                <textarea name="csr" ng-model="certificate.csr" placeholder="PEM encoded string..."
+                          class="form-control"
+                          ng-pattern="/^-----BEGIN CERTIFICATE REQUEST-----/"></textarea>
+        <p ng-show="uploadForm.csr.$invalid && !uploadForm.csr.$pristine"
+             class="help-block">Enter a valid certificate signing request.</p>
+      </div>
+    </div>
     <div class="form-group"
          ng-class="{'has-error': uploadForm.owner.$invalid&&uploadform.intermediateCert.$dirty, 'has-success': !uploadForm.intermediateCert.$invalid&&uploadForm.intermediateCert.$dirty}">
       <label class="control-label col-sm-2">
diff --git a/lemur/tests/test_certificates.py b/lemur/tests/test_certificates.py
index 4013d367..195d4398 100644
--- a/lemur/tests/test_certificates.py
+++ b/lemur/tests/test_certificates.py
@@ -456,6 +456,7 @@ def test_certificate_upload_schema_ok(client):
         'body': SAN_CERT_STR,
         'privateKey': SAN_CERT_KEY,
         'chain': INTERMEDIATE_CERT_STR,
+        'csr': CSR_STR,
         'external_id': '1234',
     }
     data, errors = CertificateUploadInputSchema().load(data)

From a5570d07bc04a0bcb2b4a59598bebcdb356365b6 Mon Sep 17 00:00:00 2001
From: Jose Plana <jplana@tuenti.com>
Date: Fri, 15 Feb 2019 14:38:04 +0100
Subject: [PATCH 2/7] Added some documentation for API users.

---
 lemur/certificates/views.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lemur/certificates/views.py b/lemur/certificates/views.py
index e77160b2..fe1a1f9c 100644
--- a/lemur/certificates/views.py
+++ b/lemur/certificates/views.py
@@ -306,6 +306,7 @@ class CertificatesUpload(AuthenticatedResource):
                  "body": "-----BEGIN CERTIFICATE-----...",
                  "chain": "-----BEGIN CERTIFICATE-----...",
                  "privateKey": "-----BEGIN RSA PRIVATE KEY-----..."
+                 "csr": "-----BEGIN CERTIFICATE REQUEST-----..."
                  "destinations": [],
                  "notifications": [],
                  "replacements": [],

From 406753fcde6183482b4a610bb2e5275f27b0088b Mon Sep 17 00:00:00 2001
From: Jose Plana <jplana@tuenti.com>
Date: Sat, 16 Feb 2019 00:38:48 +0100
Subject: [PATCH 3/7] Fix PEP8

---
 lemur/certificates/schemas.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lemur/certificates/schemas.py b/lemur/certificates/schemas.py
index 5795e71a..3813d5b7 100644
--- a/lemur/certificates/schemas.py
+++ b/lemur/certificates/schemas.py
@@ -255,7 +255,7 @@ class CertificateUploadInputSchema(CertificateCreationSchema):
     private_key = fields.String()
     body = fields.String(required=True)
     chain = fields.String(missing=None, allow_none=True)
-    csr = fields.String(required=False,valudate=validators.csr)
+    csr = fields.String(required=False, valudate=validators.csr)
 
     destinations = fields.Nested(AssociatedDestinationSchema, missing=[], many=True)
     notifications = fields.Nested(AssociatedNotificationSchema, missing=[], many=True)

From 09796cf7c98a7b43e9434cbd9b42668717963761 Mon Sep 17 00:00:00 2001
From: Hossein Shafagh <hshafagh@netflix.com>
Date: Mon, 25 Feb 2019 19:05:54 -0800
Subject: [PATCH 4/7] the check_cert_signature() method was attempting to
 compare RSA and ECC signatures. If a ec public-key certificate is signed with
 an RSA key, then it can't be a self-signed certificate, in which case we just
 raise InvalidSignature.

---
 lemur/common/utils.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lemur/common/utils.py b/lemur/common/utils.py
index 62c3182b..44c5142b 100644
--- a/lemur/common/utils.py
+++ b/lemur/common/utils.py
@@ -199,6 +199,8 @@ def is_selfsigned(cert):
         return True
     except InvalidSignature:
         return False
+    except UnsupportedAlgorithm as e:
+        raise Exception(e)
 
 
 def is_weekend(date):

From 2ff811ae711c58a0f67dc873dbdc504995e19007 Mon Sep 17 00:00:00 2001
From: Hossein Shafagh <hshafagh@netflix.com>
Date: Tue, 26 Feb 2019 16:36:59 -0800
Subject: [PATCH 5/7] updating cryptography API call, to create right signing
 algorithm object.

---
 lemur/common/utils.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lemur/common/utils.py b/lemur/common/utils.py
index 44c5142b..62c3182b 100644
--- a/lemur/common/utils.py
+++ b/lemur/common/utils.py
@@ -199,8 +199,6 @@ def is_selfsigned(cert):
         return True
     except InvalidSignature:
         return False
-    except UnsupportedAlgorithm as e:
-        raise Exception(e)
 
 
 def is_weekend(date):

From 770729a72e3f95648cfa30d0edb33910f10f1e6a Mon Sep 17 00:00:00 2001
From: Jose Plana <jplana@tuenti.com>
Date: Wed, 6 Mar 2019 13:07:25 +0100
Subject: [PATCH 6/7] Allow csr to be empty during upload

---
 lemur/certificates/schemas.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lemur/certificates/schemas.py b/lemur/certificates/schemas.py
index 3813d5b7..64cc487f 100644
--- a/lemur/certificates/schemas.py
+++ b/lemur/certificates/schemas.py
@@ -255,7 +255,7 @@ class CertificateUploadInputSchema(CertificateCreationSchema):
     private_key = fields.String()
     body = fields.String(required=True)
     chain = fields.String(missing=None, allow_none=True)
-    csr = fields.String(required=False, valudate=validators.csr)
+    csr = fields.String(required=False, allow_none=True, validate=validators.csr)
 
     destinations = fields.Nested(AssociatedDestinationSchema, missing=[], many=True)
     notifications = fields.Nested(AssociatedNotificationSchema, missing=[], many=True)

From 771f2ebc4779a644f086c61d9722caa6591a0a71 Mon Sep 17 00:00:00 2001
From: Jose Plana <jplana@tuenti.com>
Date: Sat, 13 Apr 2019 11:01:36 +0200
Subject: [PATCH 7/7] Use SAN_CERT_CSR

---
 lemur/tests/test_certificates.py |  4 ++--
 lemur/tests/vectors.py           | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/lemur/tests/test_certificates.py b/lemur/tests/test_certificates.py
index 195d4398..d6e6a7e8 100644
--- a/lemur/tests/test_certificates.py
+++ b/lemur/tests/test_certificates.py
@@ -18,7 +18,7 @@ from lemur.domains.models import Domain
 
 
 from lemur.tests.vectors import VALID_ADMIN_API_TOKEN, VALID_ADMIN_HEADER_TOKEN, VALID_USER_HEADER_TOKEN, CSR_STR, \
-    INTERMEDIATE_CERT_STR, SAN_CERT_STR, SAN_CERT_KEY, ROOTCA_KEY, ROOTCA_CERT_STR
+    INTERMEDIATE_CERT_STR, SAN_CERT_STR, SAN_CERT_CSR, SAN_CERT_KEY, ROOTCA_KEY, ROOTCA_CERT_STR
 
 
 def test_get_or_increase_name(session, certificate):
@@ -456,7 +456,7 @@ def test_certificate_upload_schema_ok(client):
         'body': SAN_CERT_STR,
         'privateKey': SAN_CERT_KEY,
         'chain': INTERMEDIATE_CERT_STR,
-        'csr': CSR_STR,
+        'csr': SAN_CERT_CSR,
         'external_id': '1234',
     }
     data, errors = CertificateUploadInputSchema().load(data)
diff --git a/lemur/tests/vectors.py b/lemur/tests/vectors.py
index 06e7445a..cb5800a1 100644
--- a/lemur/tests/vectors.py
+++ b/lemur/tests/vectors.py
@@ -137,6 +137,26 @@ eMVHHbWm1CpGO294R+vMBv4jcuhIBOx63KZE4VaoJuaazF6TE5czDw==
 
 
 #: CN=san.example.org, issued by LemurTrust Unittests Class 1 CA 2018
+SAN_CERT_CSR = """\
+-----BEGIN CERTIFICATE REQUEST-----
+MIICvTCCAaUCAQAweDELMAkGA1UEBhMCRUUxDDAKBgNVBAgMA04vQTEOMAwGA1UE
+BwwFRWFydGgxGDAWBgNVBAoMD0RhbmllbCBTYW4gJiBjbzEXMBUGA1UECwwOS2Fy
+YXRlIExlc3NvbnMxGDAWBgNVBAMMD3Nhbi5leGFtcGxlLm9yZzCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMia9BcpypZUU9xJoknzdEp+AevQE93XSAyl
+IlXji80ZlYS/T/mVWtu6hNwz2IJDBFh6nPaHT1Ud/AI4YanDMa+fF4KJxzlkKPbY
+quWx4EOjTZ2sFBBCivwxlo1So8r5Hf4NZ9Ewu4AIma3zmk+dzxJTpnWbTIFJGsDG
+LwJO9iu6uqf79VdYkGELCusq3dyF2j2DNDiGHoRcQYFMMhDKR6uYmCTYvwjf0+sf
+6k1zk2EK1X+ZWUyjP+Nl2NB6bpL0TydF75fuplWROczceiO6BKO4YT2uNPdF4BAH
+p/kQCkqnjw5FCX7PONRT4wTW/AjDkt5WOgY+AB90zQBPxvXWbUMCAwEAAaAAMA0G
+CSqGSIb3DQEBCwUAA4IBAQAFYgEafwRmsqdK1i1xrLFYbNNLkzmAZyL+6gXUBVIJ
+TbGVVWSNNIcEmHIX8O9X4lN52qDYWOsxH/OKPVxpXqoHm/ztczFlte76wOYg+VAS
+yK8DwQRP/+n+j6J40o1cZwnilPWqHgee5zbIL7lpCVxuFDofWpskwP5PLbxibFq8
+4TWynhjKKUw4+q4h4iCHG3PQhbV0ExWOyqX05QyDtJdkEwgJUWz1m9caHU2Jl7kX
+5bWKOtXORpCYA7ed3WqktKQIxBD6vCVbQ+LuLZPYeWzGHYjfOejL6usD32KmNa2E
+ZhDsC0fjqSX0FJKz6gOhP88bkbbapyHuGB71o2dwhCKV
+-----END CERTIFICATE REQUEST-----
+"""
+
 SAN_CERT_STR = """\
 -----BEGIN CERTIFICATE-----
 MIIESjCCAzKgAwIBAgIRAK/y20+NLU2OgPo4KuJ8IzMwDQYJKoZIhvcNAQELBQAw