Commit Graph

237 Commits

Author SHA1 Message Date
f6afcc6d21 Merge branch 'master' into master 2019-04-17 10:28:46 -07:00
771f2ebc47 Use SAN_CERT_CSR 2019-04-13 11:01:36 +02:00
c1b02cc8a5 Allow uploading csr along with certificates 2019-04-13 00:48:19 +02:00
ceb335f3ab Merge branch 'master' into master 2019-04-12 09:38:41 -07:00
2ff57e932c Update requirements - upgrade to py37 2019-04-10 15:40:48 -07:00
d80a6bb405 Added tests for CSR parsing into CertificateInputSchema 2019-04-01 08:44:40 +02:00
93ce259fb2 Merge branch 'master' into verify-cert-chain 2019-03-07 12:46:19 -08:00
92b60b279a Merge branch 'master' into verify-cert-chain 2019-03-06 11:15:32 -08:00
43b1d6217a Merge branch 'master' into allow-cert-deletion 2019-03-06 10:59:33 -08:00
cc6d53fdeb Ensuring that configs passed via the command line are respected. 2019-03-05 15:39:37 -08:00
10cec063c2 Check that stored certificate chain matches certificate
Similar to how the private key is checked.
2019-03-04 17:10:59 +02:00
63de8047ce Return 'already deleted' instead of 'not found' when cert has already been deleted 2019-02-27 09:38:25 +01:00
a9735e129c Merge branch 'master' into allow-cert-deletion 2019-02-27 09:28:48 +01:00
16a18cc4b7 adding more edge test cases for EC-certs 2019-02-26 16:42:26 -08:00
40fac02d8b the check_cert_signature() method was attempting to compare RSA and ECC signatures.
If a ec public-key certificate is signed with an RSA key, then it can't be a self-signed certificate, in which case we just raise InvalidSignature.
2019-02-25 19:05:54 -08:00
8abf95063c Implement a ALLOW_CERT_DELETION option (boolean, default False). When enabled, the certificate delete API call will work and the UI
will no longer display deleted certificates. When disabled (the default), the delete API call will not work (405 method not allowed)
 and the UI will show all certificates, regardless of the 'deleted' flag.
2019-02-14 11:57:27 +01:00
e034771e36 Merge branch 'master' into special-issuer-for-selfsigned-certs 2019-02-11 12:04:33 -08:00
51248c1938 Use special issuer values <selfsigned> and <unknown> in special cases
This way it's easy to find/distinguish selfsigned certificates stored in
Lemur.
2019-02-05 16:56:09 +02:00
1d2771b014 Merge branch 'master' into get_by_attributes 2019-02-04 21:07:09 -08:00
45fbaf159a Merge branch 'master' into master 2019-02-01 16:50:09 -08:00
8e93d007be Merge branch 'master' into get_by_attributes 2019-02-01 16:48:50 -08:00
e24a94d798 Enforce that PEM strings (certs, keys, CSR) are internally passed as str, not bytes
This was already true in most places but not 100%, leading to lots of redundant checks and conversions.
2019-01-30 18:11:24 +02:00
e5ddf08f48 Merge branch 'master' into master 2019-01-29 16:37:29 -08:00
4b893ab5b4 Expose full certificate RFC 4514 Distinguished Name string
Using rfc4514_string() method added in cryptography version 2.5.
2019-01-23 10:03:40 +02:00
4c4fbf3e48 Implement certificates delete API call by marking a cert as 'deleted' in the database. Only certificates that have expired can be deleted. 2019-01-21 10:25:28 +01:00
542e953919 Check that stored private keys match certificates
This is done in two places:
* Certificate import validator -- throws validation errors.
* Certificate model constructor -- to ensure integrity of Lemur's data
  even when issuer plugins or other code paths have bugs.
2018-12-31 16:28:20 +02:00
72f6fdb17d Properly handle Unicode in issuer name sanitization
If the point of sanitization is to get rid of all non-alphanumeric
characters then Unicode characters should probably be forbidden too.

We can re-use the same sanitization function as used for cert 'name'
2018-12-21 16:34:12 +02:00
e074a14ee9 unit test 2018-11-28 14:27:03 -08:00
75183ef2f2 Unpin most dependencies, and fix moto 2018-11-05 14:37:52 -08:00
a8b357965e Merge branch 'master' into get_by_attributes 2018-10-29 08:15:42 -07:00
75069cd52a Add CSR to certificiates
Add csr column to certificates field, as pending certificates have
exposed the CSR already.  This is required as generating CSR from
existing certificate is will not include SANs due to OpenSSL bug:
https://github.com/openssl/openssl/issues/6481

Change-Id: I9ea86c4f87067ee6d791d77dc1cce8f469cb2a22
2018-10-23 17:46:04 -07:00
48017a9d4c Added get_by_attributes to the certificates service, for fetching certs based on arbitrary attributes. Also associated test and extra tests for other service methods 2018-10-17 11:42:09 -04:00
40f4444099 Flake8 fix in test_verify.py 2018-10-01 22:04:31 -04:00
50919d85a8 Merge remote-tracking branch 'upstream/master' into improved_verify 2018-09-27 11:19:06 -04:00
f19b6382bc Updated verify tests 2018-09-27 10:10:04 -04:00
7d42e4ce67 Fix certificate import issues 2018-09-10 10:34:47 -07:00
1b77dfa47a Revert "Precommit - Fix linty things" 2018-08-22 13:21:35 -07:00
3e9726d9db Precommit work 2018-08-22 10:38:09 -07:00
ab37189022 Merge branch 'master' into unittests-use-valid-certs 2018-08-07 09:42:39 -07:00
82158aece6 Fill in missing cert rotation_policy; don't ignore validation errors when re-issuing certs
CertificateInputSchema requires the rotation_policy field, but
certificates created before the field existed have set to NULL. Thus
saving such certificates failed and probably caused other errors.

Made cert re-issuing (get_certificate_primitives) more strict so such
errors are harder to miss in the future.
2018-08-03 20:06:21 +03:00
1f0f432327 Fix unit tests certificates to have correct chains and private keys
In preparation for certificate integrity-checking: invalid certificate
chains and mismatching private keys will no longer be allowed anywhere
in Lemur code.

The test vector certs were generated using the Lemur "cryptography"
authority plugin.

* Certificates are now more similar to real-world usage: long serial
  numbers, etc.
* Private key is included for all certs, so it's easy to re-generate
  anything if needed.
2018-08-03 19:45:13 +03:00
acd2701fa2 Delete dead code in unit tests (#1510) 2018-08-03 08:21:55 -07:00
d690ea32bc Cache parsed certificate instead of re-parsing for each field
Use @cached_property decorator to cache the results of parse_certificate().

This significantly cuts down on the number of times certs need to be
parsed for a list view.
2018-07-03 17:31:44 +03:00
a9b9b27a0b fix tests 2018-05-10 12:58:04 -07:00
6500559f8e Fix issue with automatically renewing acme certificates 2018-05-08 14:54:10 -07:00
efd5836e43 fix test 2018-04-26 09:04:13 -07:00
7704f51441 Working acme flow. Pending DNS providers UI 2018-04-24 09:38:57 -07:00
52cb145333 ecc: add the support for ECC (#1191)
* ecc: add the support for ECC

update generate_private_key to support ECC.  Move key types to constant.  Update UI for the new key types

* ecc: Remove extra line to fix linting

* ecc: Fix flake8 lint problems

* Update options.tpl.html
2018-04-10 16:54:17 -07:00
8e2b2123f1 Fix filtering on boolean columns, broken with SQLAlchemy 1.2 upgrade
SQLAlchemy 1.2 does not allow comparing string values to boolean
columns. This caused errors like:

    sqlalchemy.exc.StatementError: (builtins.TypeError) Not a boolean value: 'true'

For more details see http://docs.sqlalchemy.org/en/latest/changelog/migration_12.html#boolean-datatype-now-enforces-strict-true-false-none-values
2018-04-09 18:59:23 +03:00
d44a1934fe Update auth keys, change python version to satisfy tests 2018-03-21 10:29:08 -07:00