mirror of https://github.com/pypa/pip
54 lines
1.6 KiB
Python
54 lines
1.6 KiB
Python
from datetime import datetime, timedelta
|
|
|
|
from cryptography import x509
|
|
from cryptography.hazmat.backends import default_backend
|
|
from cryptography.hazmat.primitives import hashes, serialization
|
|
from cryptography.hazmat.primitives.asymmetric import rsa
|
|
from cryptography.x509.oid import NameOID
|
|
|
|
from pip._internal.utils.typing import MYPY_CHECK_RUNNING
|
|
|
|
if MYPY_CHECK_RUNNING:
|
|
from typing import Text, Tuple
|
|
|
|
|
|
def make_tls_cert(hostname):
|
|
# type: (Text) -> Tuple[x509.Certificate, rsa.RSAPrivateKey]
|
|
key = rsa.generate_private_key(
|
|
public_exponent=65537,
|
|
key_size=2048,
|
|
backend=default_backend()
|
|
)
|
|
subject = issuer = x509.Name([
|
|
x509.NameAttribute(NameOID.COMMON_NAME, hostname),
|
|
])
|
|
cert = (
|
|
x509.CertificateBuilder()
|
|
.subject_name(subject)
|
|
.issuer_name(issuer)
|
|
.public_key(key.public_key())
|
|
.serial_number(x509.random_serial_number())
|
|
.not_valid_before(datetime.utcnow())
|
|
.not_valid_after(datetime.utcnow() + timedelta(days=10))
|
|
.add_extension(
|
|
x509.SubjectAlternativeName([x509.DNSName(hostname)]),
|
|
critical=False,
|
|
)
|
|
.sign(key, hashes.SHA256(), default_backend())
|
|
)
|
|
return cert, key
|
|
|
|
|
|
def serialize_key(key):
|
|
# type: (rsa.RSAPrivateKey) -> bytes
|
|
return key.private_bytes(
|
|
encoding=serialization.Encoding.PEM,
|
|
format=serialization.PrivateFormat.TraditionalOpenSSL,
|
|
encryption_algorithm=serialization.NoEncryption(),
|
|
)
|
|
|
|
|
|
def serialize_cert(cert):
|
|
# type: (x509.Certificate) -> bytes
|
|
return cert.public_bytes(serialization.Encoding.PEM)
|