Current File : //lib/python2.7/site-packages/salt/modules/tls.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l m Z d d l
Z d d l Z d d l Z d d l m Z d d l m Z d d l m Z d d l m Z e Z e a y1 d d l Z e Z e e j j! d d
� � Z" Wn e# k
r:n Xe j$ e% � Z& d Z' d Z( d
� Z) d � Z* d d � Z, d d � Z- d � Z. d � Z/ d � Z0 d d � Z1 d d d � Z2 d d d � Z3 d d d � Z4 d d � Z5 e d d � Z6 d e d d d � Z7 d e d d d � Z8 d � Z9 d � Z: d d! � Z; d" � Z< d# d$ d d% d& d' d( d d e d d d) d d e d* � Z= d+ � Z> d# d d% d& d' d( d d d d d d d d) e d, e d- � Z? d. d# d$ d d% d& d' d( d d d d d) e d/ � Z@ d$ d d d d d) d e e d0 � ZA d1 d e d2 � ZB d) d3 � ZC d d d d4 � ZD d d d d d d5 � ZE e% d6 k r�e? d7 d8 d9 d: d% d; d& d< d= d> d( d? d d@ dA �eA d7 d9 � eB d7 d9 dB dC �n d S(D u_
A salt module for SSL/TLS.
Can create a Certificate Authority (CA)
or use Self-Signed certificates.
:depends: PyOpenSSL Python module (0.10 or later, 0.14 or later for X509
extension support)
:configuration: Add the following values in /etc/salt/minion for the CA module
to function properly:
.. code-block:: yaml
ca.cert_base_path: '/etc/pki'
CLI Example #1:
Creating a CA, a server request and its signed certificate:
.. code-block:: bash
# salt-call tls.create_ca my_little \
days=5 \
CN='My Little CA' \
C=US \
ST=Utah \
L=Salt Lake City \
O=Saltstack \
emailAddress=pleasedontemail@example.com
Created Private Key: "/etc/pki/my_little/my_little_ca_cert.key"
Created CA "my_little_ca": "/etc/pki/my_little_ca/my_little_ca_cert.crt"
# salt-call tls.create_csr my_little CN=www.example.com
Created Private Key: "/etc/pki/my_little/certs/www.example.com.key
Created CSR for "www.example.com": "/etc/pki/my_little/certs/www.example.com.csr"
# salt-call tls.create_ca_signed_cert my_little CN=www.example.com
Created Certificate for "www.example.com": /etc/pki/my_little/certs/www.example.com.crt"
CLI Example #2:
Creating a client request and its signed certificate
.. code-block:: bash
# salt-call tls.create_csr my_little CN=DBReplica_No.1 cert_type=client
Created Private Key: "/etc/pki/my_little/certs//DBReplica_No.1.key."
Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1.csr."
# salt-call tls.create_ca_signed_cert my_little CN=DBReplica_No.1
Created Certificate for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1.crt"
CLI Example #3:
Creating both a server and client req + cert for the same CN
.. code-block:: bash
# salt-call tls.create_csr my_little CN=MasterDBReplica_No.2 \
cert_type=client
Created Private Key: "/etc/pki/my_little/certs/MasterDBReplica_No.2.key."
Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/MasterDBReplica_No.2.csr."
# salt-call tls.create_ca_signed_cert my_little CN=MasterDBReplica_No.2
Created Certificate for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1.crt"
# salt-call tls.create_csr my_little CN=MasterDBReplica_No.2 \
cert_type=server
Certificate "MasterDBReplica_No.2" already exists
(doh!)
# salt-call tls.create_csr my_little CN=MasterDBReplica_No.2 \
cert_type=server type_ext=True
Created Private Key: "/etc/pki/my_little/certs/DBReplica_No.1_client.key."
Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1_client.csr."
# salt-call tls.create_ca_signed_cert my_little CN=MasterDBReplica_No.2
Certificate "MasterDBReplica_No.2" already exists
(DOH!)
# salt-call tls.create_ca_signed_cert my_little CN=MasterDBReplica_No.2 \
cert_type=server type_ext=True
Created Certificate for "MasterDBReplica_No.2": "/etc/pki/my_little/certs/MasterDBReplica_No.2_server.crt"
CLI Example #4:
Create a server req + cert with non-CN filename for the cert
.. code-block:: bash
# salt-call tls.create_csr my_little CN=www.anothersometh.ing \
cert_type=server type_ext=True
Created Private Key: "/etc/pki/my_little/certs/www.anothersometh.ing_server.key."
Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/www.anothersometh.ing_server.csr."
# salt-call tls_create_ca_signed_cert my_little CN=www.anothersometh.ing \
cert_type=server cert_filename="something_completely_different"
Created Certificate for "www.anothersometh.ing": /etc/pki/my_little/certs/something_completely_different.crt
i ( t absolute_importt unicode_literalst print_functionN( t datetime( t CommandExecutionError( t LooseVersion( t six( t rangeu __version__u 0.0u
%y%m%d%H%M%SZu
%Y%m%d%H%M%SZc C@ sz t rf t t d � k rf t t d � k r@ t a t j d � n" t t d � k rb t j d � n t St a t d f Sd S( u@
Only load this module if the ca config options are set
u 0.10u 0.14uf You should upgrade pyOpenSSL to at least 0.14.1 to enable the use of X509 extensions in the tls moduleu 0.15uk You should upgrade pyOpenSSL to at least 0.15.1 to enable the full use of X509 extensions in the tls moduleuQ PyOpenSSL version 0.10 or later must be installed before this module can be used.N( t HAS_SSLt OpenSSL_versiont
_LooseVersiont Falset X509_EXT_ENABLEDt logt debugt True( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt __virtual__� s c C@ s7 t j t j � � \ } } t | � } d j | | � S( uD
Return a Unix timestamp as a string of digits
:return:
u {0:f}{1}( t matht modft timet intt format( t val1t val2( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt
_microtime� s c C@ sN | s% t j d t d d � � } n | sJ t j d t d d � � } n | S( u�
Return the base path for certs from CLI or from options
cacert_path
absolute path to ca certificates root directory
CLI Example:
.. code-block:: bash
salt '*' tls.cert_base_path
u ca.contextual_cert_base_pathu
config.optionu ca.cert_base_path( t __context__t gett __salt__( t cacert_path( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt cert_base_path� s
c C@ s
t | � S( u!
Retrocompatible wrapper
( R ( R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt _cert_base_path� s c C@ s | r | t d <n t � S( u�
If wanted, store the aforementioned cacert_path in context
to be used as the basepath for further operations
CLI Example:
.. code-block:: bash
salt '*' tls.set_ca_path /etc/certs
u ca.contextual_cert_base_path( R R ( R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt set_ca_path� s
c C@ s t t j d j t j j j t � � t j
r< t j d � n t j d � j
d � f � � d � } t j d | � t d } t j d | � d j | | � } t j j | � s� t j | � n t j j | � s� d } n d
} t j j j | | � � } | j t | � � Wd QX| S( u�
Return a serial number in hex using os.urandom() and a Unix timestamp
in microseconds.
ca_name
name of the CA
CN
common name in the request
t _i u hexi u Hashnum: %su cachediru cachedir: %su {0}/{1}.serialu wu a+N( R t binasciit hexlifyt joint saltt utilst stringutilst to_bytesR R t PY3t ost urandomt encodeR
R t __opts__R t patht existst makedirst filest fopent writet str( t ca_namet hashnumt cachedirt serial_filet modet ofile( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt _new_serial� s$
6
c C@ s
| j t � S( N( t strftimet two_digit_year_fmt( t datetimeObj( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt _four_digit_year_to_two_digit s c C@ s� | d k r$ d j t � | � } n d j | � } t | � } t t | � � } t | j � d � } d } | d j g | j � j � D] \ } } d j | | � ^ q� � 7} | d 7} | | | | f S( u6
Get basic info to write out to the index.txt
u {0}/{1}u
{0}/index.txtu Xu /u {0}={1}u
N(
t NoneR R t
_read_certR> t _get_expiration_datet get_serial_numberR# t get_subjectt get_components( R4 t certt ca_dirt
index_filet expire_datet
serial_numbert subjectt xt y( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt _get_basic_info s 8
u Vc C@ s� t | � d j t � | � } t | | | � \ } } } } d j | | | | � } t j j j | d � �# }
|
j t j j j
| � � Wd QXd S( u�
write out the index.txt database file in the appropriate directory to
track certificates
ca_name
name of the CA
cert
certificate to be recorded
u {0}/{1}u {0} {1} {2} unknown {3}u a+N( R R R RM R$ R% R0 R1 R2 R& t to_str( R4 RE R t statusRF RG RH RI RJ t
index_dataR9 ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt _write_cert_to_database! s
c C@ s� t | � | s" d j | � } n d j t � | | � } d j t � | | � } t j j j | � �f} t j j t j j
| j � � } | j � d k r�t
j d | � t j j j | � �} y1 t j j t j j
| j � � } | j � } Wn t k
rd } n Xy) t j | j � d � t j � j }
Wn t t f k
rXd }
n X| j � } t | d | d
|
d | j d | j d
| j d | j d | j d | j d | j! d t" �
Wd QXn Wd QXd S( u�
Check that the X509 version is correct
(was incorrectly set in previous salt versions).
This will fix the version if needed.
ca_name
ca authority name
cacert_path
absolute path to ca certificates root directory
ca_filename
alternative filename for the CA
.. versionadded:: 2015.5.3
CLI Example:
.. code-block:: bash
salt '*' tls.maybe_fix_ssl_version test_ca /etc/certs
u {0}_ca_certu {0}/{1}/{2}.crtu {0}/{1}/{2}.keyi u2 Regenerating wrong x509 version for certificate %si u
%Y%m%d%H%M%SZim t bitst dayst CNt Ct STt Lt Ot OUt emailAddresst fixmodeN(# R R R R$ R% R0 R1 t OpenSSLt cryptot load_certificatet FILETYPE_PEMt readt get_versionR
t infot load_privatekeyRR t ExceptionR t strptimet get_notAftert utcnowRS t
ValueErrort TypeErrorRC t create_caRT RU RV RW RX RY RZ R ( R4 R t ca_filenamet certpt ca_keypt ficRE t fic2t keyRR RS t subj( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt maybe_fix_ssl_version= sV
c C@ sj t | � | s" d j | � } n d j t � | | � } t j j | � rf t | d | d | �t St S( ul
Verify whether a Certificate Authority (CA) already exists
ca_name
name of the CA
cacert_path
absolute path to ca certificates root directory
ca_filename
alternative filename for the CA
.. versionadded:: 2015.5.3
CLI Example:
.. code-block:: bash
salt '*' tls.ca_exists test_ca /etc/certs
u {0}_ca_certu {0}/{1}/{2}.crtR Rk ( R R R R) R- R. Rr R R ( R4 R Rk Rl ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt ca_exists� s
c C@ s
t | | � S( u Retrocompatible wrapper( Rs ( R4 R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt
_ca_exists� s c C@ s� t | � d j t � | | � } t j j | � sL t d j | � � � nB | r� t j j j
| � �" } t j j j | j
� � } Wd QXn | S( u_
Get the certificate path or content
ca_name
name of the CA
as_text
if true, return the certificate content instead of the path
cacert_path
absolute path to ca certificates root directory
CLI Example:
.. code-block:: bash
salt '*' tls.get_ca test_ca as_text=False cacert_path=/etc/certs
u {0}/{1}/{2}_ca_cert.crtu" Certificate does not exist for {0}N( R R R R) R- R. Rh R$ R% R0 R1 R& t
to_unicodeR` ( R4 t as_textR Rl Rn ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt get_ca� s
$u localhostc C@ s� t | � | s | } n d j t � | | � } t j j | � s[ t d j | � � � nB | r� t j j j
| � �" } t j j j | j
� � } Wd QXn | S( u;
Get the certificate path or content
ca_name
name of the CA
CN
common name of the certificate
as_text
if true, return the certificate content instead of the path
cacert_path
absolute path to certificates root directory
cert_filename
alternative filename for the certificate, useful when using special characters in the CN
.. versionadded:: 2015.5.3
CLI Example:
.. code-block:: bash
salt '*' tls.get_ca_signed_cert test_ca CN=localhost as_text=False cacert_path=/etc/certs
u {0}/{1}/certs/{2}.crtu# Certificate does not exists for {0}N( R R R R) R- R. Rh R$ R% R0 R1 R& Ru R` ( R4 RT Rv R t
cert_filenameRl Rn ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt get_ca_signed_cert� s
$c C@ s� t | � | s | } n d j t � | | � } t j j | � s[ t d j | � � � nB | r� t j j j
| � �" } t j j j | j
� � } Wd QXn | S( ui
Get the certificate path or content
ca_name
name of the CA
CN
common name of the certificate
as_text
if true, return the certificate content instead of the path
cacert_path
absolute path to certificates root directory
key_filename
alternative filename for the key, useful when using special characters
.. versionadded:: 2015.5.3
in the CN
CLI Example:
.. code-block:: bash
salt '*' tls.get_ca_signed_key test_ca CN=localhost as_text=False cacert_path=/etc/certs
u {0}/{1}/certs/{2}.keyu# Certificate does not exists for {0}N( R R R R) R- R. Rh R$ R% R0 R1 R& Ru R` ( R4 RT Rv R t key_filenamet keypRn ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt get_ca_signed_key� s
$c C@ s� t | t j � r{ yA t j j j | � �& } t j j t j j
| j � � SWd QXWq� t k
rw t
j d | � d SXn' t | d � s� t
j d | � d S| Sd S( Nu Failed to read cert from path %su get_notAfteru" %s is not a valid cert path/object( t
isinstanceR t string_typesR$ R% R0 R1 R\ R] R^ R_ R` Rd R
t exceptionR? t hasattrt error( RE t rfh( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyR@ & s
c C@ sU t | � } | d k r0 t d j | � � � n t j t j j j | j
� � t � S( u,
Returns a datetime.datetime object
u1 Failed to read cert from {0}, see log for detailsN( R@ R? R R R Re R$ R% R& RN Rf t four_digit_year_fmt( RE t cert_obj( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyRA 9 s u %Y-%m-%dc C@ s t | � j | � S( u
.. versionadded:: 2019.2.0
Get a certificate's expiration date
cert
Full path to the certificate
date_format
By default this will return the expiration date in YYYY-MM-DD format,
use this to specify a different strftime format string. Note that the
expiration time will be in UTC.
CLI Examples:
.. code-block:: bash
salt '*' tls.get_expiration_date /path/to/foo.crt
salt '*' tls.get_expiration_date /path/to/foo.crt date_format='%d/%m/%Y'
( RA R; ( RE t date_format( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt get_expiration_dateJ s c C@ s, d } t d } | d k r� t | t j � sN | s� i d d 6t d 6} q� q� t | t j � r� | | � d k r� i d d 6t d 6} t j d � q� q� n | d k r(t | t j � s� | r%i d d 6t d 6} q%q(t | t j � r(| | � d k r%i d d 6t d 6} t j d � q%q(n | S( Nu cmd.retcodeu onlyif condition is falseu commentu resulti u unless condition is true( R? R R} R R~ R R
R ( t onlyift unlesst rett retcode( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt _check_onlyif_unlessb s&
i im u USu Utahu Salt Lake Cityu SaltStacku sha256c ! C@ s� t | | � } | d k r d St | � | sA d j | � } n d j t � | | � } d j t � | | � } | r� |
r� t | d | �r� d j | � S|
r� t j j | � r� t d j | � � � n t j j d j t � | � � st j
d j t � | � � n d } t j j | � r�t j j
j | � �� } y% t j j t j j | j � � } Wnm t j j k
r�} t j d | | � d j | t j � j d
� � } t j d | � t j | | � n XWd QXn | s t j j � } | j t j j | � n t j j � } | j d
� | j! t" | � � | | j# � _$ | | j# � _% | | j# � _& | | j# � _' | r�| | j# � _( n | | j# � _) | r�| | j# � _* n | j+ d � | j, t- | � d d d � | j. | j# � � | j/ | � t0 r�| j1 t j j2 d t3 d � t j j2 d t3 d � t j j2 d t4 d d | �g � | j1 t j j2 d t4 d d | �g � n | j5 | t j j6 j7 |
� � t j j8 t j j | � } t3 } t j j | � r�d j | t j � j d
� � } t j j
j | � �� } t j j6 j9 | j � � j: � } | j: � | j: � k rQt4 } nN t j d | � t j j
j | d � �$ } | j; | � t j< | d � Wd QXWd QXn | r�t j j
j | d � �# } | j; t j j6 j= | � � Wd QXn t j j
j | d � �8 } | j; t j j6 j= t j j> t j j | � � � Wd QXt? | | � d j t � | | � } | d! j | t � | | � 7} | S(" u`
Create a Certificate Authority (CA)
ca_name
name of the CA
bits
number of RSA key bits, default is 2048
days
number of days the CA will be valid, default is 365
CN
common name in the request, default is "localhost"
C
country, default is "US"
ST
state, default is "Utah"
L
locality, default is "Centerville", the city where SaltStack originated
O
organization, default is "SaltStack"
OU
organizational unit, default is None
emailAddress
email address for the CA owner, default is None
cacert_path
absolute path to ca certificates root directory
ca_filename
alternative filename for the CA
.. versionadded:: 2015.5.3
digest
The message digest algorithm. Must be a string describing a digest
algorithm supported by OpenSSL (by EVP_get_digestbyname, specifically).
For example, "md5" or "sha1". Default: 'sha256'
replace
Replace this certificate even if it exists
.. versionadded:: 2015.5.1
Writes out a CA certificate based upon defined config values. If the file
already exists, the function just returns assuming the CA certificate
already exists.
If the following values were set::
ca.cert_base_path='/etc/pki'
ca_name='koji'
the resulting CA, and corresponding key, would be written in the following
location::
/etc/pki/koji/koji_ca_cert.crt
/etc/pki/koji/koji_ca_cert.key
CLI Example:
.. code-block:: bash
salt '*' tls.create_ca test_ca
u {0}_ca_certu {0}/{1}/{2}.crtu {0}/{1}/{2}.keyRk u- Certificate for CA named "{0}" already existsu {0} does not exists, can't fixu {0}/{1}u? Error loading existing private key %s, generating a new key: %su {0}.unloadable.{1}u %Y%m%d%H%M%Su" Saving unloadable CA ssl key in %sNi i i i< t basicConstraintss CA:TRUE, pathlen:0t keyUsages keyCertSign, cRLSignt subjectKeyIdentifiert hashRJ t authorityKeyIdentifiers issuer:always,keyid:alwayst issueru {0}.{1}u Saving old CA ssl key in %su wi� u wbu( Created Private Key: "{0}/{1}/{2}.key." u$ Created CA "{0}": "{1}/{2}/{3}.crt."(@ R� R? R R R Rs R) R- R. Rh R/ R$ R% R0 R1 R\ R] Rc R_ R` t ErrorR
t warningR Rg R; Rb t renamet PKeyt generate_keyt TYPE_RSAt X509t set_versiont set_serial_numberR: RC RU RV RW RX RY RT RZ t gmtime_adj_notBeforet gmtime_adj_notAfterR t
set_issuert
set_pubkeyR t add_extensionst
X509ExtensionR R t signR& RN t dump_privatekeyRu t stripR2 t chmodR' t dump_certificateRQ (! R4 RR RS RT RU RV RW RX RY RZ R[ R Rk t digestR� R� t replaceRO Rl Rm Rp Ro t errt bckt cat
keycontentt write_keyRn t old_keyt bckft ca_keyt ca_crtR� ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyRj x s� M
!
%
c C@ sg t s t d j t � � � i } | d k rC t j d � d } n y t d d t � | d <Wn t k
r� } t j | � n X| d s� | d d k r� i i d d 6d
6i d d 6d
d 6d 6| d <n y t d d t � | d <Wn t k
r } t j | � n X| d s%| d d k rNi i d d 6d d 6d
6i d 6| d <n y t d d t � | d <Wn t k
r�} t j | � n X| d s�| d d k r�i i d d 6d d 6d
6i d 6| d <n | | k r/y! t d d j | � � | | <Wq/t k
r+} t j d j | | � � q/Xn | d } x' | D] } | | j
| | | � q@W| S( uO
Fetch X509 and CSR extension definitions from tls:extensions:
(common|server|client) or set them to standard defaults.
.. versionadded:: 2015.8.0
cert_type:
The type of certificate such as ``server`` or ``client``.
CLI Example:
.. code-block:: bash
salt '*' tls.get_extensions client
uY X509 extensions are not supported in pyOpenSSL prior to version 0.15.1. Your version: {0}u uK cert_type set to empty in tls_ca.get_extensions(); defaulting to ``server``u serveru
pillar.getu tls.extensions:commonu commonu CA:FALSEu basicConstraintsu csru keyid,issuer:alwaysu authorityKeyIdentifieru hashu subjectKeyIdentifieru certu tls.extensions:serveru
serverAuthu extendedKeyUsageu! digitalSignature, keyEnciphermentu keyUsageu tls.extensions:clientu clientu
clientAuthu1 nonRepudiation, digitalSignature, keyEnciphermentu tls.extensions:{0}uO pillar, tls:extensions:{0} not available or not operating in a salt context
{1}( R t AssertionErrorR R R
R� R R t NameErrorR t update( t cert_typet extR� t et retvalt Use( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt get_extensions> sb
u serverc C@ s� t |
� | s" d j | � } n t | d | �sA d j | � S| s_ d j t � | � } n t j j | � s� t j | � n | r� d j | � n d } |
s� d j | | � }
n d j | |
� } | r� t j j | � r� d j | � St j j
� } | j t j j | � t j j
� } | | j � _ | | j � _ | | j � _ | | j � _ | rw| | j � _ n | | j � _ | r�| | j � _ n y� t | � d
} g } xr | j � D]d \ } } t | t j � r�t j j j | � } n | j t j j t j j j | � t! | � � q�WWn& t" k
rU} t# j$ | � g } n X| r�t% r�t | t j � r�| g } n | j t j j d t! d j& t j j' j( | � � � � q�t) d
j t* � � � n t% r�| j+ | � n | j, | � | j- | t j j j. | � � t j j/ j0 d j | |
� d � �8 } | j1 t j j j t j j2 t j j3 | � � � Wd QXt j j/ j0 | d � �8 } | j1 t j j j t j j4 t j j3 | � � � Wd QXd j | |
� } | d j | | |
� 7} | S( u,
Create a Certificate Signing Request (CSR) for a
particular Certificate Authority (CA)
ca_name
name of the CA
bits
number of RSA key bits, default is 2048
CN
common name in the request, default is "localhost"
C
country, default is "US"
ST
state, default is "Utah"
L
locality, default is "Centerville", the city where SaltStack originated
O
organization, default is "SaltStack"
NOTE: Must the same as CA certificate or an error will be raised
OU
organizational unit, default is None
emailAddress
email address for the request, default is None
subjectAltName
valid subjectAltNames in full form, e.g. to add DNS entry you would call
this function with this value:
examples: ['DNS:somednsname.com',
'DNS:1.2.3.4',
'IP:1.2.3.4',
'IP:2001:4801:7821:77:be76:4eff:fe11:e51',
'email:me@i.like.pie.com']
.. note::
some libraries do not properly query IP: prefixes, instead looking
for the given req. source with a DNS: prefix. To be thorough, you
may want to include both DNS: and IP: entries if you are using
subjectAltNames for destinations for your TLS connections.
e.g.:
requests to https://1.2.3.4 will fail from python's
requests library w/out the second entry in the above list
.. versionadded:: 2015.8.0
cert_type
Specify the general certificate type. Can be either `server` or
`client`. Indicates the set of common extensions added to the CSR.
.. code-block:: cfg
server: {
'basicConstraints': 'CA:FALSE',
'extendedKeyUsage': 'serverAuth',
'keyUsage': 'digitalSignature, keyEncipherment'
}
client: {
'basicConstraints': 'CA:FALSE',
'extendedKeyUsage': 'clientAuth',
'keyUsage': 'nonRepudiation, digitalSignature, keyEncipherment'
}
type_ext
boolean. Whether or not to extend the filename with CN_[cert_type]
This can be useful if a server and client certificate are needed for
the same CN. Defaults to False to avoid introducing an unexpected file
naming pattern
The files normally named some_subject_CN.csr and some_subject_CN.key
will then be saved
replace
Replace this signing request even if it exists
.. versionadded:: 2015.5.1
Writes out a Certificate Signing Request (CSR) If the file already
exists, the function just returns assuming the CSR already exists.
If the following values were set::
ca.cert_base_path='/etc/pki'
ca_name='koji'
CN='test.egavas.org'
the resulting CSR, and corresponding key, would be written in the
following location::
/etc/pki/koji/certs/test.egavas.org.csr
/etc/pki/koji/certs/test.egavas.org.key
CLI Example:
.. code-block:: bash
salt '*' tls.create_csr test
u {0}_ca_certRk uF Certificate for CA named "{0}" does not exist, please create it first.u {0}/{1}/certs/u _{0}u u {0}{1}u {0}/{1}.csru( Certificate Request "{0}" already existsu csrt subjectAltNames , uz subjectAltName cannot be set as X509 extensions are not supported in pyOpenSSL prior to version 0.15.1. Your version: {0}.u {0}/{1}.keyu wb+Nu# Created Private Key: "{0}{1}.key." u$ Created CSR for "{0}": "{1}{2}.csr."(5 R R Rs R R) R- R. R/ R\ R] R� R� R� t X509ReqRC RU RV RW RX RY RT RZ R� t itemsR} R R~ R$ R% R& R' t appendR� R R� R
R� R R# t dataR+ Rh R R� R� R� RN R0 R1 R2 R� R_ t dump_certificate_request( R4 RR RT RU RV RW RX RY RZ R� R Rk t csr_patht csr_filenameR� t type_extR� R� t CN_extt csr_fRp t reqt
extensionst extension_addsR� t valueR� t priv_keyt csrR� ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt
create_csr� s� s
%
u tlsc C@ s� t |
� t j j d j t � | � � sJ t j d j t � | � � n | sY | } n |
r� t j j d j t � | | � � r� d j | � St j j � } | j
t j j | � t j j � } | j
d � | j d � | j t | � d d d � | | j � _ | | j � _ | | j � _ | | j � _ | rR| | j � _ n | | j � _ | ry| | j � _ n | j t | � � | j | j � � | j | � | j | t j j j! | � � d j t � | | � } t j j" j# | d � �8 } | j$ t j j j% t j j& t j j' | � � � Wd
QXd j t � | | � } t j j" j# | d � �8 } | j$ t j j j% t j j( t j j' | � � � Wd
QXt) | | � d j t � | | � } | d j t � | | � 7} | S(
u�
Create a Self-Signed Certificate (CERT)
tls_dir
location appended to the ca.cert_base_path, default is 'tls'
bits
number of RSA key bits, default is 2048
CN
common name in the request, default is "localhost"
C
country, default is "US"
ST
state, default is "Utah"
L
locality, default is "Centerville", the city where SaltStack originated
O
organization, default is "SaltStack"
NOTE: Must the same as CA certificate or an error will be raised
OU
organizational unit, default is None
emailAddress
email address for the request, default is None
cacert_path
absolute path to ca certificates root directory
digest
The message digest algorithm. Must be a string describing a digest
algorithm supported by OpenSSL (by EVP_get_digestbyname, specifically).
For example, "md5" or "sha1". Default: 'sha256'
replace
Replace this certificate even if it exists
.. versionadded:: 2015.5.1
Writes out a Self-Signed Certificate (CERT). If the file already
exists, the function just returns.
If the following values were set::
ca.cert_base_path='/etc/pki'
tls_dir='koji'
CN='test.egavas.org'
the resulting CERT, and corresponding key, would be written in the
following location::
/etc/pki/koji/certs/test.egavas.org.crt
/etc/pki/koji/certs/test.egavas.org.key
CLI Example:
.. code-block:: bash
salt '*' tls.create_self_signed_cert
Passing options from the command line:
.. code-block:: bash
salt 'minion' tls.create_self_signed_cert CN='test.mysite.org'
u {0}/{1}/certs/u {0}/{1}/certs/{2}.crtu Certificate "{0}" already existsi i i i< u {0}/{1}/certs/{2}.keyu wb+Nu. Created Private Key: "{0}/{1}/certs/{2}.key." u- Created Certificate: "{0}/{1}/certs/{2}.crt."(* R R) R- R. R R R/ R\ R] R� R� R� R� R� R� R� R RC RU RV RW RX RY RT RZ R� R: R� R� R� R$ R% R& RN R0 R1 R2 R' R� R_ R� RQ ( t tls_dirRR RS RT RU RV RW RX RY RZ R Rx R� R� Rp RE t
priv_key_pathR� t crt_patht crtR� ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt create_self_signed_cert� sp J
!
c
C@ s� i } t | � | s( d j | � } n | sF d j t � | � } n | r~ | sc t j d � | S| r� d j | � } q� n d } d j | | � }
| s� d j | | � } n |
r
t j j t j j t j j j d j t � | | � j
d � � � � r
d j | � Sy� t | d
| d | �t j
j j d j t � | | � � �( } t j j t j j | j � � } Wd
QXt j
j j d j t � | | � � �( } t j j t j j | j � � } Wd
QXWn/ t k
r�d | d <d j | � | d <| SXyU d j | |
� } t j
j j | � �( } t j j t j j | j � � } Wd
QXWn/ t k
r�d | d <d j | � | d <| SXg } y | j | j � � Wn� t k
rwy� t j d j t � � t j j j | j � } xf t! t j j j" | � � D]I } t j j# j$ t j j# � } t j j j% | | � | _& | j' | � q�WWqxt( k
rst j d j t � � qxXn Xt j j) � } | j* d � | j+ | j, � � | j- d � | j. t/ | � d d d � | j0 t1 | � � | j2 | j, � � | j3 | j4 � � | j5 | � | j6 | t j
j7 j8 | � � d j | | � } t j
j j | d � �8 } | j9 t j
j7 j: t j j; t j j | � � � Wd
QXt< | | � d j | | | � S( u
Create a Certificate (CERT) signed by a named Certificate Authority (CA)
If the certificate file already exists, the function just returns assuming
the CERT already exists.
The CN *must* match an existing CSR generated by create_csr. If it
does not, this method does nothing.
ca_name
name of the CA
CN
common name matching the certificate signing request
days
number of days certificate is valid, default is 365 (1 year)
cacert_path
absolute path to ca certificates root directory
ca_filename
alternative filename for the CA
.. versionadded:: 2015.5.3
cert_path
full path to the certificates directory
cert_filename
alternative filename for the certificate, useful when using special
characters in the CN. If this option is set it will override
the certificate filename output effects of ``cert_type``.
``type_ext`` will be completely overridden.
.. versionadded:: 2015.5.3
digest
The message digest algorithm. Must be a string describing a digest
algorithm supported by OpenSSL (by EVP_get_digestbyname, specifically).
For example, "md5" or "sha1". Default: 'sha256'
replace
Replace this certificate even if it exists
.. versionadded:: 2015.5.1
cert_type
string. Either 'server' or 'client' (see create_csr() for details).
If create_csr(type_ext=True) this function **must** be called with the
same cert_type so it can find the CSR file.
.. note::
create_csr() defaults to cert_type='server'; therefore, if it was also
called with type_ext, cert_type becomes a required argument for
create_ca_signed_cert()
type_ext
bool. If set True, use ``cert_type`` as an extension to the CN when
formatting the filename.
e.g.: some_subject_CN_server.crt or some_subject_CN_client.crt
This facilitates the context where both types are required for the same
subject
If ``cert_filename`` is `not None`, setting ``type_ext`` has no
effect
If the following values were set:
.. code-block:: text
ca.cert_base_path='/etc/pki'
ca_name='koji'
CN='test.egavas.org'
the resulting signed certificate would be written in the following
location:
.. code-block:: text
/etc/pki/koji/certs/test.egavas.org.crt
CLI Example:
.. code-block:: bash
salt '*' tls.create_ca_signed_cert test localhost
u {0}_ca_certu
{0}/{1}/certsu@ type_ext = True but cert_type is unset. Certificate not written.u _{0}u u {0}{1}u {0}/{1}/certs/{2}.crtu /u Certificate "{0}" already existsR Rk u {0}/{1}/{2}.crtNu {0}/{1}/{2}.keyi u retcodeu There is no CA named "{0}"u commentu {0}/{1}.csru) There is no CSR that matches the CN "{0}"u| req.get_extensions() not supported in pyOpenSSL versions prior to 0.15. Processing extensions internally. Your version: {0}u} X509 extensions are unsupported in pyOpenSSL versions prior to 0.14. Upgrade required to use extensions. Current version: {0}i i i i< u {0}/{1}.crtu wb+u, Created Certificate for "{0}": "{1}/{2}.crt"(= R R R R
R� R) R- R. R# t sept splitRr R$ R% R0 R1 R\ R] R^ R_ R` Rc t IOErrort load_certificate_requestt extendR� t AttributeErrorRb R t _utilt libt X509_REQ_get_extensionst _reqt _ranget sk_X509_EXTENSION_numR� t __new__t sk_X509_EXTENSION_valuet
_extensionR� Rd R� R� t set_subjectRC R� R� R R� R: R� R� t
get_pubkeyR� R� R& RN R2 R' R� RQ ( R4 RT RS R Rk t cert_pathRx R� R� R� R� R� R� R� t fhrt ca_certR� R� R� t extst native_exts_objt iR� RE t cert_full_pathR� ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt create_ca_signed_cert s� e
u c
C@ s& t | � | rB t j j d j t � | | � � rB d j | � SyU t j j j d j t � | | � � �( } t
j j t
j j
| j � � } Wd QXWn t k
r� d j | � SXy� t j j j d j t � | | � � �( } t
j j t
j j
| j � � } Wd QXt j j j d j t � | | � � �( } t
j j t
j j
| j � � } Wd QXWn t k
rxd j | � SXt
j j � } | j | � | j | g � | j | � t j j j d j t � | | � d � �/ }
|
j | j d
t j j j | � � � Wd QXd j | t � | | � S( u'
Create a PKCS#12 browser certificate for a particular Certificate (CN)
ca_name
name of the CA
CN
common name matching the certificate signing request
passphrase
used to unlock the PKCS#12 certificate when loaded into the browser
cacert_path
absolute path to ca certificates root directory
replace
Replace this certificate even if it exists
.. versionadded:: 2015.5.1
If the following values were set::
ca.cert_base_path='/etc/pki'
ca_name='koji'
CN='test.egavas.org'
the resulting signed certificate would be written in the
following location::
/etc/pki/koji/certs/test.egavas.org.p12
CLI Example:
.. code-block:: bash
salt '*' tls.create_pkcs12 test localhost
u {0}/{1}/certs/{2}.p12u Certificate "{0}" already existsu {0}/{1}/{2}_ca_cert.crtNu There is no CA named "{0}"u {0}/{1}/certs/{2}.crtu {0}/{1}/certs/{2}.keyu1 There is no certificate that matches the CN "{0}"u wbt
passphraseu> Created PKCS#12 Certificate for "{0}": "{1}/{2}/certs/{3}.p12"( R R) R- R. R R R$ R% R0 R1 R\ R] R^ R_ R` R� Rc t PKCS12t set_certificatet set_ca_certificatest set_privatekeyR2 t exportR& R' ( R4 RT R� R R� R� R� RE Rp t pkcs12R9 ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt
create_pkcs12 s\ "
c C@ s� d } d | k r? t j j j | � � } | j � } Wd QXn t j j t j j | � } i } xx | j � j
� D]d \ } } t | t � r� t j j
j | � } n t | t � r� t j j
j | � } n | | | <qs Wi } xx | j � j
� D]d \ } } t | t � r't j j
j | � } n t | t � rNt j j
j | � } n | | | <q� Wi t j j
j | j t j j
j | � � � d 6| d 6| d 6| j � d 6t j t j t | j � j t � � | � � d 6t j t j | j � j t � | � � d 6} t | d
� r�i | d <x| t | j � � D]e } yH | j | � }
t j j
j |
j � � } t |
� j! � | d | <Wq3t" k
r�q3q3Xq3Wn d | j# d i � k r^d } t$ � } x� t | d d � j% d � D]c }
|
j% d d � \ } }
| | k r:t& j' d j( | d |
d j) | � � � q�| j* |
� q�Wt+ | � | d <n t | d � r�yA | j, � } t | t � r�t j j
j | � } n | | d <Wq�t" k
r�q�Xn | S( u:
Return information for a particular certificate
cert
path to the certifiate PEM file or string
.. versionchanged:: 2018.3.4
digest
what digest to use for fingerprinting
CLI Example:
.. code-block:: bash
salt '*' tls.cert_info /dir/for/certs/cert.pem
u
%Y%m%d%H%M%SZu
-----BEGINNu fingerprintu subjectu issueru
serial_numberu
not_beforeu not_afteru get_extension_countu
extensionsu subjectAltNameu DNSu
IP Addressu , u :i u9 Cert {0} has an entry ({1}) which does not start with {2}u /u subject_alt_namesu get_signature_algorithmu signature_algorithm( u DNSu
IP Address(- R$ R% R0 R1 R` R\ R] R^ R_ t
get_issuerRD R} t bytesR& Ru RC R� RN RB t calendart timegmR Re R3 t
get_notBeforet decodet __salt_system_encoding__Rf R� R� t get_extension_countt
get_extensiont get_short_nameR� R� R t setR� R
R� R R# t addt listt get_signature_algorithm( RE R� t date_fmtt cert_fileR� Rp R� RJ R� R� R� t
valid_entriest valid_namest namet entry( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt cert_infod sz "
$
c
C@ s� t | � | s" d j | � } n | s@ d j t � | � } n t j j d j | � � rh d j | � Sy� t j j j d j t
� | | � � �( } t j j
t j j | j � � } Wd QXt j j j d j t
� | | � � �( } t j j t j j | j � � } Wd QXWn t k
r+d j | � SXt j j � } | j | | � } t j j j | d � �# } | j t j j j | � � Wd QXd
j | � S( u
Create an empty Certificate Revocation List.
.. versionadded:: 2015.8.0
ca_name
name of the CA
cacert_path
absolute path to ca certificates root directory
ca_filename
alternative filename for the CA
.. versionadded:: 2015.5.3
crl_file
full path to the CRL file
CLI Example:
.. code-block:: bash
salt '*' tls.create_empty_crl ca_name='koji' ca_filename='ca' crl_file='/etc/openvpn/team1/crl.pem'
u {0}_ca_certu {0}/{1}/crl.pemu {0}u CRL "{0}" already existsu {0}/{1}/{2}.crtNu {0}/{1}/{2}.keyu There is no CA named "{0}"u wu Created an empty CRL: "{0}"( R R R R) R- R. R$ R% R0 R1 R R\ R] R^ R_ R` Rc R� t CRLR� R2 R& RN (
R4 R Rk t crl_filet fp_R� R� t crlt crl_textt f( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt create_empty_crl� s>
"c
C@ sv t | � d j t � | � } | d k r= d j | � } n | d k ra d j t � | � } n | d k r d j | � } n y� t j j j d j t � | | � � �( } t j
j t j
j | j
� � } Wd QXt j j j d j t � | | � � �( } t j
j t j
j | j
� � }
Wd QXWn t k
rBd j | � SXt d j | | � � } | d k rtd
j | � St | | | � \ } }
} } d j | | � } d j |
| � } t j d
|
d t j | � � } d j |
t t j � � | � } i } t j j j | � �� } x� | D]� } t j j j | � } | j | � r�| j d � d } y' t j | t � d j | | | � SWq�t k
r�d | d <d j | t � | d <| SXq | | k r t d | | | d t �Pq q WWd QXt j
j! � } t j j j | � �� } x� | D]� } t j j j | � } | j" d � r | j d � } t j
j# � } | j$ | d � t j | d t � } | j% | j& t' � � | j( | � q q WWd QX| j) | |
� } | d k r�d j t � | � } n t* j+ j, | � r&d | d <d j | � | d <| St j j j | d � �# } | j- t j j j. | � � Wd QXd j | | | � S( u�
Revoke a certificate.
.. versionadded:: 2015.8.0
ca_name
Name of the CA.
CN
Common name matching the certificate signing request.
cacert_path
Absolute path to ca certificates root directory.
ca_filename
Alternative filename for the CA.
cert_path
Path to the cert file.
cert_filename
Alternative filename for the certificate, useful when using special
characters in the CN.
crl_file
Full path to the CRL file.
CLI Example:
.. code-block:: bash
salt '*' tls.revoke_cert ca_name='koji' ca_filename='ca' crl_file='/etc/openvpn/team1/crl.pem'
u {0}/{1}u {0}_ca_certu
{0}/{1}/certsu {0}u {0}/{1}/{2}.crtNu {0}/{1}/{2}.keyu There is no CA named "{0}"u {0}/{1}.crtu* There is no client certificate named "{0}"u {0} unknown {1}u
V {0} {1}u R\tu \t\d{12}Z\tu
R {0} {1} {2}u i u5 "{0}/{1}.crt" was already revoked, serial number: {2}i u retcodeu0 Revocation date '{0}' does not matchformat '{1}'u commentu file.replacet backupu Ri u {0}/{1}/crl.pemu' crl_file "{0}" is an existing directoryu wu6 Revoked Certificate: "{0}/{1}.crt", serial number: {2}(/ R R R R? R R$ R% R0 R1 R\ R] R^ R_ R` Rc R� R@ RM t ret compilet escapeR> R Rg R& Ru t matchR� Re R< Rh R R R t
startswitht Revokedt
set_serialt set_rev_dateR; R� t add_revokedR� R) R- t isdirR2 RN ( R4 RT R Rk R� Rx R RF R R� R� t client_certRG RH RI RJ t index_serial_subjectt index_v_datat index_r_data_patternt index_r_dataR� t linet revoke_dateR
t fieldst revokedt revoke_date_2_digitR ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt revoke_cert s� -
"u __main__u kojiRT u test_systemRU RV RW u CentervilleRX RY RZ u test_system@saltstack.orgR� u test(F t __doc__t
__future__R R R R) R R R� t loggingR R! R t salt.utils.dataR$ t salt.utils.filest salt.utils.stringutilst salt.exceptionsR t salt.utils.versionsR R
t salt.extR t salt.ext.six.movesR R� R R R R R\ t __dict__R R t ImportErrort getLoggert __name__R
R< R� R R R? R R R R: R> RM RQ Rr Rs Rt Rw Ry R| R@ RA R� R� Rj R� R� R� R� R� R R
R# ( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/tls.pyt <module>e s
% D# * - � [ � � �` c I �
Mini Shell