Current File : //lib/python2.7/site-packages/salt/runners/digicertapi.pyo
�
���^c @@ sc d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l j Z d d l
Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l m Z m Z y d d l m Z e Z WnO e k
rJe Z y d d l m Z WqKe k
rFd d l m Z qKXn Xd Z! e j" e# � Z$ d � Z% d
� Z& d � Z' d � Z( d d
� Z* d d � Z+ d d � Z, d d d d d d � Z- d e d � Z. d d d d d d d d e d d d � Z/ d d d d � Z0 d � Z1 d d d d d � Z2 d � Z3 d � Z4 d � Z5 d � Z6 d � Z7 d � Z8 d S( u<
Support for Digicert. Heavily based on the Venafi runner by Joseph Hall (jphall@saltstack.com).
Before using this module you need to register an account with Digicert's CertCentral.
Login to CertCentral, ensure you have a payment method configured and/or there are adequate
funds attached to your account. Click the ``Account`` item in the left sidebar, and select
``Account Access``. The right hand pane should show "Account Access" and a link to create
an API key. Create a new API key and assign it to the user that should be attached to requests
coming from Salt.
NOTE CertCentral will not show the API key again after revealing it the first time. Make sure
you copy it right away or you will have to revoke it and generate a new one.
Now open ``/etc/salt/master`` and add the API key as shown below.
.. code-block:: yaml
digicert:
api_key: ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABC
Restart your Salt Master.
You can also include default values of the following variables to help with creating CSRs:
.. code-block:: yaml
digicert:
api_key: ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABC
shatype: sha256
This API currently only supports RSA key types. Support for other key types will be added
if interest warrants.
i ( t absolute_importt print_functiont unicode_literalsN( t six( t range( t CommandExecutionErrort SaltRunnerError( t RSAu digicertc C@ s# t j d i � j d � r t St S( uE
Only load the module if digicert has configuration in place
u digicertu api_key( t __opts__t gett __virtualname__t False( ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt __virtual__C s c C@ s t j d i � j d d � S( u
Return the base_url
u digicertu base_urlu% https://www.digicert.com/services/v2/( R R ( ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt _base_urlL s c C@ s t j d i � j d d � S( u
Return the API key
u digicertu api_keyu ( R R ( ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt _api_keyU s c O@ s t j j j | | � } d | d k r0 | d St | d d d � } t | d d d � } | d k rp i S| | d } | d k r� | d | S| d | } | d } xc t d | � D]R } | d j | | d � }
t j j j |
| � } | | j | d | � q� W| S(
uN
Wrapper to assist with paginated responses from Digicert's REST API.
u errorsu dictu pageu limitu totali i i u ?offset={0}( t saltt utilst httpt queryt intR t formatt extend( t urlt topkeyt argst kwargst rett limt totalt numpagest
aggregate_rett pt param_urlt next_ret( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt _paginate\ s"
c
C@ sy | r d j t � | � } n d j t � � } t | d d d d t d d d i t � d
6d d 6�} i | d 6} | S(
u�
List domains that CertCentral knows about. You can filter by
container_id (also known as "Division") by passing a container_id.
CLI Example:
.. code-block:: bash
salt-run digicert.list_domains
u {0}/domain?{1}u
{0}/domainu domainst methodu GETt decodet decode_typeu jsont header_dictu X-DC-DEVKEYu application/jsonu Content-Type( R R
R" t TrueR ( t container_idR t orgsR ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt list_domains{ s
c C@ s | r d j t � | � } n d j t � � } t | d d d d t d d d t d
i t � d 6d d
6�} i | d 6} | S( u�
List certificate requests made to CertCentral. You can filter by
status: ``pending``, ``approved``, ``rejected``
CLI Example:
.. code-block:: bash
salt-run digicert.list_requests pending
u {0}/request?status={1}u {0}/requestu requestsR# u GETR$ R% u jsont raise_errorR& u X-DC-DEVKEYu application/jsonu Content-Type( R R
R" R' R R ( t statusR t reqsR ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt
list_requests� s
c C@ sa d j t � � } t | d d d d t d d d t d i t � d
6d d 6�} i | d 6} | S(
u�
List certificate orders made to CertCentral.
CLI Example:
.. code-block:: bash
salt-run digicert.list_orders
u {0}/order/certificateu ordersR# u GETR$ R% u jsonR+ R& u X-DC-DEVKEYu application/jsonu Content-Type( R R
R" R' R R ( R, R R- R ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt list_orders� s
u pem_allc C@ s� | r� t j j j d j t � | � d d d t d t d d d i t � d 6d
d 6�} | d j d
� d k r� i | d d 6S| d j d t � r� i | d d 6S| d j d � j d d+ � } | d j d � j d � } n | s
i i i d d 6d d 6d 6d 6S| rnt j j j d j t � | | � d d d t d t d t d | d t d i t � d 6�} nO t j j j d j t � | | � d d d t d t d t d i t � d 6�} d | k r�i | d 6Sd | k r�i | d 6} | } n t | t � r| d } | } n | } | } d+ }
| sht
j � \ } }
|
} t j | | � t j | � n d d d d d d! d" | g } t j | � }
d+ } x? |
j � D]1 } t j d# | � } | r�| j d$ � } Pq�q�W|
r�t j |
� n | rdd% } t j j t t j � } y | j | | � } Wn t k
rMi | d 6} n X| j | | | � n d& | k r�i i | d' 6| d& j d( d) � d* 6| d& j d d) � d 6d 6Si | d 6S(, u�
Retrieve a certificate by order_id or certificate_id and write it to stdout or a filename.
A list of permissible cert_formats is here:
https://www.digicert.com/services/v2/documentation/appendix-certificate-formats
CLI Example:
.. code-block:: bash
salt-run digicert.get_certificate order_id=48929454 cert_format=apache
Including a 'filename' will write the certificate to the desired file.
Note that some cert formats are zipped files, and some are binary.
If the certificate has not been issued, this function will return the order details
inside of which will be a status (one of pending, rejected, processing, issued,
revoked, canceled, needs_csr, and needs_approval)
If for some reason you want to pipe the output of this command to a file or other
command you will want to leave off the ``filename`` argument and make sure to include
``--no-color`` so there will be no terminal ANSI escape sequences.
u {0}/order/certificate/{1}R# u GETR+ R$ R% u jsonR& u X-DC-DEVKEYu application/jsonu Content-Typeu dictu statusu issuedu certificateu errorsu idu common_nameu unknownu codeuT Unknown error, no certificate ID passed on command line or in body returned from APIu messageu' {0}/certificate/{1}/download/format/{2}t textt headerst text_outu bodyu opensslu x509u -nooutu -subjectu -nameoptu multilineu -inu *commonName *= *(.*)i u digicert/domainsu headersu filenameu Content-Dispositionu Not providedu original_filenameN(! R R R R R R
R R' R R t Nonet
isinstancet dictt tempfilet mkstempt ost writet closet
subprocesst check_outputt
splitlinest ret searcht groupt unlinkt cachet CacheR t syspathst CACHE_DIRt fetcht TypeErrort store( t order_idt certificate_idt minion_idt cert_formatt filenamet
order_certt common_namet ret_certR t certt tmpfilenamet fdt cmdt outt lt common_name_matcht bankRB t data( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt get_certificate� s�
c
C@ sU t d j t � � d d d d t d d d i t � d 6d
d 6�} i | d 6} | S( u`
List organizations that CertCentral knows about. You can filter by
container_id (also known as "Division") by passing a container_id.
This function returns validation information by default; pass
``include_validation=False`` to turn it off.
CLI Example:
.. code-block:: bash
salt-run digicert.list_organizations
u {0}/organizationu
organizationsR# u GETR$ R% u jsonR& u X-DC-DEVKEYu application/jsonu Content-Type( R" R R
R' R ( R( t include_validationR) R ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt list_organizationsY s
i c C@ s0 | r$ t | t j � r$ | g } n | rL t | t j � rL t d � � n i | d 6} | | d <| rv | | d <n" t j d i � j d d � | d <i } | r� t | t j � r� | g } n | r� t | t j � r� t d � � n | r� | | d <n | r8t | | | d
| d d | d d
| d | �} n( t | | | d | d d
| d | �} | | d <| r�| | d d <n i | d 6| d <|
r�|
| d <n | r�| | d <n | r�| | d <n | | d <|
r�i |
d 6| d <n | r| | d <n | | d <t j
j j | � } t j
j
j d j t � � d d d | d t d d! d" i t � d# 6d$ d% 6d& t �} d' | d( k r!d) } t j j t t j � } | j | | � } | d. k r�i } n | j i | d* 6| d( d+ d d d, 6| d 6� | j | | | � t | | � n i | d( d- 6S(/ u�
Order a certificate. Requires that an Organization has been created inside Digicert's CertCentral.
See here for API documentation:
https://www.digicert.com/services/v2/documentation/order/order-ssl-determinator
CLI Example:
.. code-block:: bash
salt-run digicert.order_certificate my_minionid my.domain.com 10 3 signature_hash=sha256 dns_names=['this.domain.com', 'that.domain.com'] organization_units='My Domain Org Unit' comments='Comment goes here for the approver'
This runner can also be used to renew a certificate by passing `renewal_of_order_id`.
Previous order details can be retrieved with digicertapi.list_orders.
uD order_certificate needs a single dns_name, or an array of dns_names.u common_nameu dns_namesu signature_hashu digicertu shatypeu sha256u, Organization_units is not a valid data type.u organization_unitst ou_namei t shatypet key_lent passwordu csru server_platformu idu organizationu custom_expiration_dateu validity_yearsu commentsu disable_renewal_notificationsu type_hintu productu renewal_of_order_idu certificateu {0}/order/certificate/sslR# u POSTRY R$ R% u jsonR& u X-DC-DEVKEYu application/jsonu Content-TypeR+ u errorsu dictu digicert/domainsu minion_idu requestsu order_idu orderN( R4 R t string_typest collectionst SequenceR R R t gen_csrR R t jsont dumpsR R R R
R' R R RB RC RD RE RF R3 t updateRH t _id_map( RK RO t organization_idt validity_yearst cert_key_passphraset signature_hashR_ t dns_namest organization_unitst server_platformt custom_expiration_datet commentst disable_renewal_notificationst product_type_hintt renewal_of_order_idt certificatet bodyt csrt encoded_bodyt qdataRX RB RY ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt order_certificatev s�
"
c
@ s d } | d k rt rN t j | d � } | j d d d � f d � � } n$ t j d | � } | j d � � } | d k rd } t j j t
t j � } y* | j
| | � } | | d
<| | d <Wn% t k
r� i | d
6| d 6} n X| j | | | � qn | S(
u�
Generate and return a private_key. If a ``dns_name`` is passed in, the
private_key will be cached under that name.
CLI Example:
.. code-block:: bash
salt-run digicert.gen_key <minion_id> [dns_name] [password]
u RSAi t cipheru des_ede3_cbct callbackc @ s
t j � � S( N( R t b( t x( R` ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt <lambda>� s t bitsu PEMu digicert/domainsu private_keyu minion_idN( t HAS_M2R t gen_keyt as_pemt generatet exportKeyR3 R RB RC R RD RE RF RG RH (
RK t dns_nameR` R_ t keygen_typet gent private_keyRX RB RY ( ( R` s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyR� � s& $
c C@ sQ t j j j d j t � | � d d d t d d d i t � d 6d d
6�} | S( u�
Return the details for an organization
CLI Example:
.. code-block:: bash
salt-run digicert.get_org_details 34
Returns a dictionary with the org details, or with 'error' and 'status' keys.
u {0}/organization/{1}R# u GETR$ R% u jsonR& u X-DC-DEVKEYu application/jsonu Content-Type( R R R R R R
R' R ( Ri Ry ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt get_org_details s
u sha256c C@ sj t | � } d | k r7 t d j | | d � � � n | d j d d � d k rk t d j | � � � n t j � } t j | d � d } t j j
t t j
� }
|
j | | � } | d k r� i } n d
| k r� t | | | d | �| d
<n d j | � } d
j | � }
t j j j | d � �' } | j t j j j | d
� � Wd QXd j | d d | d d | d d | d d � } | r�| d j | � } n | d j | � } d j | | |
| � } t d d | � } d | k rt d � � n t j j j |
d � �" } t j j j | j � � } Wd QX| | d <| | d <|
j | | | � | S( uk
CLI Example:
.. code-block:: bash
salt-run digicert.gen_csr <minion_id> <dns_name>
u erroruB Problem getting organization details for organization_id={0} ({1})u dictu statusu activeu inactiveu8 Organization with organization_id={0} is marked inactivei� u digicert/domainsu private_keyR_ u {0}/privu {0}/csru wNu /C={0}/ST={1}/L={2}/O={3}u countryu stateu cityu display_nameu /OU={0}u /CN={0}u3 openssl req -new -{0} -key {1} -out {2} -subj '{3}'u salt.cmdu cmd.runu# problems making Certificate Requestuw There was a problem generating the CSR. Please ensure that you have a valid Organization established inside CertCentralu ru minion_idu csr( R� R R R R6 t mkdtempR8 t chmodR RB RC R RD RE RF R3 R� R t filest fopenR9 t stringutilst to_strt __salt__R t
to_unicodet readRH ( RK R� Ri R] R_ R^ R` t org_detailst tmpdirRX RB RY t tmpprivt tmpcsrt if_t subjectRT t outputt of_Rw ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyRd # sR & !
c C@ s{ d } t j j t t j � } | j | | � } t | t � sH g } n | | k rd | j | � n | j
| | | � d S( uA
Maintain a relationship between a minion and a dns name
u digicert/minionsN( R RB RC R RD RE RF R4 t listt appendRH ( RK R� RX RB Rm ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyRh p s c C@ s� t j j j d j t � | � d t d t d d d i t � d 6�} | d } t j | � j
d � s� t j | � j
d
� r� t d j | d � � � n | j d
i � S( u�
Show organization information, especially the company id
CLI Example:
.. code-block:: bash
salt-run digicert.show_company example.com
u {0}/companies/domain/{1}R, R$ R% u jsonR& u tppl-api-keyu statusu 4u 5u There was an API error: {0}u erroru dict(
R R R R R R
R' R R t text_typet
startswithR R ( t domainRY R, ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt show_organization~ s
0c C@ s� t j j j d j t � � d t d t d d d i t � d 6�} | d } t j | � j
d � s} t j | � j
d
� r� t d j | d � � � n | j d
i � S( u�
Show certificate requests for this API key
CLI Example:
.. code-block:: bash
salt-run digicert.show_csrs
u {0}/certificaterequestsR, R$ R% u jsonR& u tppl-api-keyu statusu 4u 5u There was an API error: {0}u erroru dict(
R R R R R R
R' R R R� R� R R ( RY R, ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt show_csrs� s
0c C@ s8 t j j t t j � } d } | j | | � } | d S( u�
Show a private RSA key
CLI Example:
.. code-block:: bash
salt-run digicert.show_rsa myminion domain.example.com
u digicert/domainsu private_key( R RB RC R RD RE RF ( RK R� RB RX RY ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt show_rsa� s
c C@ s% t j j t t j � } | j d � S( u�
List domains that have been cached
CLI Example:
.. code-block:: bash
salt-run digicert.list_domain_cache
u digicert/domains( R RB RC R RD RE R� ( RB ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt list_domain_cache� s
c C@ s� t j j t t j � } t | t j � r< | j d � } n t | t
� sZ t d � � n g } g } xP | D]H } y! | j d | � | j
| � Wqm t k
r� | j
| � qm Xqm Wi | d 6| d 6S( u�
Delete cached domains from the master
CLI Example:
.. code-block:: bash
salt-run digicert.del_cached_domain domain1.example.com,domain2.example.com
u ,uw You must pass in either a string containing one or more domains separated by commas, or a list of single domain stringsu digicert/domainsu Succeededu Failed( R RB RC R RD RE R4 R Ra t splitR� R t flushR� ( t domainsRB t successt failedR� ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt del_cached_domain� s
(9 t __doc__t
__future__R R R R8 t loggingR6 R; Rb R> t
salt.syspathsRD t
salt.cacheR t salt.utils.filest salt.utils.httpt salt.utils.jsont salt.extR t salt.ext.six.movesR t salt.exceptionsR R t M2CryptoR R' R� t ImportErrorR t Cryptodome.PublicKeyt Crypto.PublicKeyR
t getLoggert __name__t logR R
R R" R3 R* R. R/ RZ R\ Rz R� R� Rd Rh R� R� R� R� R� ( ( ( s< /usr/lib/python2.7/site-packages/salt/runners/digicertapi.pyt <module>% sf
� m" F
Mini Shell