Skip to content

gh-118658: Modify cert generation script to extract cert3.pem #124598

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 4, 2024
Merged

gh-118658: Modify cert generation script to extract cert3.pem #124598

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2265e43
Modify cert generation script to extract cert3.pem.
felixfontein Sep 26, 2024
021af09
Use openssl CLI tool instead of text manipulation.
felixfontein Oct 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions Lib/test/certdata/make_ssl_certs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,23 @@ def write_cert_reference(path):
print(refdata, file=f)


def extract_cert(pem_cert, index):
result = []
active = False
for line in pem_cert.splitlines():
match = active
if line == '-----BEGIN CERTIFICATE-----':
if index == 0:
active = True
match = True
index -= 1
elif line == '-----END CERTIFICATE-----':
active = False
if match:
result.append(line)
return '\n'.join(result) + '\n'


if __name__ == '__main__':
parser = argparse.ArgumentParser(description='Make the custom certificate and private key files used by test_ssl and friends.')
parser.add_argument('--days', default=days_default)
Expand Down Expand Up @@ -266,6 +283,10 @@ def write_cert_reference(path):
f.write(key)
f.write(cert)

cert = extract_cert(cert, 0)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of text manipulation, could we ask openssl to extract it?
As far as I can see, the incantation is:

openssl x509 -outform pem -in keycert3.pem -out cert3.pem

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great idea! Implemented in 021af09.

with open('cert3.pem', 'w') as f:
f.write(cert)

cert, key = make_cert_key(cmdlineargs, 'fakehostname', sign=True)
with open('keycert4.pem', 'w') as f:
f.write(key)
Expand Down
Loading