* Regenerate certificate on CA's subject change. (#402)
(cherry picked from commit 3ebc132c03)
* Add fix for PyOpenSSL backend.
* x509_certificate: check existing certificate's signature for selfsigned and ownca provider (#407)
* Verify whether signature matches.
* Add changelog fragment.
* Forgot imports.
* Fix wrong name.
* Check whether the CA private key fits to the CA certificate. Use correct key in tests.
* Refactor code.
(cherry picked from commit 28729657ac)
* There doesn't seem a way to do this with pyOpenSSL.
* Allow multiple intermediate CAs to have same subject.
* Add tests.
* Fix test name.
* Don't use CN for SAN.
* Make a bit more compatible.
* Include jinja2 compat for CentOS 6.
(cherry picked from commit 11a14543c8)
Co-authored-by: Felix Fontein <felix@fontein.de>
* PyOpenSSL 22.0.0 no longer supports Python 2.7. (#387)
(cherry picked from commit 5abfe8fca9)
* Do not install PyOpenSSL from PyPi if cryptography cannot be updated - at least on FreeBSD 13.0, latest PyOpenSSL requires a cryptography upgrade, which breaks CI.
* Revert "Do not install PyOpenSSL from PyPi if cryptography cannot be updated - at least on FreeBSD 13.0, latest PyOpenSSL requires a cryptography upgrade, which breaks CI."
This reverts commit 16f9145653.
* Try another approach.
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update CI matrix for Remote Devel.
* Add Python info entries.
(cherry picked from commit cd5ed011a5)
Co-authored-by: Felix Fontein <felix@fontein.de>
* Avoid infinite loops, and double roots when root certificate was already part of chain.
* Refactor tests for readability.
(cherry picked from commit 6ee238d961)
Co-authored-by: Felix Fontein <felix@fontein.de>
* Use modules from internal_test_tools instead of stat workaround to check whether file actually changed.
* Properly add testing dependency.
(cherry picked from commit 471506c5d4)
Co-authored-by: Felix Fontein <felix@fontein.de>
* Name test tasks in a more explicite manner
* Space test + verification blocks apart
* Apply suggestions from code review
Co-authored-by: Jens Heinrich <github.com/JensHeinrich>
Co-authored-by: Felix Fontein <felix@fontein.de>
(cherry picked from commit 2c05221d89)
Co-authored-by: Jens Heinrich <59469646+JensHeinrich@users.noreply.github.com>
* Prepare for distutils.version being removed in Python 2.12.
* Fix copy'n'paste error.
* Re-add Loose prefix.
* Fix Python version typo.
* Improve formulation.
* Move message into own line.
* Fix casing, now that the object is no longer called Version.
(cherry picked from commit a539cd6939)
The first case about ca_csr has been copy/pasted.
But in the following cases, the CSR must be the certificate csr.
(cherry picked from commit 32dab841d7)
Co-authored-by: Bruno Vernay <brunovern.a@gmail.com>
* Extension parsing: add new fallback code which uses the new cryptography API (#331)
* Add new code as fallback which re-serializes de-serialized extensions using the new cryptography API.
* Forgot Base64 encoding.
* Add extension by OID tests.
* There's one value which is different with the new code.
* Differences in CI.
* Working around older Jinjas.
* Value depends on which SAN was included.
* Force complete CI run now since cryptography 36.0.0 is out.
ci_complete
(cherry picked from commit 3f40795a98)
* Adjust tests.
Co-authored-by: Felix Fontein <felix@fontein.de>
* Use new PKCS#12 deserialization code from cryptography 36.0.0 if available.
* Refactor into smaller functions.
* Force complete CI run now since cryptography 36.0.0 is out.
ci_complete
(cherry picked from commit 73bc0f5de7)
Co-authored-by: Felix Fontein <felix@fontein.de>
Felix Fontein
patchback[bot]
Andrew Pantuso