From 04110a73ed7ef810d1d3839b9ff6895937d6b51e Mon Sep 17 00:00:00 2001 From: TuxCoder Date: Sun, 10 May 2020 15:38:53 +0200 Subject: [PATCH] add ocsp to certs --- lenticular_cloud/pki.py | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) diff --git a/lenticular_cloud/pki.py b/lenticular_cloud/pki.py index 1acfc2b..3a44c07 100644 --- a/lenticular_cloud/pki.py +++ b/lenticular_cloud/pki.py @@ -123,7 +123,18 @@ class Pki(object): critical=False).\ add_extension( x509.SubjectKeyIdentifier.from_public_key(_public_key), + critical=False).\ + add_extension( + x509.AuthorityInformationAccess([ + x509.AccessDescription( + access_method=x509.AuthorityInformationAccessOID.CA_ISSUERS, + access_location=x509.UniformResourceIdentifier(f'https://www.{self._domain}')), + x509.AccessDescription( + access_method=x509.AuthorityInformationAccessOID.OCSP, + access_location=x509.UniformResourceIdentifier(f'http://ocsp.{self._domain}/{ca_name}/')) + ]), critical=False) + end_entity_cert = end_entity_cert_builder.\ sign( private_key=ca_private_key, @@ -203,23 +214,6 @@ class Pki(object): add_extension( x509.SubjectKeyIdentifier.from_public_key(ca_public_key), critical=False).\ - add_extension( - x509.CRLDistributionPoints([ - x509.DistributionPoint( - full_name=[x509.UniformResourceIdentifier(f'http://crl.{self._domain}/{ca_name}.crl')], - relative_name=None, crl_issuer=None, reasons=None) - ]), - critical=False).\ - add_extension( - x509.AuthorityInformationAccess([ - x509.AccessDescription( - access_method=x509.AuthorityInformationAccessOID.CA_ISSUERS, - access_location=x509.UniformResourceIdentifier(f'https://www.{self._domain}')), - x509.AccessDescription( - access_method=x509.AuthorityInformationAccessOID.OCSP, - access_location=x509.UniformResourceIdentifier(f'http://ocsp.{self._domain}')) - ]), - critical=True).\ sign( private_key=ca_private_key, algorithm=hashes.SHA256(),