Merge NSSDatabase.create_request_with_wrapping_key() into create_requ…

…est()
dogtagpki · Sep 19, 2024 · 47414b8 · 47414b8
1 parent d07d0c7
commit 47414b8
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 26 deletions.
diff --git a/base/common/python/pki/nssdb.py b/base/common/python/pki/nssdb.py
@@ -949,6 +949,7 @@ def create_request(
             cka_id=None,
             key_type=None,
             key_size=None,
+            key_wrap=False,
             curve=None,
             hash_alg=None,
             basic_constraints_ext=None,
@@ -985,6 +986,14 @@ def create_request(
                 Raw extension data (``bytes``)
 
         """
+
+        if key_wrap:
+            self.__create_request_for_key_wrap(
+                subject_dn=subject_dn,
+                request_file=request_file,
+                key_size=key_size)
+            return
+
         if os.geteuid() == 0 and self.user:
             os.chown(os.path.dirname(request_file), self.uid, self.gid)
 
@@ -998,6 +1007,7 @@ def create_request(
                 cka_id=cka_id,
                 key_type=key_type,
                 key_size=key_size,
+                key_wrap=key_wrap,
                 curve=curve,
                 hash_alg=hash_alg,
                 basic_constraints_ext=basic_constraints_ext,
@@ -1187,7 +1197,7 @@ def create_request(
         finally:
             shutil.rmtree(tmpdir)
 
-    def create_request_with_wrapping_key(
+    def __create_request_for_key_wrap(
             self,
             subject_dn,
             request_file,
@@ -1473,6 +1483,7 @@ def __create_request(
             cka_id=None,
             key_type=None,
             key_size=None,
+            key_wrap=False,
             curve=None,
             hash_alg=None,
             basic_constraints_ext=None,
@@ -1569,6 +1580,9 @@ def __create_request(
             if key_size:
                 cmd.extend(['--key-size', str(key_size)])
 
+            if key_wrap:
+                cmd.append('--key-wrap')
+
             if curve:
                 cmd.extend(['--curve', curve])
 

diff --git a/base/server/python/pki/server/deployment/__init__.py b/base/server/python/pki/server/deployment/__init__.py
@@ -3112,7 +3112,6 @@ def generate_csr(self,
 
         cert_id = self.get_cert_id(subsystem, tag)
         logger.info('Generating %s CSR in %s', cert_id, csr_path)
-        csr_pathname = os.path.join(nssdb.tmpdir, os.path.basename(csr_path))
 
         subject_dn = self.mdict['pki_%s_subject_dn' % cert_id]
 
@@ -3136,32 +3135,29 @@ def generate_csr(self,
         if (subsystem.type == 'KRA' and
                 config.str2bool(self.mdict['pki_hsm_enable']) and
                 (cert_id in ['storage', 'transport'])):
-
-            logger.debug('generate_csr: calling PKCS10Client for %s', cert_id)
-
-            nssdb.create_request_with_wrapping_key(
-                subject_dn=subject_dn,
-                request_file=csr_path,
-                key_size=key_size)
+            key_wrap = True
+            csr_pathname = csr_path
 
         else:
-
-            logger.debug('generate_csr: calling certutil for %s', cert_id)
-
-            nssdb.create_request(
-                subject_dn=subject_dn,
-                request_file=csr_pathname,
-                key_type=key_type,
-                key_size=key_size,
-                curve=curve,
-                hash_alg=hash_alg,
-                basic_constraints_ext=basic_constraints_ext,
-                key_usage_ext=key_usage_ext,
-                extended_key_usage_ext=extended_key_usage_ext,
-                subject_key_id=subject_key_id,
-                generic_exts=generic_exts,
-                use_jss=True)
-
+            key_wrap = False
+            csr_pathname = os.path.join(nssdb.tmpdir, os.path.basename(csr_path))
+
+        nssdb.create_request(
+            subject_dn=subject_dn,
+            request_file=csr_pathname,
+            key_type=key_type,
+            key_size=key_size,
+            key_wrap=key_wrap,
+            curve=curve,
+            hash_alg=hash_alg,
+            basic_constraints_ext=basic_constraints_ext,
+            key_usage_ext=key_usage_ext,
+            extended_key_usage_ext=extended_key_usage_ext,
+            subject_key_id=subject_key_id,
+            generic_exts=generic_exts,
+            use_jss=True)
+
+        if not key_wrap:
             shutil.move(csr_pathname, csr_path)
 
         new_csr_path = subsystem.csr_file(tag)