demo/secure_element/resources/generation_scripts/create_root_ca.py

1 
2 from __future__ import print_function
3 
4 from secure_element_common import *
5 import os
6 import traceback
7 import datetime
8 import optparse
9 
10 
11 
12 ''' ******************************************************************************************* '''
13 def create_root_ca():
14  # Delete all old credentials first
15  print('\nDeleting old credentials')
16  for name in os.listdir(CREDENTIAL_BASE_PATH):
17  if name.startswith('.'):
18  continue
19 
20  os.remove(CREDENTIAL_PATH(name))
21 
22 
23  # Create or load a root CA key pair
24  print('\nLoading root CA key')
25  root_ca_priv_key = load_or_create_key(ROOT_CA_KEY_FILENAME)
26 
27  # Create root CA certificate
28  print('\nGenerating self-signed root CA certificate')
29  builder = x509.CertificateBuilder()
30  builder = builder.serial_number(random_cert_sn(16))
31  # Please note that the name of the root CA is also part of the signer certificate.
32  # If this changes then you must re-generate the signer certificate and device certificate.
33  builder = builder.issuer_name(x509.Name([
34  x509.NameAttribute(x509.oid.NameOID.ORGANIZATION_NAME, u'Example Inc'),
35  x509.NameAttribute(x509.oid.NameOID.COMMON_NAME, u'Example Root CA')]))
36  builder = builder.not_valid_before(datetime.datetime.now(tz=pytz.utc))
37  builder = builder.not_valid_after(builder._not_valid_before.replace(year=builder._not_valid_before.year + 25))
38  builder = builder.subject_name(builder._issuer_name)
39  builder = builder.public_key(root_ca_priv_key.public_key())
40  builder = builder.add_extension(
41  x509.SubjectKeyIdentifier.from_public_key(root_ca_priv_key.public_key()),
42  critical=False)
43  builder = builder.add_extension(
44  x509.BasicConstraints(ca=True, path_length=None),
45  critical=True)
46  # Self-sign certificate
47  root_ca_cert = builder.sign(
48  private_key=root_ca_priv_key,
49  algorithm=hashes.SHA256(),
50  backend=crypto_be)
51 
52  # Write root CA certificate to file
53  with open(CREDENTIAL_PATH(ROOT_CA_CERT_FILENAME), 'wb') as f:
54  print(' Saving to ' + f.name)
55  f.write(root_ca_cert.public_bytes(encoding=serialization.Encoding.PEM))
56 
57  print('\nDone')
58 
59 
60 
61 
62 
63 ''' ******************************************************************************************* '''
64 if __name__ == '__main__':
65  parser = optparse.OptionParser(description='Generates a self-signed CA certificate')
66  parser.parse_args()
67 
68  try:
69  create_root_ca()
70  except Exception as e:
71  traceback.print_exc()
72  print(e)
73