An application to manage x509 PKI infrastructure, and sign Django models with PKCS7.
Python
Switch branches/tags
Nothing to show
Latest commit a47a145 Aug 30, 2011 @cyberj cyberj Some bugs on install
Permalink
Failed to load latest commit information.
signature Add check_passphrase method Aug 30, 2011
tests Add check_passphrase method Aug 30, 2011
.hgignore First commit Apr 28, 2010
LICENCE.txt First commit Apr 28, 2010
README.rst Add new todo Sep 7, 2010
setup.py Some bugs on install Aug 30, 2011

README.rst

django-signature

Application to generate x509 certificates and sign models with PKCS#7 standard

http://bitbucket.org/bearstech/django-signature/

Beta : not really for production use

Features :

  • PKI :
    • Generate (or load) RSA keys and store them in Django models
    • Generate x509 certificates and store them in Django models
    • Load x509 certificat and find relations with other Certificates and Keys
    • Generate (or load) x509 Requests and store them in Django models
    • Generate self-signed x509 for root CA
    • Verify certificate chain (with CRLs)
    • Sign Certificate Requests
  • Digital signature
    • Sign/verify text with PKCS#7 standard
    • Sign/verify simple modelswith PKCS#7 standard
    • Support FileField (with sha512 digest)
  • Good test coverage

Todo :

  • Sign complex models
  • Generate indexes with OpenSSL.generate_index()
  • Improve configuration
  • Cert load with renew
  • ... and much more

Examples :

There is an simple PKI example:

from signature.models import Key, Certificate, CertificateRequest
from datetime import datetime

ca_pwd = "R00tz"
c_pwd = "1234"

# CA and Client keys
ca_key = Key.generate(ca_pwd)
c_key = Key.generate(c_pwd)

# CA Cert
ca_cert = Certificate()
ca_cert.CN = "Admin"
ca_cert.C = "FR"
ca_cert.key = ca_key
ca_cert.days = 150
ca_cert.is_ca = True
ca_cert.generate_x509_root(ca_pwd)
ca_cert.save()

# Client's request
rqst = CertificateRequest()
rqst.CN = "World Company"
rqst.C = "FR"
rqst.key = c_key
rqst.sign_request(c_pwd)
rqst.save()

# Sign client's request and return certificate
# (you can give to Client's certificate CA capabilities with ca=True)
c_cert = ca_cert.sign_request(rqst, 150, ca_pwd, ca=False)

# Verify created certificate :
c_cert.check()

# Revoke certificate :
c_cert.revoke(c_cert, ca_pwd)

# Import a Key / Certificate:
imported = Key.new_from_pem(pem_str, passphrase="gigowatt", user=None)
imported = Certificate.new_from_pem(pem_str)

For more examples, see SignaturePKITestCase into tests/test_project/apps/testapp/tests.py

There is an simple signature example:

# Sign Text
text = "This is a data"
data_signed = c_cert.sign_text(text, c_pwd)
result = c_cert.verify_smime(data_signed)

# Sign Model (get text)
auth1 = Author(name="Raymond E. Feist", title="MR")
data_signed = c_cert.sign_model(auth1, c_pwd)
result = c_cert.verify_smime(data_signed)

# Sign Model (get Signature)
auth1 = Author(name="Raymond E. Feist", title="MR")
signed = c_cert.make_signature(auth1, self.c_pwd)
signed.check_pkcs7(signed)

For more examples, see SignatureTestCase into tests/test_project/apps/testapp/tests.py

Tests :

  • cd tests
  • python bootstrap.py
  • ./bin/buildout.py -v
  • ./bin/test-1.2 or ./bin/test-1.1

Requirements :