python crypto使用_使用Python（crypto）生成CSR

我有一个骨架——有用，但我有点困在下面我看不到加密库处理SAN(subjectAltName)的方法？希望我在术语上没有错，但是如果我说——一个主主机名test.test.edu，然后另一个选择是希望该主机也是pushu.edu，通常可以是“subjectAltName”。

有没有办法看到整个企业社会责任？比如，在哪里显示主题、状态等？我只想看到它打印到屏幕上，但我看不到一种方法来做这个加密。

任何帮助都将不胜感激；迄今为止的代码-#!/usr/bin/env python

from OpenSSL import crypto, SSL

import subprocess, os, sys

# Create 'usage' portion

# Something, blah blah, use script like this, blah blah.

# Variable

TYPE_RSA = crypto.TYPE_RSA

# Generate pkey

def generateKey(type, bits):

keyfile = 'incommon.key'

key = crypto.PKey()

key.generate_key(type, bits)

if os.path.exists(keyfile):

print "Certificate file exists, aborting."

print " ", keyfile

sys.exit(1)

else:

f = open(keyfile, "w")

f.write(crypto.dump_privatekey(crypto.FILETYPE_PEM, key))

f.close()

return key

# Generate CSR

def generateCSR(nodename):

csrfile = 'incommon.csr'

req = crypto.X509Req()

# Return an X509Name object representing the subject of the certificate.

req.get_subject().CN = nodename

#req.get_subject().countryName = 'xxx'

#req.get_subject().stateOrProvinceName = 'xxx'

#req.get_subject().localityName = 'xxx'

#req.get_subject().organizationName = 'xxx'

#req.get_subject().organizationalUnitName = 'xxx'

# Set the public key of the certificate to pkey.

req.set_pubkey(key)

# Sign the certificate, using the key pkey and the message digest algorithm identified by the string digest.

req.sign(key, "sha1")

# Dump the certificate request req into a buffer string encoded with the type type.

if os.path.exists(csrfile):

print "Certificate file exists, aborting."

print " ", csrfile

sys.exit(1)

else:

f = open('incommon.csr', "w")

f.write(crypto.dump_certificate_request(crypto.FILETYPE_PEM, req))

f.close()

#Call key & CSR functions

key = generateKey(TYPE_RSA,2048)

# Needs to take input from user.

generateCSR('test.test.edu')

编辑：

我不久前就把这个修好了。这是添加了扩展名的代码，或者您可以从我的Github中克隆它：https://github.com/cjcotton/python-csr# Generate Certificate Signing Request (CSR)

def generateCSR(nodename, sans = []):

C = raw_input('Enter your country: ')

ST = raw_input("Enter your state: ")

L = raw_input("Enter your location: ")

O = raw_input("Enter your organization: ")

OU = raw_input("Enter your organizational unit: ")

# Allows you to permanently set values required for CSR

# To use, comment raw_input and uncomment this section.

# C = 'US'

# ST = 'New York'

# L = 'Location'

# O = 'Organization'

# OU = 'Organizational Unit'

csrfile = 'host.csr'

keyfile = 'host.key'

TYPE_RSA = crypto.TYPE_RSA

# appends SAN to have 'DNS:'

ss = []

for i in sans:

ss.append("DNS: %s" % i)

ss = ", ".join(ss)

req = crypto.X509Req()

req.get_subject().CN = nodename

req.get_subject().countryName = C

req.get_subject().stateOrProvinceName = ST

req.get_subject().localityName = L

req.get_subject().organizationName = O

req.get_subject().organizationalUnitName = OU

# Add in extensions

base_constraints = ([

crypto.X509Extension("keyUsage", False, "Digital Signature, Non Repudiation, Key Encipherment"),

crypto.X509Extension("basicConstraints", False, "CA:FALSE"),

])

x509_extensions = base_constraints

# If there are SAN entries, append the base_constraints to include them.

if ss:

san_constraint = crypto.X509Extension("subjectAltName", False, ss)

x509_extensions.append(san_constraint)

req.add_extensions(x509_extensions)

# Utilizes generateKey function to kick off key generation.

key = generateKey(TYPE_RSA, 2048)

req.set_pubkey(key)

req.sign(key, "sha1")

generateFiles(csrfile, req)

generateFiles(keyfile, key)

return req