Convert crypto_util_test.py to use cryptography's APIs (#10100)

certbot/certbot/_internal/tests/crypto_util_test.py

@@ -1,4 +1,5 @@
 """Tests for certbot.crypto_util."""
+import binascii
 import logging
 import re
 import sys
@@ -7,6 +8,10 @@ from unittest import mock
 
 import OpenSSL
 import pytest
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import ec
 
 from certbot import errors
 from certbot import util
@@ -168,18 +173,19 @@ class MakeKeyTest(unittest.TestCase):
         from certbot.crypto_util import make_key
 
         # Do not test larger keys as it takes too long.
-        OpenSSL.crypto.load_privatekey(OpenSSL.crypto.FILETYPE_PEM, make_key(2048))
+        serialization.load_pem_private_key(make_key(2048), password=None)
 
     def test_ec(self):  # pylint: disable=no-self-use
         # ECDSA Key Type Tests
         from certbot.crypto_util import make_key
 
         for (name, bits) in [('secp256r1', 256), ('secp384r1', 384), ('secp521r1', 521)]:
-            pkey = OpenSSL.crypto.load_privatekey(
-                OpenSSL.crypto.FILETYPE_PEM,
-                make_key(elliptic_curve=name, key_type='ecdsa')
+            pkey = serialization.load_pem_private_key(
+                make_key(elliptic_curve=name, key_type='ecdsa'),
+                password=None
             )
-            assert pkey.bits() == bits
+            assert isinstance(pkey, ec.EllipticCurvePrivateKey)
+            assert pkey.curve.key_size == bits
 
     def test_bad_key_sizes(self):
         from certbot.crypto_util import make_key
@@ -199,8 +205,7 @@ class MakeKeyTest(unittest.TestCase):
         # Try a bad --key-type
         with pytest.raises(errors.Error,
                            match=re.escape('Invalid key_type specified: unf.  Use [rsa|ecdsa]')):
-            OpenSSL.crypto.load_privatekey(
-                OpenSSL.crypto.FILETYPE_PEM, make_key(2048, key_type='unf'))
+            make_key(2048, key_type='unf')
 
 
 class VerifyCertSetup(unittest.TestCase):
@@ -393,8 +398,10 @@ class CertLoaderTest(unittest.TestCase):
         from certbot.crypto_util import pyopenssl_load_certificate
 
         cert, file_type = pyopenssl_load_certificate(CERT)
-        assert cert.digest('sha256') == \
-                         OpenSSL.crypto.load_certificate(file_type, CERT).digest('sha256')
+        assert file_type == OpenSSL.crypto.FILETYPE_PEM
+        assert binascii.unhexlify(
+            cert.digest("sha256").replace(b":", b"")
+        ) == x509.load_pem_x509_certificate(CERT).fingerprint(hashes.SHA256())
 
     def test_load_invalid_cert(self):
         from certbot.crypto_util import pyopenssl_load_certificate