From 1afae838bb752dfc61e2821b8fead32c77c60587 Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Thu, 19 Dec 2024 10:11:47 -0500 Subject: [PATCH] Convert `validate_key_csr` to use cryptography's APIs (#10099) --- certbot/certbot/_internal/client.py | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/certbot/certbot/_internal/client.py b/certbot/certbot/_internal/client.py index e2da44cca..9bd4c682c 100644 --- a/certbot/certbot/_internal/client.py +++ b/certbot/certbot/_internal/client.py @@ -11,14 +11,15 @@ from typing import List from typing import Optional from typing import Tuple +from cryptography import x509 from cryptography.hazmat.backends import default_backend +from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric.rsa import generate_private_key import josepy as jose from josepy import ES256 from josepy import ES384 from josepy import ES512 from josepy import RS256 -import OpenSSL from acme import client as acme_client from acme import crypto_util as acme_crypto_util @@ -804,12 +805,9 @@ def validate_key_csr(privkey: util.Key, csr: Optional[util.CSR] = None) -> None: if csr: if csr.form == "der": - csr_obj = OpenSSL.crypto.load_certificate_request( - OpenSSL.crypto.FILETYPE_ASN1, csr.data) - cert_buffer = OpenSSL.crypto.dump_certificate_request( - OpenSSL.crypto.FILETYPE_PEM, csr_obj - ) - csr = util.CSR(csr.file, cert_buffer, "pem") + csr_obj = x509.load_der_x509_csr(csr.data) + csr_pem = csr_obj.public_bytes(serialization.Encoding.PEM) + csr = util.CSR(csr.file, csr_pem, "pem") # If CSR is provided, it must be readable and valid. if csr.data and not crypto_util.valid_csr(csr.data):