From 06ea141ca98ff33d1e900f69130868d394c5df02 Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Wed, 18 Dec 2024 18:10:20 -0500 Subject: [PATCH] Convert `make_key` to use cryptography's APIs (#10091) --- certbot/certbot/crypto_util.py | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/certbot/certbot/crypto_util.py b/certbot/certbot/crypto_util.py index 7cd384592..90fc9b600 100644 --- a/certbot/certbot/crypto_util.py +++ b/certbot/certbot/crypto_util.py @@ -23,6 +23,7 @@ from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import hashes from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric import ec +from cryptography.hazmat.primitives.asymmetric import rsa from cryptography.hazmat.primitives.asymmetric.dsa import DSAPublicKey from cryptography.hazmat.primitives.asymmetric.ec import ECDSA from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey @@ -221,12 +222,12 @@ def make_key(bits: int = 2048, key_type: str = "rsa", or of type ec_curve when key_type ecdsa is used. :rtype: str """ + key: Union[rsa.RSAPrivateKey, ec.EllipticCurvePrivateKey] if key_type == 'rsa': if bits < 2048: raise errors.Error("Unsupported RSA key length: {}".format(bits)) - key = crypto.PKey() - key.generate_key(crypto.TYPE_RSA, bits) + key = rsa.generate_private_key(public_exponent=65537, key_size=bits) elif key_type == 'ecdsa': if not elliptic_curve: raise errors.Error("When key_type == ecdsa, elliptic_curve must be set.") @@ -236,7 +237,7 @@ def make_key(bits: int = 2048, key_type: str = "rsa", curve = getattr(ec, elliptic_curve.upper()) if not curve: raise errors.Error(f"Invalid curve type: {elliptic_curve}") - _key = ec.generate_private_key( + key = ec.generate_private_key( curve=curve(), backend=default_backend() ) @@ -246,15 +247,13 @@ def make_key(bits: int = 2048, key_type: str = "rsa", raise errors.Error("Unsupported elliptic curve: {}".format(elliptic_curve)) except UnsupportedAlgorithm as e: raise e from errors.Error(str(e)) - _key_pem = _key.private_bytes( - encoding=Encoding.PEM, - format=PrivateFormat.TraditionalOpenSSL, - encryption_algorithm=NoEncryption() - ) - key = crypto.load_privatekey(crypto.FILETYPE_PEM, _key_pem) else: raise errors.Error("Invalid key_type specified: {}. Use [rsa|ecdsa]".format(key_type)) - return crypto.dump_privatekey(crypto.FILETYPE_PEM, key) + return key.private_bytes( + encoding=Encoding.PEM, + format=PrivateFormat.TraditionalOpenSSL, + encryption_algorithm=NoEncryption() + ) def valid_privkey(privkey: Union[str, bytes]) -> bool: