fix: Remove pyOpenSSL dependency with custom certificate text formatting (#10439)

fixed: #10434

---------

Co-authored-by: ohemorange <ebportnoy@gmail.com>

certbot-ci/pyproject.toml

@@ -26,7 +26,6 @@ classifiers = [
 dependencies = [
     "coverage",
     "cryptography",
-    "pyopenssl",
     "pytest",
     "pytest-cov",
     # This version is needed for "worker" attributes we currently use like

certbot-ci/src/certbot_integration_tests/certbot_tests/test_main.py

@@ -13,7 +13,11 @@ from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurve
 from cryptography.hazmat.primitives.asymmetric.ec import SECP256R1
 from cryptography.hazmat.primitives.asymmetric.ec import SECP384R1
 from cryptography.hazmat.primitives.asymmetric.ec import SECP521R1
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography import x509
+from cryptography.x509 import ExtensionNotFound
 from cryptography.x509 import NameOID
+from cryptography.x509 import TLSFeatureType
 import pytest
 
 from certbot_integration_tests.certbot_tests.assertions import assert_cert_count_for_lineage
@@ -637,7 +641,10 @@ def test_ecdsa(context: IntegrationTestsContext) -> None:
     ])
 
     certificate = misc.read_certificate(cert_path)
-    assert 'ASN1 OID: secp384r1' in certificate
+    # Check that the certificate uses SECP384R1 curve
+    public_key = certificate.public_key()
+    assert isinstance(public_key, ec.EllipticCurvePublicKey)
+    assert isinstance(public_key.curve, ec.SECP384R1)
 
 
 def test_default_key_type(context: IntegrationTestsContext) -> None:
@@ -736,7 +743,12 @@ def test_ocsp_must_staple(context: IntegrationTestsContext) -> None:
 
     certificate = misc.read_certificate(join(context.config_dir,
                                              'live/{0}/cert.pem').format(certname))
-    assert 'status_request' in certificate or '1.3.6.1.5.5.7.1.24' in certificate
+
+    try:
+        tls_feature_ext = certificate.extensions.get_extension_for_class(x509.TLSFeature)
+        assert TLSFeatureType.status_request in list(tls_feature_ext.value)
+    except ExtensionNotFound:
+        assert False, "OCSP Must-Staple requires TLS Feature extension"
 
 
 def test_revoke_simple(context: IntegrationTestsContext) -> None:
@@ -1011,8 +1023,9 @@ def test_preferred_chain(context: IntegrationTestsContext) -> None:
                 '--preferred-chain', requested, '--force-renewal']
         context.certbot(args)
 
-        dumped = misc.read_certificate(cert_path)
+        certificate = misc.read_certificate(cert_path)
-        assert f'Issuer: CN={expected}'in dumped, \
+        issuer_cn = certificate.issuer.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value
+        assert expected == issuer_cn, \
                f'Expected chain issuer to be {expected} when preferring {requested}'
 
         with open(conf_path, 'r') as f:

certbot-ci/src/certbot_integration_tests/utils/misc.py

@@ -33,7 +33,7 @@ from cryptography.hazmat.primitives.serialization import NoEncryption
 from cryptography.hazmat.primitives.serialization import PrivateFormat
 from cryptography.x509 import Certificate
 from cryptography.x509 import load_pem_x509_certificate
-from OpenSSL import crypto
+
 import requests
 
 from certbot_integration_tests.utils.constants import PEBBLE_ALTERNATE_ROOTS
@@ -237,20 +237,16 @@ def generate_csr(
         file_h.write(csr.public_bytes(Encoding.DER))
 
 
-def read_certificate(cert_path: str) -> str:
+def read_certificate(cert_path: str) -> Certificate:
     """
-    Load the certificate from the provided path, and return a human readable version
+    Load the certificate from the provided path and return the certificate object.
-    of it (TEXT mode).
     :param str cert_path: the path to the certificate
-    :returns: the TEXT version of the certificate, as it would be displayed by openssl binary
+    :returns: a cryptography.x509.Certificate object
     """
     with open(cert_path, "rb") as file:
         data = file.read()
 
-    cert = x509.load_pem_x509_certificate(data)
+    return x509.load_pem_x509_certificate(data)
-    return crypto.dump_certificate(
-        crypto.FILETYPE_TEXT, crypto.X509.from_cryptography(cert)
-    ).decode("utf-8")
 
 
 def load_sample_data_path(workspace: str) -> str: