pki.models.credential

Module that contains the CredentialModel.

Exceptions

CredentialAlreadyExistsError

The CredentialAlreadyExistsError is raised if a credential already exists in the database.

Classes

CredentialModel

The CredentialModel that holds all local credentials used by the Trustpoint.

CertificateChainOrderModel

This Model is used to preserve the order of certificates in credential certificate chains.

IDevIDReferenceModel

Model to store the string referencing an IDevID certificate.

OwnerCredentialModel

Device owner credential model.

Module Contents

exception pki.models.credential.CredentialAlreadyExistsError(*args, **kwargs)[source]

Bases: django.core.exceptions.ValidationError

The CredentialAlreadyExistsError is raised if a credential already exists in the database.

Parameters:

  • args (Any)

  • kwargs (Any)

class pki.models.credential.CredentialModel(*args, **kwargs)[source]

Bases: trustpoint.logger.LoggerMixin, util.db.CustomDeleteActionModel

The CredentialModel that holds all local credentials used by the Trustpoint.

This model holds both local unprotected credentials, for which the keys and certificates are stored in the DB, but also credentials that are stored within an HSM or TPM utilizing PKCS#11.

PKCS#11 credentials are not yet supported.

class CredentialTypeChoice(*args, **kwds)[source]

Bases: django.db.models.IntegerChoices

The CredentialTypeChoice defines the type of the credential and thus implicitly restricts its usage.

It is intended to limit the credential usage to specific cases, e.g. usage as Issuing CA. The abstractions using the CredentialModel are responsible to check that the credential has the correct and expected CredentialTypeChoice.

TRUSTPOINT_TLS_SERVER[source]
ROOT_CA[source]
ISSUING_CA[source]
ISSUED_CREDENTIAL[source]
DEV_OWNER_ID[source]
credential_type[source]
private_key[source]
certificate[source]
certificates[source]
certificate_chain[source]
created_at[source]
__repr__()[source]

Returns a string representation of this CredentialModel entry.

Return type:

str

__str__()[source]

Returns a human-readable string that represents this CredentialModel entry.

Returns:

Human-readable string that represents this CredentialModel entry.

Return type:

str

clean()[source]

Validates the CredentialModel instance.

Return type:

None

classmethod save_credential_serializer(credential_serializer, credential_type)[source]

This method will try to normalize the credential_serializer and then save it to the database.

Parameters:

  • credential_serializer (trustpoint_core.serializer.CredentialSerializer) – The credential serializer to store in the database.

  • credential_type (CredentialModel) – The credential type to set.

Returns:

The stored credential model.

Return type:

CredentialModel

property ordered_certificate_chain_queryset: django.db.models.QuerySet[CertificateChainOrderModel][source]

Gets the ordered certificate chain queryset.

Return type:

django.db.models.QuerySet[CertificateChainOrderModel]

classmethod _save_normalized_credential_serializer(normalized_credential_serializer, credential_type)[source]

This method will store a credential that is expected to be normalized..

Parameters:

  • normalized_credential_serializer (trustpoint_core.serializer.CredentialSerializer) – The normalized credential serializer to store in the database.

  • credential_type (CredentialModel) – The credential type to set.

Returns:

The stored credential model.

Return type:

CredentialModel

classmethod save_keyless_credential(certificate, certificate_chain, credential_type)[source]

Stores a credential without a private key.

Parameters:

  • certificate (cryptography.x509.Certificate)

  • certificate_chain (list[cryptography.x509.Certificate])

  • credential_type (CredentialModel)

Return type:

CredentialModel

update_keyless_credential(certificate, certificate_chain)[source]

Updates the primary certificate and certificate chain of the credential.

Previous certificates are kept as part of the credential.

Parameters:

  • certificate (cryptography.x509.Certificate)

  • certificate_chain (list[cryptography.x509.Certificate])

Return type:

None

pre_delete()[source]

Deletes related models, only allow deletion if there are no more active certificates.

Return type:

None

get_private_key()[source]

Gets an abstraction of the credential private key.

Note, in the case of keys stored in an HSM or TPM using PKCS#11, it will only be possible to use the key abstraction to sign and verify, but not to export the key in any way.

Returns:

The credential private key abstraction.

Return type:

PrivateKey

get_private_key_serializer()[source]

Gets a serializer of the credential private key.

Returns:

The credential private key abstraction.

Return type:

PrivateKey

get_certificate()[source]

Gets the credential certificate as x509.Certificate instance.

Returns:

The credential certificate.

Return type:

x509.Certificate

get_certificate_chain()[source]

Gets the credential certificate chain as a list of x509.Certificate instances.

Returns:

The credential certificate chain as list of x509.Certificate instances.

Return type:

list[x509.Certificate]

get_certificate_serializer()[source]

Gets the credential certificate as a CertificateSerializer instance.

Returns:

The credential certificate.

Return type:

CertificateSerializer

get_certificate_chain_serializer()[source]

Gets the credential certificate chain as a CertificateCollectionSerializer instance.

Returns:

The credential certificate chain.

Return type:

CertificateCollectionSerializer

get_last_in_chain()[source]

Gets the root ca certificate model, if any.

Return type:

None | pki.models.CertificateModel

get_root_ca_certificate()[source]

Gets the root CA certificate of the credential certificate chain.

Return type:

None | cryptography.x509.Certificate

get_root_ca_certificate_serializer()[source]

Gets the root CA certificate serializer.

Return type:

None | trustpoint_core.serializer.CertificateSerializer

get_credential_serializer()[source]

Gets the serializer for this credential.

Return type:

trustpoint_core.serializer.CredentialSerializer

property signature_suite: trustpoint_core.oid.SignatureSuite[source]

Returns the signature suite used by the current credential primary certificate.

Return type:

trustpoint_core.oid.SignatureSuite

property public_key_info: trustpoint_core.oid.PublicKeyInfo[source]

Returns the PublicKeyInfo the current credential primary certificate.

Return type:

trustpoint_core.oid.PublicKeyInfo

property hash_algorithm: cryptography.hazmat.primitives.hashes.HashAlgorithm | None[source]

Returns the hash algorithm used by the current credential.

Return type:

cryptography.hazmat.primitives.hashes.HashAlgorithm | None

is_valid_issued_credential()[source]

Determines if this issued credential is valid.

This method performs the following checks:

  1. The credential must be of type ISSUED_CREDENTIAL.

  2. A primary certificate must exist.

  3. The certificate’s status must be ‘OK’.

Returns:

A tuple where:

  • The first value is True if the credential meets all criteria, False otherwise.

  • The second value is a reason string explaining why the credential is invalid.

Return type:

tuple[bool, str]

class pki.models.credential.CertificateChainOrderModel(*args, **kwargs)[source]

Bases: django.db.models.Model

This Model is used to preserve the order of certificates in credential certificate chains.

certificate[source]
credential[source]
order[source]
primary_certificate[source]
class Meta[source]

This Meta class add some configuration to the CertificateChainOrderModel.

Sets the default ordering such that the field order is used. Restricts entries such that the tuple (credential, order) is unique.

ordering: ClassVar = ['order'][source]
constraints: ClassVar[source]
__repr__()[source]

Returns a string representation of this CertificateChainOrderModel entry.

Return type:

str

__str__()[source]

Returns a human-readable string that represents this CertificateChainOrderModel entry.

Returns:

Human-readable string that represents this CertificateChainOrderModel entry.

Return type:

str

save(*args, **kwargs)[source]

Stores a CertificateChainOrderModel in the database.

This is only possible if the order takes the next available value. That is, e.g. if the corresponding credential certificate chain has already two certificates stored with order 0 and 1, then the next entry to be stored must have order 2.

Parameters:

  • *args (Any) – Positional arguments, passed to super().save()

  • **kwargs (Any) – Keyword arguments, passed to super().save()

Returns:

None

Raises:

ValueError – If the CertificateChainOrderModel entry to be stored does not have the correct order.

Return type:

None

delete(*args, **kwargs)[source]

Tries to delete the CertificateChainOrderModel entry.

A CertificateChainOrderModel entry can only be deleted if it has the highest order in the corresponding credential certificate chain.

Parameters:

  • *args (Any) – Positional arguments, passed to super().delete()

  • **kwargs (Any) – Keyword arguments, passed to super().delete()

Returns:

tuple[int, dict[str, int]] (returned by parent)

Raises:

ValueError – If the CertificateChainOrderModel entry does not have the highest order in the corresponding credential certificate chain.

Return type:

tuple[int, dict[str, int]]

_get_max_order()[source]

Gets highest order of a certificate of a credential certificate chain.

Returns:

The highest order of a certificate of a credential certificate chain.

Return type:

int

class pki.models.credential.IDevIDReferenceModel(*args, **kwargs)[source]

Bases: django.db.models.Model

Model to store the string referencing an IDevID certificate.

Obtained from the SAN of the DevOwnerID certificate.

dev_owner_id[source]
idevid_ref[source]
__str__()[source]

Returns a human-readable string that represents this IDevIDRefSanModel entry.

Return type:

str

property idevid_subject_serial_number: str[source]

Returns the IDevID Subject Serial Number from the SAN of the DevOwnerID certificate.

Return type:

str

property idevid_x509_serial_number: str[source]

Returns the IDevID X.509 Serial Number from the SAN of the DevOwnerID certificate.

Return type:

str

property idevid_sha256_fingerprint: str[source]

Returns the IDevID SHA256 Fingerprint from the SAN of the DevOwnerID certificate.

Return type:

str

class pki.models.credential.OwnerCredentialModel(*args, **kwargs)[source]

Bases: trustpoint.logger.LoggerMixin, util.db.CustomDeleteActionModel

Device owner credential model.

This model is a wrapper to store a DevOwnerID Credential for use by devices to trust the Trustpoint.

unique_name[source]
credential: CredentialModel[source]
created_at[source]
__str__()[source]

Returns a human-readable string that represents this OwnerCredentialModel entry.

Returns:

Human-readable string that represents this OwnerCredentialModel entry.

Return type:

str

__repr__()[source]

Returns a string representation of the OwnerCredentialModel instance.

Return type:

str

classmethod create_new_owner_credential(unique_name, credential_serializer)[source]

Creates a new owner credential model and returns it.

Parameters:

  • unique_name (str) – The unique name that will be used to identify the Owner Credential.

  • credential_serializer (trustpoint_core.serializer.CredentialSerializer) – The credential as CredentialSerializer instance.

Returns:

The newly created owner credential model.

Return type:

OwnerCredentialModel

post_delete()[source]

Deletes the credential of this owner credential after deleting it.

Return type:

None