pki.forms.issuing_cas ===================== .. py:module:: pki.forms.issuing_cas .. autoapi-nested-parse:: Django forms for issuing CA configuration and management. Module Contents --------------- .. py:function:: get_private_key_location_from_config() Determine the appropriate PrivateKeyLocation based on KeyStorageConfig. .. py:function:: get_ca_type_from_config() Determine the appropriate CA type based on KeyStorageConfig. .. py:class:: IssuingCaImportMixin Mixin for Issuing CA import forms providing common validation and creation logic. .. py:class:: IssuingCaAddMethodSelectForm(data=None, files=None, auto_id='id_%s', prefix=None, initial=None, error_class=ErrorList, label_suffix=None, empty_permitted=False, field_order=None, use_required_attribute=None, renderer=None, bound_field_class=None) Bases: :py:obj:`django.forms.Form` Form for selecting the method to add an Issuing Certificate Authority (CA). This form provides options to choose the method for adding a new Issuing CA. Users can select between importing from a file, generating a key pair and requesting an Issuing CA certificate, or configuring a remote Issuing CA. .. attribute:: method_select A dropdown to select the method for adding an Issuing CA. - `local_file_import`: Import a new Issuing CA from a file. - `local_request`: Generate a key-pair and request a certificate. - `remote_est`: Configure a remote Issuing CA. :type: ChoiceField .. py:attribute:: method_select .. py:class:: IssuingCaFileTypeSelectForm(data=None, files=None, auto_id='id_%s', prefix=None, initial=None, error_class=ErrorList, label_suffix=None, empty_permitted=False, field_order=None, use_required_attribute=None, renderer=None, bound_field_class=None) Bases: :py:obj:`django.forms.Form` Form for selecting the file type when importing an Issuing CA. This form allows users to choose the type of file to use for importing an Issuing Certificate Authority (CA). Supported formats include PKCS#12 and other common certificate formats such as PEM, PKCS#1, PKCS#7, and PKCS#8. .. attribute:: method_select A dropdown to select the file type for the Issuing CA. :type: ChoiceField .. py:attribute:: method_select .. py:class:: IssuingCaAddFileImportPkcs12Form(data=None, files=None, auto_id='id_%s', prefix=None, initial=None, error_class=ErrorList, label_suffix=None, empty_permitted=False, field_order=None, use_required_attribute=None, renderer=None, bound_field_class=None) Bases: :py:obj:`IssuingCaImportMixin`, :py:obj:`trustpoint.logger.LoggerMixin`, :py:obj:`django.forms.Form` Form for importing an Issuing CA using a PKCS#12 file. This form allows the user to upload a PKCS#12 file containing the private key and certificate chain, along with an optional password. It validates the uploaded file and its contents and ensures the unique name is not already used by another Issuing CA. .. attribute:: unique_name A unique name for the Issuing CA. :type: CharField .. attribute:: pkcs12_file The PKCS#12 file containing the private key and certificates. :type: FileField .. attribute:: pkcs12_password An optional password for the PKCS#12 file. :type: CharField .. py:attribute:: unique_name .. py:attribute:: pkcs12_file .. py:attribute:: pkcs12_password .. py:method:: clean() Cleans and validates the entire form. This method performs additional validation on the cleaned data to ensure all required fields are valid and consistent. It checks the uploaded PKCS#12 file and its password (if provided) and validates that the unique name does not conflict with existing entries. Any issues during validation raise appropriate errors. :raises ValidationError: If the data is invalid, such as when the unique name :raises is already taken or the PKCS#12 file cannot be read or parsed.: .. py:class:: IssuingCaAddFileImportSeparateFilesForm(data=None, files=None, auto_id='id_%s', prefix=None, initial=None, error_class=ErrorList, label_suffix=None, empty_permitted=False, field_order=None, use_required_attribute=None, renderer=None, bound_field_class=None) Bases: :py:obj:`IssuingCaImportMixin`, :py:obj:`trustpoint.logger.LoggerMixin`, :py:obj:`django.forms.Form` Form for importing an Issuing CA using separate files. This form allows the user to upload a private key file, its password (optional), an Issuing CA certificate file, and an optional certificate chain. The form validates the uploaded files, ensuring they are correctly formatted, within size limits, and not already associated with an existing Issuing CA. .. attribute:: unique_name A unique name for the Issuing CA. :type: CharField .. attribute:: private_key_file The private key file (.key, .pem). :type: FileField .. attribute:: private_key_file_password An optional password for the private key. :type: CharField .. attribute:: ca_certificate The Issuing CA certificate file (.cer, .der, .pem, .p7b, .p7c). :type: FileField .. attribute:: ca_certificate_chain An optional certificate chain file. :type: FileField .. py:attribute:: unique_name .. py:attribute:: ca_certificate .. py:attribute:: ca_certificate_chain .. py:attribute:: private_key_file .. py:attribute:: private_key_file_password .. py:method:: clean_private_key_file() Validates and parses the uploaded private key file. This method checks if the private key file is provided, ensures it meets size constraints, and validates its contents. If a password is provided, it is used to decrypt the private key. Raises validation errors for missing, oversized, or corrupted private key files. :returns: A serializer containing the parsed private key. :rtype: PrivateKeySerializer :raises ValidationError: If the private key file is missing, too large, or :raises corrupted, or if the password is invalid or incompatible.: .. py:method:: clean_ca_certificate() Validates and parses the uploaded Issuing CA certificate file. This method ensures the provided Issuing CA certificate file is valid and not already associated with an existing Issuing CA in the database. If the file is too large, corrupted, or already in use, a validation error is raised. :returns: A serializer containing the parsed certificate. :rtype: CertificateSerializer :raises ValidationError: If the file is missing, too large, corrupted, or already :raises associated with an existing Issuing CA.: .. py:method:: clean_ca_certificate_chain() Validates and parses the uploaded Issuing CA certificate chain file. This method checks if the optional certificate chain file is provided. If present, it validates and attempts to parse the file into a collection of certificates. Raises a validation error if parsing fails or the file appears corrupted. :returns: A serializer containing the parsed certificate chain if provided. :rtype: CertificateCollectionSerializer :raises ValidationError: If the certificate chain cannot be parsed. .. py:method:: clean() Cleans and validates the form data. This method performs additional validation on the provided data, such as ensuring the unique name, private key file, and certificates are valid. It also initializes and saves the issuing CA configuration if all checks pass. :raises ValidationError: If the form data is invalid or there is an error during processing. .. py:class:: IssuingCaAddRequestMixin Bases: :py:obj:`trustpoint.logger.LoggerMixin`, :py:obj:`django.forms.ModelForm`\ [\ :py:obj:`pki.models.CaModel`\ ] Mixin for forms requesting an Issuing CA certificate from remote servers. .. py:class:: Meta Meta class for IssuingCaAddRequestMixin. .. py:attribute:: model .. py:attribute:: fields :type: ClassVar[list[str]] :value: ['unique_name', 'remote_host', 'remote_port', 'remote_path', 'est_username', 'ca_type'] .. py:attribute:: key_type .. py:method:: clean() Validate the form data. .. py:method:: save(*, commit = True) Save the form and create the CA model with configuration. .. py:class:: IssuingCaAddRequestEstForm(*args, **kwargs) Bases: :py:obj:`IssuingCaAddRequestMixin` Form for requesting an Issuing CA certificate using EST. .. py:class:: Meta Meta class for IssuingCaAddRequestEstForm. .. py:attribute:: model .. py:attribute:: fields :type: ClassVar[list[str]] :value: ['unique_name', 'remote_host', 'remote_port', 'remote_path', 'est_username', 'est_password', 'ca_type'] .. py:attribute:: est_username .. py:attribute:: est_password .. py:method:: save(*, is_ra_mode = False) Save the form and create the CA model with configuration. If is_ra_mode is True, create a REMOTE_EST_RA (Registration Authority) instead of REMOTE_ISSUING_EST. .. py:class:: IssuingCaAddRequestCmpForm(*args, **kwargs) Bases: :py:obj:`IssuingCaAddRequestMixin` Generic form for configuring a remote CMP endpoint (CA or RA). This form is used for both requesting an Issuing CA certificate via CMP and for setting up a remote CMP RA (Registration Authority) configuration. Fields include remote host, port, path, and the shared secret for CMP authentication. The form can be extended or reused for both CA and RA scenarios. .. py:class:: Meta Meta class for IssuingCaAddRequestCmpForm. .. py:attribute:: model .. py:attribute:: fields :type: ClassVar[list[str]] :value: ['unique_name', 'remote_host', 'remote_port', 'remote_path', 'ca_type'] .. py:attribute:: cmp_shared_secret .. py:method:: save(*, is_ra_mode = False) Save the form and create the CA model with configuration. If is_ra_mode is True, create a REMOTE_CMP_RA (Registration Authority) instead of REMOTE_ISSUING_CMP. .. py:class:: IssuingCaTruststoreAssociationForm(*args, **kwargs) Bases: :py:obj:`django.forms.Form` Form for associating a truststore with an Issuing CA. .. py:attribute:: trust_store .. py:attribute:: instance :type: pki.models.CaModel .. py:method:: save() Save the truststore association to the CA's onboarding config. .. py:class:: IssuingCaCrlCycleForm Bases: :py:obj:`django.forms.ModelForm`\ [\ :py:obj:`pki.models.CaModel`\ ] Form for configuring CRL cycle settings for an Issuing CA. .. py:class:: Meta Meta class for IssuingCaCrlCycleForm. .. py:attribute:: model .. py:attribute:: fields :type: ClassVar[list[str]] :value: ['crl_cycle_enabled', 'crl_cycle_interval_hours', 'crl_validity_hours', 'auto_crl_on_revocation_enabled'] .. py:attribute:: crl_cycle_enabled .. py:attribute:: crl_cycle_interval_hours .. py:attribute:: crl_validity_hours .. py:attribute:: auto_crl_on_revocation_enabled .. py:method:: clean_crl_cycle_interval_hours() Validate the CRL cycle interval. .. py:method:: clean_crl_validity_hours() Validate the CRL validity against the active security policy maximum. .. py:method:: save(*, commit = True) Save the form and schedule the next CRL generation if enabled.