pki.util.cert_profile ===================== .. py:module:: pki.util.cert_profile .. autoapi-nested-parse:: JSON Certificate Profile implementation. This module provides functionality to verify certificate requests against JSON-based profiles. Profiles define allowed fields, prohibited fields, and other constraints for certificate requests. They can also specify default values for fields and validate the request against these rules. Module Contents --------------- .. py:data:: logger .. py:exception:: ProfileValidationError Bases: :py:obj:`Exception` Raised when the request is well-formed but does not match the profile constraints. .. py:data:: ALIASES :type: dict[str, pydantic.AliasChoices] .. py:data:: CERT_PROFILE_KEYWORDS .. py:function:: build_alias_map_name_oids(alias_map, enum_cls) Build a mapping of all known OID strings from trustpoint_core to their canonical field names. .. py:data:: alias_map .. py:data:: alias_map .. py:class:: ProfileValuePropertyModel(/, **data) Bases: :py:obj:`pydantic.BaseModel` Model for a profile value property. .. py:attribute:: value :type: Any | None :value: None .. py:attribute:: default :type: Any | None :value: None .. py:attribute:: required :type: bool :value: False .. py:attribute:: mutable :type: bool :value: True .. py:class:: SubjectModel(/, **data) Bases: :py:obj:`pydantic.BaseModel` Model for the subject DN of a certificate profile. .. py:attribute:: common_name :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: surname :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: serial_number :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: country_name :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: locality_name :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: state_or_province_name :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: street_address :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: organization_name :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: organizational_unit_name :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: title :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: description :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: postal_code :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: email_address :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: name :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: given_name :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: initials :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: pseudonym :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: uid :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: domain_component :type: str | ProfileValuePropertyModel | None :value: None .. py:attribute:: model_config Configuration for the model, should be a dictionary conforming to [`ConfigDict`][pydantic.config.ConfigDict]. .. py:class:: BaseExtensionModel(/, **data) Bases: :py:obj:`pydantic.BaseModel` Base model for certificate extensions. .. py:attribute:: critical :type: bool | None :value: None .. py:attribute:: model_config Configuration for the model, should be a dictionary conforming to [`ConfigDict`][pydantic.config.ConfigDict]. .. py:class:: BasicConstraintsExtensionModel(/, **data) Bases: :py:obj:`BaseExtensionModel` Model for the Basic Constraints extension of a certificate profile. .. py:attribute:: ca :type: bool | None :value: None .. py:attribute:: path_length :type: int | None :value: None .. py:attribute:: model_config Configuration for the model, should be a dictionary conforming to [`ConfigDict`][pydantic.config.ConfigDict]. .. py:class:: SanExtensionModel(/, **data) Bases: :py:obj:`BaseExtensionModel`, :py:obj:`ProfileValuePropertyModel` Model for the SAN extension of a certificate profile. .. py:attribute:: dns_names :type: list[str] | ProfileValuePropertyModel | None :value: None .. py:attribute:: ip_addresses :type: list[str] | ProfileValuePropertyModel | None :value: None .. py:attribute:: rfc822_names :type: list[str] | ProfileValuePropertyModel | None :value: None .. py:attribute:: uris :type: list[str] | ProfileValuePropertyModel | None :value: None .. py:attribute:: other_names :type: list[str] | ProfileValuePropertyModel | None :value: None .. py:attribute:: model_config Configuration for the model, should be a dictionary conforming to [`ConfigDict`][pydantic.config.ConfigDict]. .. py:class:: CRLDistributionPointsExtensionModel(/, **data) Bases: :py:obj:`BaseExtensionModel`, :py:obj:`ProfileValuePropertyModel` Model for the CRL Distribution Points extension of a certificate profile. Note: Only URIs in full_name are supported. .. py:attribute:: uris :type: list[str] | ProfileValuePropertyModel | None :value: None .. py:attribute:: model_config Configuration for the model, should be a dictionary conforming to [`ConfigDict`][pydantic.config.ConfigDict]. .. py:class:: KeyUsageExtensionModel(/, **data) Bases: :py:obj:`BaseExtensionModel` Model for the Key Usage extension of a certificate profile. .. py:attribute:: digital_signature :type: bool | None :value: None .. py:attribute:: content_commitment :type: bool | None :value: None .. py:attribute:: key_encipherment :type: bool | None :value: None .. py:attribute:: data_encipherment :type: bool | None :value: None .. py:attribute:: key_agreement :type: bool | None :value: None .. py:attribute:: key_cert_sign :type: bool | None :value: None .. py:attribute:: crl_sign :type: bool | None :value: None .. py:attribute:: encipher_only :type: bool | None :value: None .. py:attribute:: decipher_only :type: bool | None :value: None .. py:attribute:: model_config Configuration for the model, should be a dictionary conforming to [`ConfigDict`][pydantic.config.ConfigDict]. .. py:class:: ExtendedKeyUsageExtensionModel(/, **data) Bases: :py:obj:`BaseExtensionModel` Model for the Extended Key Usage extension of a certificate profile. .. py:attribute:: usages :type: list[str] | ProfileValuePropertyModel | None :value: None .. py:attribute:: model_config Configuration for the model, should be a dictionary conforming to [`ConfigDict`][pydantic.config.ConfigDict]. .. py:class:: ExtensionsModel(/, **data) Bases: :py:obj:`pydantic.BaseModel` Model for the extensions of a certificate request. .. py:attribute:: basic_constraints :type: BasicConstraintsExtensionModel | None :value: None .. py:attribute:: key_usage :type: KeyUsageExtensionModel | None :value: None .. py:attribute:: extended_key_usage :type: ExtendedKeyUsageExtensionModel | None :value: None .. py:attribute:: subject_alternative_name :type: SanExtensionModel | None :value: None .. py:attribute:: crl_distribution_points :type: CRLDistributionPointsExtensionModel | None :value: None .. py:class:: ValidityModel(/, **data) Bases: :py:obj:`pydantic.BaseModel` Model for the validity period of a certificate profile. .. py:attribute:: not_before :type: pydantic.AwareDatetime | None :value: None .. py:attribute:: not_after :type: pydantic.AwareDatetime | None :value: None .. py:attribute:: days :type: float | None :value: None .. py:attribute:: hours :type: float | None :value: None .. py:attribute:: minutes :type: float | None :value: None .. py:attribute:: seconds :type: int | None :value: None .. py:attribute:: duration :type: datetime.timedelta | None :value: None .. py:attribute:: offset_s :type: int | None :value: None .. py:attribute:: validity_max :type: datetime.timedelta | None :value: None .. py:attribute:: validity_min :type: datetime.timedelta | None :value: None .. py:attribute:: model_config Configuration for the model, should be a dictionary conforming to [`ConfigDict`][pydantic.config.ConfigDict]. .. py:class:: CertProfileBaseModel(/, **data) Bases: :py:obj:`pydantic.BaseModel` Base model for each nesting level of certificate profiles. This allows for granular control over allowed fields and constraints at each level. .. py:attribute:: allow :type: list[str] | Literal['*'] | None :value: None .. py:attribute:: reject_mods :type: bool :value: None .. py:method:: normalize_allow(value) :classmethod: Normalize the allow list by replacing aliases with their canonical names. .. py:class:: ProfileSubjectModel(/, **data) Bases: :py:obj:`SubjectModel`, :py:obj:`CertProfileBaseModel` Model for the subject DN of a certificate profile, with profile constraints. .. py:class:: ProfileSanExtensionModel(/, **data) Bases: :py:obj:`SanExtensionModel`, :py:obj:`CertProfileBaseModel` Model for the SAN extension of a certificate profile, with profile constraints. .. py:class:: ProfileCrlDistributionPointsExtensionModel(/, **data) Bases: :py:obj:`CRLDistributionPointsExtensionModel`, :py:obj:`CertProfileBaseModel` Model for the CRL Distribution Points extension of a certificate profile, with profile constraints. .. py:class:: ProfileExtensionsModel(/, **data) Bases: :py:obj:`CertProfileBaseModel` Model for the extensions of a certificate profile, with profile constraints. .. py:attribute:: basic_constraints :type: BasicConstraintsExtensionModel | ProfileValuePropertyModel | None :value: None .. py:attribute:: key_usage :type: KeyUsageExtensionModel | ProfileValuePropertyModel | None :value: None .. py:attribute:: extended_key_usage :type: ExtendedKeyUsageExtensionModel | ProfileValuePropertyModel | None :value: None .. py:attribute:: subject_alternative_name :type: ProfileSanExtensionModel | ProfileValuePropertyModel | None :value: None .. py:attribute:: crl_distribution_points :type: ProfileCrlDistributionPointsExtensionModel | ProfileValuePropertyModel | None :value: None .. py:class:: CertProfileModel(/, **data) Bases: :py:obj:`CertProfileBaseModel` Model for a certificate profile. .. py:attribute:: type :type: Literal['cert_profile'] .. py:attribute:: display_name :type: str | None :value: None .. py:attribute:: subject :type: ProfileSubjectModel :value: None .. py:attribute:: extensions :type: ProfileExtensionsModel :value: None .. py:attribute:: validity :type: ValidityModel :value: None .. py:class:: CertRequestModel(/, **data) Bases: :py:obj:`pydantic.BaseModel` Model for a certificate request. .. py:attribute:: type :type: Literal['cert_request'] | None :value: 'cert_request' .. py:attribute:: subject :type: SubjectModel :value: None .. py:attribute:: extensions :type: ExtensionsModel :value: None .. py:attribute:: validity :type: ValidityModel :value: None .. py:attribute:: model_config Configuration for the model, should be a dictionary conforming to [`ConfigDict`][pydantic.config.ConfigDict]. .. py:class:: InheritedProfileConfig(*, allow_implicit = False, reject_mods = False, mutable = False) Constraints set in the profile that are inherited by deeper nesting levels. .. py:attribute:: allow_implicit :type: bool :value: False .. py:attribute:: reject_mods :type: bool :value: False .. py:attribute:: mutable :type: bool :value: False .. py:class:: JSONProfileVerifier(profile) Class to verify certificate requests against JSON-based profiles. .. py:attribute:: profile .. py:attribute:: profile_dict .. py:method:: validate_request(request) :staticmethod: Validates and normalizes a certificate request. This just checks its structure, it does not validate against a profile. .. py:method:: apply_profile_to_request(request) Apply the profile to a certificate request and return the modified request. .. py:method:: get_sample_request() Generate a sample certificate request that conforms to the profile. .. py:method:: get_profile() Get the profile as a dictionary.