pki.models.credential¶

Module that contains the CredentialModel.

Module Contents¶

exception pki.models.credential.CredentialAlreadyExistsError(*args, **kwargs)[source]¶

Bases: django.core.exceptions.ValidationError

The CredentialAlreadyExistsError is raised if a credential already exists in the database.

Parameters:

args (Any)
kwargs (Any)

class pki.models.credential.PKCS11Key(*args, **kwargs)[source]¶

Bases: django.db.models.Model

Model representing a private key stored in a PKCS#11 HSM/token.

class KeyType(*args, **kwds)[source]¶

Bases: django.db.models.TextChoices

Supported key types in PKCS#11.

RSA[source]¶

EC[source]¶

AES[source]¶

token_label[source]¶

key_label[source]¶

key_type[source]¶

created_at[source]¶

class Meta[source]¶

Meta class to define unique constraints and verbose names for the PKCS11Key model.

unique_together: ClassVar = [['token_label', 'key_label']][source]¶

verbose_name[source]¶

verbose_name_plural[source]¶

get_pkcs11_key_instance(lib_path, user_pin)[source]¶

Get the appropriate PKCS#11 key instance.

Parameters:

lib_path (str)
user_pin (str)

Return type:

management.pkcs11_util.Pkcs11RSAPrivateKey | management.pkcs11_util.Pkcs11ECPrivateKey | management.pkcs11_util.Pkcs11AESKey

class pki.models.credential.CredentialModel(*args, **kwargs)[source]¶

Bases: trustpoint.logger.LoggerMixin, util.db.CustomDeleteActionModel

The CredentialModel that holds all local credentials used by the Trustpoint.

This model holds both local unprotected credentials, for which the keys and certificates are stored in the DB, but also credentials that are stored within an HSM or TPM utilizing PKCS#11.

PKCS#11 credentials are not yet supported.

class CredentialTypeChoice(*args, **kwds)[source]¶

Bases: django.db.models.IntegerChoices

The CredentialTypeChoice defines the type of the credential and thus implicitly restricts its usage.

It is intended to limit the credential usage to specific cases, e.g. usage as Issuing CA. The abstractions using the CredentialModel are responsible to check that the credential has the correct and expected CredentialTypeChoice.

TRUSTPOINT_TLS_SERVER[source]¶

ROOT_CA[source]¶

ISSUING_CA[source]¶

ISSUED_CREDENTIAL[source]¶

DEV_OWNER_ID[source]¶

SIGNER[source]¶

credential_type[source]¶

private_key[source]¶

pkcs11_private_key[source]¶

certificate[source]¶

certificates[source]¶

certificate_chain: django.db.models.ManyToManyField[pki.models.CertificateModel, CertificateChainOrderModel][source]¶

created_at[source]¶

clean()[source]¶

Validates the CredentialModel instance.

Return type:: None

property certificate_or_error: pki.models.CertificateModel[source]¶

Returns the certificate, raising an error if it is None.

Returns:: The non-null certificate.
Return type:: CertificateModel
Raises:: ValueError – If certificate is None.

classmethod save_credential_serializer(credential_serializer, credential_type)[source]¶

This method will try to normalize the credential_serializer and then save it to the database.

Parameters:

credential_serializer (trustpoint_core.serializer.CredentialSerializer) – The credential serializer to store in the database.
credential_type (CredentialModel) – The credential type to set.

Returns:

The stored credential model.

Return type:

CredentialModel

property ordered_certificate_chain_queryset: django.db.models.QuerySet[CertificateChainOrderModel][source]¶

Gets the ordered certificate chain queryset.

Return type:: django.db.models.QuerySet[CertificateChainOrderModel]

classmethod save_keyless_credential(certificate, certificate_chain, credential_type)[source]¶

Stores a credential without a private key.

Parameters:

certificate (cryptography.x509.Certificate)
certificate_chain (list[cryptography.x509.Certificate])
credential_type (CredentialModel)

Return type:

CredentialModel

update_keyless_credential(certificate, certificate_chain)[source]¶

Updates the primary certificate and certificate chain of the credential.

Previous certificates are kept as part of the credential.

Parameters:

certificate (cryptography.x509.Certificate)
certificate_chain (list[cryptography.x509.Certificate])

Return type:

None

pre_delete()[source]¶

Deletes related models, only allow deletion if there are no more active certificates.

Return type:: None

get_private_key()[source]¶

Gets an abstraction of the credential private key.

Note, in the case of keys stored in an HSM or TPM using PKCS#11, it will only be possible to use the key abstraction to sign and verify, but not to export the key in any way.

Returns:: The credential private key abstraction.
Return type:: PrivateKey

get_pkcs11_private_key()[source]¶

Gets the private key abstraction.

Return type:: trustpoint_core.crypto_types.PrivateKey

get_private_key_serializer()[source]¶

Gets a serializer of the credential private key.

For PKCS#11 keys, since the private key cannot be exported, this method returns a PrivateKeySerializer constructed from the public key extracted from the certificate. This allows code that needs the public key (via .public_key_serializer) to work with both software-stored and HSM-stored credentials.

Returns:: The credential private key serializer.
Return type:: PrivateKeySerializer
Raises:: RuntimeError – If no private key information is available.

get_certificate()[source]¶

Gets the credential certificate as x509.Certificate instance.

Returns:: The credential certificate.
Return type:: x509.Certificate

get_certificate_chain()[source]¶

Gets the credential certificate chain as a list of x509.Certificate instances.

Returns:: The credential certificate chain as list of x509.Certificate instances.
Return type:: list[x509.Certificate]

get_certificate_serializer()[source]¶

Gets the credential certificate as a CertificateSerializer instance.

Returns:: The credential certificate.
Return type:: CertificateSerializer
Raises:: ValueError – If the certificate is not set.

get_certificate_chain_serializer()[source]¶

Gets the credential certificate chain as a CertificateCollectionSerializer instance.

Returns:: The credential certificate chain.
Return type:: CertificateCollectionSerializer

get_last_in_chain()[source]¶

Gets the root ca certificate model, if any.

Return type:: None | pki.models.CertificateModel

get_root_ca_certificate()[source]¶

Gets the root CA certificate of the credential certificate chain.

Return type:: None | cryptography.x509.Certificate

get_root_ca_certificate_serializer()[source]¶

Gets the root CA certificate serializer.

Return type:: None | trustpoint_core.serializer.CertificateSerializer

get_credential_serializer()[source]¶

Gets the serializer for this credential.

Return type:: trustpoint_core.serializer.CredentialSerializer

property signature_suite: trustpoint_core.oid.SignatureSuite[source]¶

Returns the signature suite used by the current credential primary certificate.

Return type:: trustpoint_core.oid.SignatureSuite

property public_key_info: trustpoint_core.oid.PublicKeyInfo[source]¶

Returns the PublicKeyInfo the current credential primary certificate.

Return type:: trustpoint_core.oid.PublicKeyInfo

property hash_algorithm: cryptography.hazmat.primitives.hashes.HashAlgorithm | None[source]¶

Returns the hash algorithm used by the current credential.

Return type:: cryptography.hazmat.primitives.hashes.HashAlgorithm | None

is_valid_issued_credential()[source]¶

Determines if this issued credential is valid.

This method performs the following checks:

The credential must be of type ISSUED_CREDENTIAL.
A primary certificate must exist.
The certificate’s status must be ‘OK’.

Returns:

A tuple where:

The first value is True if the credential meets all criteria, False otherwise.
The second value is a reason string explaining why the credential is invalid.

Return type:

tuple[bool, str]

class pki.models.credential.PrimaryCredentialCertificate(*args, **kwargs)[source]¶

Bases: django.db.models.Model

Model to store which certificate is the primary certificate of a credential.

Used as through model for the many-to-many relationship between CredentialModel and CertificateModel.

credential[source]¶

certificate[source]¶

is_primary[source]¶

save(*args, **kwargs)[source]¶

If a new certificate is added to a credential, it is set to primary and all others to non-primary.

Parameters:

args (Any)
kwargs (Any)

Return type:

None

class pki.models.credential.CertificateChainOrderModel(*args, **kwargs)[source]¶

Bases: django.db.models.Model

This Model is used to preserve the order of certificates in credential certificate chains.

certificate[source]¶

credential[source]¶

order[source]¶

primary_certificate[source]¶

class Meta[source]¶

This Meta class add some configuration to the CertificateChainOrderModel.

Sets the default ordering such that the field order is used. Restricts entries such that the tuple (credential, order) is unique.

ordering: ClassVar = ['order'][source]¶

constraints: ClassVar[source]¶

save(*args, **kwargs)[source]¶

Stores a CertificateChainOrderModel in the database.

This is only possible if the order takes the next available value. That is, e.g. if the corresponding credential certificate chain has already two certificates stored with order 0 and 1, then the next entry to be stored must have order 2.

Parameters:

*args (Any) – Positional arguments, passed to super().save()
**kwargs (Any) – Keyword arguments, passed to super().save()

Returns:

None

Raises:

ValueError – If the CertificateChainOrderModel entry to be stored does not have the correct order.

Return type:

None

delete(*args, **kwargs)[source]¶

Tries to delete the CertificateChainOrderModel entry.

A CertificateChainOrderModel entry can only be deleted if it has the highest order in the corresponding credential certificate chain.

Parameters:

*args (Any) – Positional arguments, passed to super().delete()
**kwargs (Any) – Keyword arguments, passed to super().delete()

Returns:

tuple[int, dict[str, int]] (returned by parent)

Raises:

ValueError – If the CertificateChainOrderModel entry does not have the highest order in the corresponding credential certificate chain.

Return type:

tuple[int, dict[str, int]]

class pki.models.credential.IDevIDReferenceModel(*args, **kwargs)[source]¶

Bases: django.db.models.Model

Model to store the string referencing an IDevID certificate.

Obtained from the SAN of the DevOwnerID certificate.

The idevid_ref field holds the raw dev-owner: URI embedded in the DevOwnerID SAN. dev_owner_id_certificate points to the CertificateModel of the DevOwnerID certificate whose SAN contained this reference, so the details view can display the DevOwnerID certificate information without a fragile fingerprint-string lookup.

dev_owner_id[source]¶

idevid_ref[source]¶

dev_owner_id_certificate[source]¶

property idevid_subject_serial_number: str[source]¶

Returns the IDevID Subject Serial Number from the SAN of the DevOwnerID certificate.

The stored idevid_ref format is dev-owner:<subj_sn>.<x509_sn>.<sha256_fingerprint>. This property strips the dev-owner: scheme prefix and returns the first segment.

Return type:: str

property idevid_x509_serial_number: str[source]¶

Returns the IDevID X.509 Serial Number from the SAN of the DevOwnerID certificate.

Second dot-separated segment after stripping the dev-owner: prefix.

Return type:: str

property idevid_sha256_fingerprint: str[source]¶

Returns the IDevID SHA256 Fingerprint from the SAN of the DevOwnerID certificate.

Third dot-separated segment after stripping the dev-owner: prefix.

Return type:: str

class pki.models.credential.OwnerCredentialModel(*args, **kwargs)[source]¶

Bases: trustpoint.logger.LoggerMixin, util.db.CustomDeleteActionModel

Device owner credential model.

This model is a wrapper to manage a DevOwnerID for use by devices to trust the Trustpoint.

The actual DevOwnerID certificate is stored as an IssuedCredentialModel with issued_credential_type=DEV_OWNER_ID pointing back to this model.

Supports two acquisition modes: - File upload / Manual: a NoOnboardingConfigModel with MANUAL protocol is created. - Remote CA enrollment: no_onboarding_config (EST username/password) or

onboarding_config (EST IDevID) is set together with the remote_* fields.

class OwnerCredentialTypeChoice(*args, **kwds)[source]¶

Bases: django.db.models.IntegerChoices

How the DevOwnerID certificate is acquired.

LOCAL: uploaded as a file or generated locally (no remote CA).
REMOTE_EST: enrolled from a remote CA via EST (RFC 7030) with username/password.
REMOTE_CMP: enrolled from a remote CA via CMP (RFC 4210 / 9483).
REMOTE_EST_ONBOARDING: enrolled from a remote CA via EST using IDevID onboarding.

LOCAL[source]¶

REMOTE_EST[source]¶

REMOTE_CMP[source]¶

REMOTE_EST_ONBOARDING[source]¶

unique_name[source]¶

owner_credential_type[source]¶

remote_host[source]¶

remote_port[source]¶

remote_path[source]¶

remote_path_domain_credential[source]¶

est_username[source]¶

key_type[source]¶

onboarding_config[source]¶

no_onboarding_config[source]¶

created_at[source]¶

property dev_owner_id_credentials: django.db.models.QuerySet[pki.models.issued_credential.RemoteIssuedCredentialModel][source]¶

Returns all DevOwnerID RemoteIssuedCredentialModel instances for this owner credential, newest first.

An OwnerCredentialModel may accumulate multiple DevOwnerID credentials over time, e.g. after re-enrollment or renewal rounds.

Return type:: django.db.models.QuerySet[pki.models.issued_credential.RemoteIssuedCredentialModel]

property dev_owner_id_credential: pki.models.issued_credential.RemoteIssuedCredentialModel | None[source]¶

Returns the most recently created DevOwnerID RemoteIssuedCredentialModel, or None.

Use dev_owner_id_credentials when you need the full set of credentials.

Return type:: pki.models.issued_credential.RemoteIssuedCredentialModel | None

property domain_credentials: django.db.models.QuerySet[pki.models.issued_credential.RemoteIssuedCredentialModel][source]¶

Returns all Domain Credential RemoteIssuedCredentialModel instances for this owner credential, newest first.

Domain credentials are obtained during onboarding before the DevOwnerID is enrolled.

Return type:: django.db.models.QuerySet[pki.models.issued_credential.RemoteIssuedCredentialModel]

property domain_credential: pki.models.issued_credential.RemoteIssuedCredentialModel | None[source]¶

Returns the most recently created Domain Credential RemoteIssuedCredentialModel, or None.

Return type:: pki.models.issued_credential.RemoteIssuedCredentialModel | None

property has_valid_domain_credential: bool[source]¶

Returns True if there is at least one valid domain credential.

Return type:: bool

classmethod create_new_owner_credential(unique_name, credential_serializer, no_onboarding_config=None)[source]¶

Creates a new OwnerCredentialModel with the DevOwnerID stored as RemoteIssuedCredentialModel.

The DevOwnerID certificate (with optional chain and private key) is stored in a CredentialModel and wrapped in a RemoteIssuedCredentialModel of type DEV_OWNER_ID. If no no_onboarding_config is provided a new NoOnboardingConfigModel with protocol MANUAL is created automatically.

Parameters:

unique_name (str) – Unique human-readable name for this owner credential.
credential_serializer (trustpoint_core.serializer.CredentialSerializer) – The DevOwnerID credential (cert + optional key + chain).
no_onboarding_config (Any | None) – Optional pre-created NoOnboardingConfigModel to attach.

Returns:

The newly created instance.

Return type:

OwnerCredentialModel

post_delete()[source]¶

Deletes all remote issued credentials and the onboarding config on deletion.

Return type:: None