pki.models.issued_credential

A model for issued credentials.

Module Contents

class pki.models.issued_credential.IssuedCredentialModel(*args, **kwargs)[source]

Bases: util.db.CustomDeleteActionModel

Model for credentials and certificates issued to a device by the Trustpoint.

Each instance must have a device FK set. For credentials owned by a CA or an OwnerCredential, use RemoteIssuedCredentialModel instead.

class IssuedCredentialType(*args, **kwds)[source]

Bases: django.db.models.IntegerChoices

The type of the credential.

DOMAIN_CREDENTIAL[source]
APPLICATION_CREDENTIAL[source]
id[source]
common_name[source]
issued_credential_type[source]
issued_using_cert_profile[source]
credential[source]
device[source]
domain[source]
created_at[source]
class Meta[source]

Bases: django_stubs_ext.db.models.TypedModelMeta

Meta class configuration.

clean()[source]

Validate that the device FK is set.

Return type:

None

revoke()[source]

Revokes all active certificates associated with this credential.

Return type:

None

pre_delete()[source]

Revoke all active certificates and delete the credential.

Return type:

None

is_valid_domain_credential()[source]

Determines if this issued credential is valid for enrolling new application credentials.

This method performs the following checks:

  1. The IssuedCredentialModel type must be of type DOMAIN_CREDENTIAL.

  2. The credential must be of type ISSUED_CREDENTIAL.

  3. A primary certificate must exist.

  4. The certificate’s status must be ‘OK’.

Returns:

A tuple where:

  • The first value is True if the credential meets all criteria, False otherwise.

  • The second value is a reason string explaining why the credential is invalid.

Return type:

tuple[bool, str]

static get_credential_for_certificate(cert)[source]

Retrieve an IssuedCredentialModel instance for the given certificate.

Parameters:

cert (cryptography.x509.Certificate) – x509.Certificate to search for.

Returns:

The corresponding IssuedCredentialModel instance.

Raises:

DoesNotExist – if no matching issued credential is found.

Return type:

IssuedCredentialModel

static get_credential_for_serial_number(domain, device, serial_number)[source]

Retrieve an IssuedCredentialModel instance for the given X.509 serial number within the specified domain.

Raises: DoesNotExist if no matching issued credential is found.

Parameters:
Return type:

IssuedCredentialModel

class pki.models.issued_credential.RemoteIssuedCredentialModel(*args, **kwargs)[source]

Bases: util.db.CustomDeleteActionModel

Model for credentials issued to a CA, a DevOwnerID, or a device via a remote/RA CA.

class RemoteIssuedCredentialType(*args, **kwds)[source]

Bases: django.db.models.IntegerChoices

The type of the credential.

DOMAIN_CREDENTIAL[source]
DEV_OWNER_ID[source]
LOCAL_CA[source]
RA_DEVICE[source]
id[source]
common_name[source]
issued_credential_type[source]
issued_using_cert_profile[source]
credential[source]
ca[source]
owner_credential[source]
device[source]
domain[source]
created_at[source]
class Meta[source]

Bases: django_stubs_ext.db.models.TypedModelMeta

Meta class configuration.

clean()[source]

Validate that exactly one owner (ca, owner_credential, or device) is set.

Return type:

None

pre_delete()[source]

Delete the underlying credential (cascades back to this model).

Return type:

None