pki.util.cert_profile

JSON Certificate Profile implementation.

This module provides functionality to verify certificate requests against JSON-based profiles.

Profiles define allowed fields, prohibited fields, and other constraints for certificate requests. They can also specify default values for fields and validate the request against these rules.

Module Contents

pki.util.cert_profile.logger

exception pki.util.cert_profile.ProfileValidationError

Bases: Exception

Raised when the request is well-formed but does not match the profile constraints.

pki.util.cert_profile.ALIASES: dict[str, pydantic.AliasChoices]

pki.util.cert_profile.CERT_PROFILE_KEYWORDS

pki.util.cert_profile.build_alias_map_name_oids(alias_map, enum_cls)

Build a mapping of all known OID strings from trustpoint_core to their canonical field names.

Parameters:

• alias_map (dict[str, str])

• enum_cls (type[enum.Enum])

Return type:

dict[str, str]

pki.util.cert_profile.alias_map

pki.util.cert_profile.alias_map

class pki.util.cert_profile.ProfileValuePropertyModel(/, **data)

Bases: pydantic.BaseModel

Model for a profile value property.

Parameters:

data (Any)

value: Any | None = None

default: Any | None = None

required: bool = False

mutable: bool = True

class pki.util.cert_profile.SubjectModel(/, **data)

Bases: pydantic.BaseModel

Model for the subject DN of a certificate profile.

Parameters:

data (Any)

common_name: str | ProfileValuePropertyModel | None = None

surname: str | ProfileValuePropertyModel | None = None

serial_number: str | ProfileValuePropertyModel | None = None

country_name: str | ProfileValuePropertyModel | None = None

locality_name: str | ProfileValuePropertyModel | None = None

state_or_province_name: str | ProfileValuePropertyModel | None = None

street_address: str | ProfileValuePropertyModel | None = None

organization_name: str | ProfileValuePropertyModel | None = None

organizational_unit_name: str | ProfileValuePropertyModel | None = None

title: str | ProfileValuePropertyModel | None = None

description: str | ProfileValuePropertyModel | None = None

postal_code: str | ProfileValuePropertyModel | None = None

email_address: str | ProfileValuePropertyModel | None = None

name: str | ProfileValuePropertyModel | None = None

given_name: str | ProfileValuePropertyModel | None = None

initials: str | ProfileValuePropertyModel | None = None

pseudonym: str | ProfileValuePropertyModel | None = None

uid: str | ProfileValuePropertyModel | None = None

domain_component: str | ProfileValuePropertyModel | None = None

model_config

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class pki.util.cert_profile.BaseExtensionModel(/, **data)

Bases: pydantic.BaseModel

Base model for certificate extensions.

Parameters:

data (Any)

critical: bool | None = None

model_config

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class pki.util.cert_profile.BasicConstraintsExtensionModel(/, **data)

Bases: BaseExtensionModel

Model for the Basic Constraints extension of a certificate profile.

Parameters:

data (Any)

ca: bool | None = None

path_length: int | None = None

model_config

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class pki.util.cert_profile.SanExtensionModel(/, **data)

Bases: BaseExtensionModel, ProfileValuePropertyModel

Model for the SAN extension of a certificate profile.

Parameters:

data (Any)

dns_names: list[str] | ProfileValuePropertyModel | None = None

ip_addresses: list[str] | ProfileValuePropertyModel | None = None

rfc822_names: list[str] | ProfileValuePropertyModel | None = None

uris: list[str] | ProfileValuePropertyModel | None = None

other_names: list[str] | ProfileValuePropertyModel | None = None

model_config

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class pki.util.cert_profile.CRLDistributionPointsExtensionModel(/, **data)

Bases: BaseExtensionModel, ProfileValuePropertyModel

Model for the CRL Distribution Points extension of a certificate profile.

Note: Only URIs in full_name are supported.

Parameters:

data (Any)

uris: list[str] | ProfileValuePropertyModel | None = None

model_config

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class pki.util.cert_profile.KeyUsageExtensionModel(/, **data)

Bases: BaseExtensionModel

Model for the Key Usage extension of a certificate profile.

Parameters:

data (Any)

digital_signature: bool | None = None

content_commitment: bool | None = None

key_encipherment: bool | None = None

data_encipherment: bool | None = None

key_agreement: bool | None = None

key_cert_sign: bool | None = None

crl_sign: bool | None = None

encipher_only: bool | None = None

decipher_only: bool | None = None

model_config

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class pki.util.cert_profile.ExtendedKeyUsageExtensionModel(/, **data)

Bases: BaseExtensionModel

Model for the Extended Key Usage extension of a certificate profile.

Parameters:

data (Any)

usages: list[str] | ProfileValuePropertyModel | None = None

model_config

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class pki.util.cert_profile.ExtensionsModel(/, **data)

Bases: pydantic.BaseModel

Model for the extensions of a certificate request.

Parameters:

data (Any)

basic_constraints: BasicConstraintsExtensionModel | None = None

key_usage: KeyUsageExtensionModel | None = None

extended_key_usage: ExtendedKeyUsageExtensionModel | None = None

subject_alternative_name: SanExtensionModel | None = None

crl_distribution_points: CRLDistributionPointsExtensionModel | None = None

class pki.util.cert_profile.ValidityModel(/, **data)

Bases: pydantic.BaseModel

Model for the validity period of a certificate profile.

Parameters:

data (Any)

not_before: pydantic.AwareDatetime | None = None

not_after: pydantic.AwareDatetime | None = None

days: float | None = None

hours: float | None = None

minutes: float | None = None

seconds: int | None = None

duration: datetime.timedelta | None = None

offset_s: int | None = None

validity_max: datetime.timedelta | None = None

validity_min: datetime.timedelta | None = None

model_config

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class pki.util.cert_profile.CertProfileBaseModel(/, **data)

Bases: pydantic.BaseModel

Base model for each nesting level of certificate profiles.

This allows for granular control over allowed fields and constraints at each level.

Parameters:

data (Any)

allow: list[str] | Literal['*'] | None = None

reject_mods: bool = None

classmethod normalize_allow(value)

Normalize the allow list by replacing aliases with their canonical names.

Parameters:

value (list[str] | Literal['*'] | None)

Return type:

list[str] | Literal[‘*’] | None

class pki.util.cert_profile.ProfileSubjectModel(/, **data)

Bases: SubjectModel, CertProfileBaseModel

Model for the subject DN of a certificate profile, with profile constraints.

Parameters:

data (Any)

class pki.util.cert_profile.ProfileSanExtensionModel(/, **data)

Bases: SanExtensionModel, CertProfileBaseModel

Model for the SAN extension of a certificate profile, with profile constraints.

Parameters:

data (Any)

class pki.util.cert_profile.ProfileCrlDistributionPointsExtensionModel(/, **data)

Bases: CRLDistributionPointsExtensionModel, CertProfileBaseModel

Model for the CRL Distribution Points extension of a certificate profile, with profile constraints.

Parameters:

data (Any)

class pki.util.cert_profile.ProfileExtensionsModel(/, **data)

Bases: CertProfileBaseModel

Model for the extensions of a certificate profile, with profile constraints.

Parameters:

data (Any)

basic_constraints: BasicConstraintsExtensionModel | ProfileValuePropertyModel | None = None

key_usage: KeyUsageExtensionModel | ProfileValuePropertyModel | None = None

extended_key_usage: ExtendedKeyUsageExtensionModel | ProfileValuePropertyModel | None = None

subject_alternative_name: ProfileSanExtensionModel | ProfileValuePropertyModel | None = None

crl_distribution_points: ProfileCrlDistributionPointsExtensionModel | ProfileValuePropertyModel | None = None

class pki.util.cert_profile.CertProfileModel(/, **data)

Bases: CertProfileBaseModel

Model for a certificate profile.

Parameters:

data (Any)

type: Literal['cert_profile']

display_name: str | None = None

subject: ProfileSubjectModel = None

extensions: ProfileExtensionsModel = None

validity: ValidityModel = None

class pki.util.cert_profile.CertRequestModel(/, **data)

Bases: pydantic.BaseModel

Model for a certificate request.

Parameters:

data (Any)

type: Literal['cert_request'] | None = 'cert_request'

subject: SubjectModel = None

extensions: ExtensionsModel = None

validity: ValidityModel = None

model_config

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class pki.util.cert_profile.InheritedProfileConfig(*, allow_implicit=False, reject_mods=False, mutable=False)

Constraints set in the profile that are inherited by deeper nesting levels.

Parameters:

• allow_implicit (bool)

• reject_mods (bool)

• mutable (bool)

allow_implicit: bool = False

reject_mods: bool = False

mutable: bool = False

class pki.util.cert_profile.JSONProfileVerifier(profile)

Class to verify certificate requests against JSON-based profiles.

Parameters:

profile (dict[str, Any])

profile

profile_dict

static validate_request(request)

Validates and normalizes a certificate request.

This just checks its structure, it does not validate against a profile.

Parameters:

request (dict[str, Any])

Return type:

dict[str, Any]

apply_profile_to_request(request)

Apply the profile to a certificate request and return the modified request.

Parameters:

request (dict[str, Any])

Return type:

dict[str, Any]

get_sample_request()

Generate a sample certificate request that conforms to the profile.

Return type:

dict[str, Any]

get_profile()

Get the profile as a dictionary.

Return type:

dict[str, Any]