parameters: (self, name, config)
return_statement: return cert
docstring: Create a certificate with the given configuration.
docstring_summary: Create a certificate with the given configuration.
docstring_tokens: Create a certificate with the given configuration .
function: def create_cert(self, name, config):
          """
          Create a certificate with the given configuration.
          """
          cert = argparse.Namespace()
          cert.name = name
          cert.key_type = config.get('key-type', 'rsa:2048')
  
          cert.client = config.get('client', None)
          if not cert.client:
              raise ConfigError('ssl: missing required field "client"')
  
          (cert.remote,) = self.ctx.cluster.only(cert.client).remotes.keys()
  
          cert.remote.run(args=['mkdir', '-p', self.cadir])
  
          cert.key = f'{self.cadir}/{cert.name}.key'
          cert.certificate = f'{self.cadir}/{cert.name}.crt'
  
          san_ext = []
          add_san_default = False
          cn = config.get('cn', '')
          if cn == '':
              cn = cert.remote.hostname
              add_san_default = True
          if config.get('add-san', add_san_default):
              ext = f'{self.cadir}/{cert.name}.ext'
              san_ext = ['-extfile', ext]
  
          # provide the common name in -subj to avoid the openssl command prompts
          subject = f'/CN={cn}'
  
          # if a ca certificate is provided, use it to sign the new certificate
          ca = config.get('ca', None)
          if ca:
              # the ca certificate must have been created by a prior ssl task
              ca_cert = self.ctx.ssl_certificates.get(ca, None)
              if not ca_cert:
                  raise ConfigError(f'ssl: ca {ca} not found for certificate {cert.name}')
  
              csr = f'{self.cadir}/{cert.name}.csr'
              srl = f'{self.cadir}/{ca_cert.name}.srl'
              remove_files = ['rm', csr, srl]
  
              # these commands are run on the ca certificate's client because
              # they need access to its private key and cert
  
              # generate a private key and signing request
              ca_cert.remote.run(args=['openssl', 'req', '-nodes',
                  '-newkey', cert.key_type, '-keyout', cert.key,
                  '-out', csr, '-subj', subject])
  
              if san_ext:
                  remove_files.append(ext)
                  ca_cert.remote.write_file(path=ext,
                      data='subjectAltName = DNS:{},IP:{}'.format(
                          cn,
                          config.get('ip', cert.remote.ip_address)))
  
              # create the signed certificate
              ca_cert.remote.run(args=['openssl', 'x509', '-req', '-in', csr,
                  '-CA', ca_cert.certificate, '-CAkey', ca_cert.key, '-CAcreateserial',
                  '-out', cert.certificate, '-days', '365', '-sha256'] + san_ext)
  
              ca_cert.remote.run(args=remove_files) # clean up the signing request and serial
  
              # verify the new certificate against its ca cert
              ca_cert.remote.run(args=['openssl', 'verify',
                  '-CAfile', ca_cert.certificate, cert.certificate])
  
              if cert.remote != ca_cert.remote:
                  # copy to remote client
                  self.remote_copy_file(ca_cert.remote, cert.certificate, cert.remote, cert.certificate)
                  self.remote_copy_file(ca_cert.remote, cert.key, cert.remote, cert.key)
                  # clean up the local copies
                  ca_cert.remote.run(args=['rm', cert.certificate, cert.key])
                  # verify the remote certificate (requires ca to be in its trusted ca certificate store)
                  cert.remote.run(args=['openssl', 'verify', cert.certificate])
          else:
              # otherwise, generate a private key and use it to self-sign a new certificate
              cert.remote.run(args=['openssl', 'req', '-x509', '-nodes',
                  '-newkey', cert.key_type, '-keyout', cert.key,
                  '-days', '365', '-out', cert.certificate, '-subj', subject])
  
          if config.get('embed-key', False):
              # append the private key to the certificate file
              cert.remote.run(args=['cat', cert.key, run.Raw('>>'), cert.certificate])
  
          return cert
function_tokens: def create_cert ( self , name , config ) : cert = argparse . Namespace ( ) cert . name = name cert . key_type = config . get ( 'key-type' , 'rsa:2048' ) cert . client = config . get ( 'client' , None ) if not cert . client : raise ConfigError ( 'ssl: missing required field "client"' ) ( cert . remote , ) = self . ctx . cluster . only ( cert . client ) . remotes . keys ( ) cert . remote . run ( args = [ 'mkdir' , '-p' , self . cadir ] ) cert . key = f'{self.cadir}/{cert.name}.key' cert . certificate = f'{self.cadir}/{cert.name}.crt' san_ext = [ ] add_san_default = False cn = config . get ( 'cn' , '' ) if cn == '' : cn = cert . remote . hostname add_san_default = True if config . get ( 'add-san' , add_san_default ) : ext = f'{self.cadir}/{cert.name}.ext' san_ext = [ '-extfile' , ext ] # provide the common name in -subj to avoid the openssl command prompts subject = f'/CN={cn}' # if a ca certificate is provided, use it to sign the new certificate ca = config . get ( 'ca' , None ) if ca : # the ca certificate must have been created by a prior ssl task ca_cert = self . ctx . ssl_certificates . get ( ca , None ) if not ca_cert : raise ConfigError ( f'ssl: ca {ca} not found for certificate {cert.name}' ) csr = f'{self.cadir}/{cert.name}.csr' srl = f'{self.cadir}/{ca_cert.name}.srl' remove_files = [ 'rm' , csr , srl ] # these commands are run on the ca certificate's client because # they need access to its private key and cert # generate a private key and signing request ca_cert . remote . run ( args = [ 'openssl' , 'req' , '-nodes' , '-newkey' , cert . key_type , '-keyout' , cert . key , '-out' , csr , '-subj' , subject ] ) if san_ext : remove_files . append ( ext ) ca_cert . remote . write_file ( path = ext , data = 'subjectAltName = DNS:{},IP:{}' . format ( cn , config . get ( 'ip' , cert . remote . ip_address ) ) ) # create the signed certificate ca_cert . remote . run ( args = [ 'openssl' , 'x509' , '-req' , '-in' , csr , '-CA' , ca_cert . certificate , '-CAkey' , ca_cert . key , '-CAcreateserial' , '-out' , cert . certificate , '-days' , '365' , '-sha256' ] + san_ext ) ca_cert . remote . run ( args = remove_files ) # clean up the signing request and serial # verify the new certificate against its ca cert ca_cert . remote . run ( args = [ 'openssl' , 'verify' , '-CAfile' , ca_cert . certificate , cert . certificate ] ) if cert . remote != ca_cert . remote : # copy to remote client self . remote_copy_file ( ca_cert . remote , cert . certificate , cert . remote , cert . certificate ) self . remote_copy_file ( ca_cert . remote , cert . key , cert . remote , cert . key ) # clean up the local copies ca_cert . remote . run ( args = [ 'rm' , cert . certificate , cert . key ] ) # verify the remote certificate (requires ca to be in its trusted ca certificate store) cert . remote . run ( args = [ 'openssl' , 'verify' , cert . certificate ] ) else : # otherwise, generate a private key and use it to self-sign a new certificate cert . remote . run ( args = [ 'openssl' , 'req' , '-x509' , '-nodes' , '-newkey' , cert . key_type , '-keyout' , cert . key , '-days' , '365' , '-out' , cert . certificate , '-subj' , subject ] ) if config . get ( 'embed-key' , False ) : # append the private key to the certificate file cert . remote . run ( args = [ 'cat' , cert . key , run . Raw ( '>>' ) , cert . certificate ] ) return cert