Package: pyspkac
Author:Ralf Schlatterbeck <rsc@runtux.com>This library supports the format of browser-generated SPKAC certificate
requests.The HTMLkeygentag which previously was supported by most
Mozilla-based browsers is now in the HTML-5 standard. The keygen tag is
used in a HTML form element and displays a key generation widget to the
user. When submitted, the browser locally generates a public key pair,
locally stores the private key, and submits the public key to the web
server in theSPKACformat.When generating a form with a keygen element, the web server can include
a challenge string in the form. This challenge string is returned in the
SPKAC generated by the browser. It is signed together with the public
key by the private key retained by the browser.This package is intended for server-side support of SPKAC. It uses a
submitted SPKAC and checks for correct challenge string and that the
public key and challenge are properly signed by the browser. It supports
a method for generating a certificate from the data in the SPKAC and
additional data supplied by the web application.The generated certificate can then typically be used for client
authentication to a web application and is therefore called a client
certificate. The web browser (or other client-side application) supplies
the certificate in the SSL handshake and proves it is in the posession
of the necessary private key.When building certificates it is also a good idea to have a certificate
revocation list (CRL). The package provides routines to generate a
revocation list from scratch using a list of certificate serial numbers
and revocation dates.InstallationInstall using the standard python setup.py mechanism, e.g.:python setup.py install --prefix=/usr/localYou needpyasn1andM2Cryptoinstalled for this package to work.ExamplesFor a usage example see the doctests inspkac.pyandcrl.pyNotes for BuildingWhen doing a release the following commands should be issued:python setup.py clean --all
python setup.py sdist --manifest-only
git status
python setup.py sdist --quiet
git status
python setup.py register
python setup.py sdist upload --signThe interleavedgit statuscommands work around a bug in older git
versions that, whengit describewith--dirtyoption is used,
will erroneously detectdirtystatus when the directory is stat-dirty.
Sincesetup.py sdistwill create symlinks this will make the
directory stat-dirty.The –manifest-only will re-create theMANIFESTfile even if neithersetup.pynorMANIFEST.inhave changed.ChangesVersion 0.7: Bug fixesFix github issuesFix Github issue 2 problems with version number format, we now use a
numeric value but leave the tag format as before (starting with ‘V-‘).Merge pull request for Opera Workaround in Github issue 3Version 0.6: Bug fixRelease now contains missing files from 0.5.AddNotes for Buildingsection and document release procedure to
avoid missing files in the futureRemove relativeimportstatementsAdd version import to__init__.pyVersion 0.5: Major feature enhancementsImplement Certificate Revocation Lists (CRL)Implementation of CRL (with MD5 hash, this probably needs to be fixed
later on, don’t know yet if there is a format with a stronger hash)factor pem_objectFix timezone of default valid_from for generated certificate: We used
a timezone correction on a timestamp which is already UTC.Version 0.4: Bug fixFix incompatibility with newer versions of pyasn1.BitString serialisation in pyasn1 changed method names, the old
inofficial serialisation method with ‘_’ is now official without the
‘_’.Version 0.3: Bug fixImport of version.py failed if dependecies were missing. This prevented
apip installfrom succeeding in case of missing dependencies.Guard import in __init__.py to not fail for missing dependenciesVersion 0.2: Minor feature additionsMove example from end of spkac.py into a doctest. Change of API:
set_email no longer supported. Now extensions can be given as unnamed
arguments in the constructor. Named arguments are interpreted as
subject parameters for the resulting certificate. All this is shown in
the doctest.Remove set_emailChange constructor: Allow extensions as args and subject parameters as
keyword argsAdd doctestFix setup.py to include install_requires to auto-install required
packagesEasier import:
from pyspkac import SPKAC
works now.Version 0.1: Initial Release