SUNET / python_x509_pkcs11

Python library for signing x509 using keys in an pkcs11 device
MIT License
4 stars 3 forks source link

Add a create_csr() function in the csr module #18

Open peterwu opened 7 months ago

peterwu commented 7 months ago

Hi again. :)

I'm reading up the source code ca.create() where a self-signed certificate is created. It basically consists of 3 steps:

  1. generate a keypair
  2. create a csr
  3. sign the csr with its own key

I wonder if it might make sense to refactor the code (2nd point above) into the csr module so that one can call csr.create_csr() to create a csr with the specified private key in the device.

Typical use cases are: cross signing and an intermediate CA.

For the cross signing scenario, e.g. when the CA is created, there is no intention to have the root CA to be signed by another CA. Thus, the csr returned by ca.create() may not be saved. However, 5 years later, the new situation warrants a cross signing and at that point, a csr.create_csr() function would be useful to re-create the csr.

Just my 2 cents. Thanks for the great package!

vinas003 commented 7 months ago

I will refactor the code. Might take a few days or a week due to me working on other stuff. Very good idea @peterwu !