diff --git a/app/utils/crypto.py b/app/utils/crypto.py
@@ -1,8 +1,11 @@
import ssl
+from datetime import datetime, timedelta
from cryptography import x509
from cryptography.hazmat.backends import default_backend
-from OpenSSL import crypto
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.x509.oid import ExtendedKeyUsageOID
def get_cert_SANs(cert: bytes):
@@ -17,21 +20,60 @@ def get_cert_SANs(cert: bytes):
def generate_certificate():
- k = crypto.PKey()
- k.generate_key(crypto.TYPE_RSA, 4096)
- cert = crypto.X509()
- cert.get_subject().CN = "Gozargah"
- cert.gmtime_adj_notBefore(0)
- cert.gmtime_adj_notAfter(100 * 365 * 24 * 60 * 60)
- cert.set_issuer(cert.get_subject())
- cert.set_pubkey(k)
- cert.sign(k, "sha512")
- cert_pem = crypto.dump_certificate(crypto.FILETYPE_PEM, cert).decode(
- "utf-8"
+ key = ec.generate_private_key(ec.SECP256R1())
+
+ subject = issuer = x509.Name([])
+
+ subject_key_id = x509.SubjectKeyIdentifier.from_public_key(
+ key.public_key()
+ )
+
+ cert = (
+ x509.CertificateBuilder()
+ .subject_name(subject)
+ .issuer_name(issuer)
+ .public_key(key.public_key())
+ .serial_number(x509.random_serial_number())
+ .not_valid_before(datetime.utcnow())
+ .not_valid_after(datetime.utcnow() + timedelta(days=3650))
+ .add_extension(
+ x509.BasicConstraints(ca=False, path_length=None), critical=True
+ )
+ .add_extension(
+ x509.KeyUsage(
+ digital_signature=True,
+ content_commitment=False,
+ key_encipherment=True,
+ data_encipherment=False,
+ key_agreement=False,
+ key_cert_sign=False,
+ crl_sign=False,
+ encipher_only=False,
+ decipher_only=False,
+ ),
+ critical=False,
+ )
+ .add_extension(subject_key_id, critical=False)
+ .add_extension(
+ x509.ExtendedKeyUsage(
+ [
+ ExtendedKeyUsageOID.SERVER_AUTH,
+ ExtendedKeyUsageOID.CLIENT_AUTH,
+ ]
+ ),
+ critical=False,
+ )
+ .sign(private_key=key, algorithm=hashes.SHA256())
)
- key_pem = crypto.dump_privatekey(crypto.FILETYPE_PEM, k).decode("utf-8")
- return {"cert": cert_pem, "key": key_pem}
+ return {
+ "cert": cert.public_bytes(serialization.Encoding.PEM).decode(),
+ "key": key.private_bytes(
+ encoding=serialization.Encoding.PEM,
+ format=serialization.PrivateFormat.TraditionalOpenSSL,
+ encryption_algorithm=serialization.NoEncryption(),
+ ).decode(),
+ }
def create_secure_context(
diff --git a/requirements.txt b/requirements.txt
@@ -10,7 +10,6 @@ passlib==1.7.4
protobuf==4.25.2
pydantic==2.10
PyMySQL==1.1.1
-pyOpenSSL==24.2.1
python-decouple==3.8
python-dotenv==1.0.0
requests==2.32.2