123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554 |
- #!/usr/bin/env python
- # Copyright 2015 The Chromium Authors. All rights reserved.
- # Use of this source code is governed by a BSD-style license that can be
- # found in the LICENSE file.
- import base64
- import copy
- import os
- import random
- import subprocess
- import sys
- import tempfile
- sys.path += [os.path.join('..', 'verify_name_match_unittest', 'scripts')]
- import generate_names
- def generate(s, out_fn):
- conf_tempfile = tempfile.NamedTemporaryFile()
- conf_tempfile.write(str(s))
- conf_tempfile.flush()
- der_tmpfile = tempfile.NamedTemporaryFile()
- description_tmpfile = tempfile.NamedTemporaryFile()
- subprocess.check_call(['openssl', 'asn1parse', '-genconf', conf_tempfile.name,
- '-i', '-out', der_tmpfile.name],
- stdout=description_tmpfile)
- conf_tempfile.close()
- output_file = open(out_fn, 'w')
- description_tmpfile.seek(0)
- output_file.write(description_tmpfile.read())
- output_file.write('-----BEGIN %s-----\n' % s.token())
- output_file.write(base64.encodestring(der_tmpfile.read()))
- output_file.write('-----END %s-----\n' % s.token())
- output_file.close()
- class SubjectAltNameGenerator:
- def __init__(self):
- self.names = []
- def token(self):
- return "SUBJECT ALTERNATIVE NAME"
- def add_name(self, general_name):
- self.names.append(general_name)
- def __str__(self):
- s = "asn1 = SEQUENCE:subjectAltNameSequence\n"
- s += "[subjectAltNameSequence]\n"
- s_suffix = ""
- for n, name in enumerate(self.names):
- n1, n2 = (str(name) + '\n').split('\n', 1)
- if n2:
- s_suffix += n2 + '\n'
- s += '%s%s\n' % (n, n1)
- return s + s_suffix
- class NameConstraintsGenerator:
- def __init__(self,
- force_permitted_sequence=False,
- force_excluded_sequence=False):
- self.permitted = []
- self.excluded = []
- self.force_permitted_sequence = force_permitted_sequence
- self.force_excluded_sequence = force_excluded_sequence
- def token(self):
- return "NAME CONSTRAINTS"
- def union_from(self, c):
- self.permitted.extend(c.permitted)
- self.excluded.extend(c.excluded)
- def add_permitted(self, general_name):
- self.permitted.append(general_name)
- def add_excluded(self, general_name):
- self.excluded.append(general_name)
- def __str__(self):
- s = "asn1 = SEQUENCE:nameConstraintsSequence\n[nameConstraintsSequence]\n"
- if self.permitted or self.force_permitted_sequence:
- s += "permittedSubtrees = IMPLICIT:0,SEQUENCE:permittedSubtreesSequence\n"
- if self.excluded or self.force_excluded_sequence:
- s += "excludedSubtrees = IMPLICIT:1,SEQUENCE:excludedSubtreesSequence\n"
- if self.permitted or self.force_permitted_sequence:
- s += "[permittedSubtreesSequence]\n"
- for n, subtree in enumerate(self.permitted):
- s += 'subtree%i = SEQUENCE:permittedSubtree%i\n' % (n, n)
- if self.excluded or self.force_excluded_sequence:
- s += "[excludedSubtreesSequence]\n"
- for n, subtree in enumerate(self.excluded):
- s += 'subtree%i = SEQUENCE:excludedSubtree%i\n' % (n, n)
- for n, subtree in enumerate(self.permitted):
- s += '[permittedSubtree%i]\n%s\n' % (n, subtree)
- for n, subtree in enumerate(self.excluded):
- s += '[excludedSubtree%i]\n%s\n' % (n, subtree)
- return s
- def other_name():
- i = random.randint(0, sys.maxint)
- s = 'otherName = IMPLICIT:0,SEQUENCE:otherNameSequence%i\n' % i
- s += '[otherNameSequence%i]\n' % i
- s += 'type_id = OID:1.2.3.4.5\n'
- s += 'value = FORMAT:HEX,OCTETSTRING:DEADBEEF\n'
- return s
- def rfc822_name(name):
- return 'rfc822Name = IMPLICIT:1,IA5STRING:' + name
- def dns_name(name):
- return 'dNSName = IMPLICIT:2,IA5STRING:' + name
- def x400_address():
- i = random.randint(0, sys.maxint)
- s = 'x400Address = IMPLICIT:3,SEQUENCE:x400AddressSequence%i\n' % i
- s += '[x400AddressSequence%i]\n' % i
- s += 'builtinstandardattributes = SEQUENCE:BuiltInStandardAttributes%i\n' % i
- s += '[BuiltInStandardAttributes%i]\n' % i
- s += 'countryname = EXPLICIT:1A,PRINTABLESTRING:US\n'
- return s
- def directory_name(name):
- return str(name).replace(
- 'asn1 = SEQUENCE', 'directoryName = EXPLICIT:4,SEQUENCE')
- def edi_party_name():
- i = random.randint(0, sys.maxint)
- s = 'ediPartyName = IMPLICIT:5,SEQUENCE:ediPartyNameSequence%i\n' % i
- s += '[ediPartyNameSequence%i]\n' % i
- s += 'partyName = IMPLICIT:1,UTF8:foo\n'
- return s
- def uniform_resource_identifier(name):
- return 'uniformResourceIdentifier = IMPLICIT:6,IA5STRING:' + name
- def ip_address(addr, enforce_length=True):
- if enforce_length:
- assert len(addr) in (4,16)
- addr_str = ""
- for addr_byte in addr:
- addr_str += '%02X'%(addr_byte)
- return 'iPAddress = IMPLICIT:7,FORMAT:HEX,OCTETSTRING:' + addr_str
- def ip_address_range(addr, netmask, enforce_length=True):
- if enforce_length:
- assert len(addr) == len(netmask)
- assert len(addr) in (4,16)
- addr_str = ""
- netmask_str = ""
- for addr_byte, mask_byte in map(None, addr, netmask):
- assert (addr_byte & ~mask_byte) == 0
- addr_str += '%02X'%(addr_byte)
- netmask_str += '%02X'%(mask_byte)
- return ('iPAddress = IMPLICIT:7,FORMAT:HEX,OCTETSTRING:' + addr_str +
- netmask_str)
- def registered_id(oid):
- return 'registeredID = IMPLICIT:8,OID:' + oid
- def with_min_max(val, minimum=None, maximum=None):
- s = val
- s += '\n'
- assert '\n[' not in s
- if minimum is not None:
- s += 'minimum = IMPLICIT:0,INTEGER:%i\n' % minimum
- if maximum is not None:
- s += 'maximum = IMPLICIT:1,INTEGER:%i\n' % maximum
- return s
- def main():
- dnsname_constraints = NameConstraintsGenerator()
- dnsname_constraints.add_permitted(dns_name("permitted.example.com"))
- dnsname_constraints.add_permitted(dns_name("permitted.example2.com"))
- dnsname_constraints.add_permitted(dns_name("permitted.example3.com."))
- dnsname_constraints.add_permitted(dns_name("alsopermitted.example.com"))
- dnsname_constraints.add_excluded(dns_name("excluded.permitted.example.com"))
- dnsname_constraints.add_permitted(
- dns_name("stillnotpermitted.excluded.permitted.example.com"))
- dnsname_constraints.add_excluded(dns_name("extraneousexclusion.example.com"))
- generate(dnsname_constraints, "dnsname.pem")
- dnsname_constraints2 = NameConstraintsGenerator()
- dnsname_constraints2.add_permitted(dns_name("com"))
- dnsname_constraints2.add_excluded(dns_name("foo.bar.com"))
- generate(dnsname_constraints2, "dnsname2.pem")
- dnsname_constraints3 = NameConstraintsGenerator()
- dnsname_constraints3.add_permitted(dns_name(".bar.com"))
- generate(dnsname_constraints3, "dnsname-permitted_with_leading_dot.pem")
- dnsname_constraints4 = NameConstraintsGenerator()
- dnsname_constraints4.add_excluded(dns_name(".bar.com"))
- generate(dnsname_constraints4, "dnsname-excluded_with_leading_dot.pem")
- dnsname_constraints5 = NameConstraintsGenerator()
- dnsname_constraints5.add_permitted(dns_name(".."))
- generate(dnsname_constraints5, "dnsname-permitted_two_dot.pem")
- c = NameConstraintsGenerator()
- c.add_excluded(dns_name("excluded.permitted.example.com"))
- generate(c, "dnsname-excluded.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(dns_name("permitted.example.com"))
- c.add_excluded(dns_name(""))
- generate(c, "dnsname-excludeall.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(dns_name("permitted.example.com"))
- c.add_excluded(dns_name("."))
- generate(c, "dnsname-exclude_dot.pem")
- ipaddress_constraints = NameConstraintsGenerator()
- ipaddress_constraints.add_permitted(
- ip_address_range((192,168,0,0),(255,255,0,0)))
- ipaddress_constraints.add_excluded(
- ip_address_range((192,168,5,0),(255,255,255,0)))
- ipaddress_constraints.add_permitted(
- ip_address_range((192,168,5,32),(255,255,255,224)))
- ipaddress_constraints.add_permitted(
- ip_address_range((192,167,5,32),(255,255,255,224)))
- ipaddress_constraints.add_excluded(
- ip_address_range((192,166,5,32),(255,255,255,224)))
- ipaddress_constraints.add_permitted(ip_address_range(
- (1,2,3,4,5,6,7,8,9,10,11,12,0,0,0,0),
- (255,255,255,255,255,255,255,255,255,255,255,255,0,0,0,0)))
- ipaddress_constraints.add_excluded(ip_address_range(
- (1,2,3,4,5,6,7,8,9,10,11,12,5,0,0,0),
- (255,255,255,255,255,255,255,255,255,255,255,255,255,0,0,0)))
- ipaddress_constraints.add_permitted(ip_address_range(
- (1,2,3,4,5,6,7,8,9,10,11,12,5,32,0,0),
- (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0)))
- ipaddress_constraints.add_permitted(ip_address_range(
- (1,2,3,4,5,6,7,8,9,10,11,11,5,32,0,0),
- (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0)))
- ipaddress_constraints.add_excluded(ip_address_range(
- (1,2,3,4,5,6,7,8,9,10,11,10,5,32,0,0),
- (255,255,255,255,255,255,255,255,255,255,255,255,255,224,0,0)))
- generate(ipaddress_constraints, "ipaddress.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(ip_address_range((192,168,1,3),(255,255,255,255)))
- generate(c, "ipaddress-permit_singlehost.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(ip_address_range((0,0,0,0),(0,0,0,0)))
- generate(c, "ipaddress-permit_all.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(ip_address_range((0x80,0,0,0),(0x80,0,0,0)))
- generate(c, "ipaddress-permit_prefix1.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(ip_address_range((192,168,1,2),(255,255,255,254)))
- generate(c, "ipaddress-permit_prefix31.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(ip_address_range((192,168,1,0),(255,255,255,253)))
- generate(c, "ipaddress-invalid_mask_not_contiguous_1.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(ip_address_range((192,168,0,0),(255,253,0,0)))
- generate(c, "ipaddress-invalid_mask_not_contiguous_2.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(ip_address_range((0,0,0,0),(0x40,0,0,0)))
- generate(c, "ipaddress-invalid_mask_not_contiguous_3.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(ip_address_range((192,0,0,0),(0xFF,0,0xFF,0)))
- generate(c, "ipaddress-invalid_mask_not_contiguous_4.pem")
- c = NameConstraintsGenerator()
- c.add_excluded(ip_address_range((192,168,5,0),(255,255,255,0)))
- generate(c, "ipaddress-excluded.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(ip_address_range((192,168,0,0),(255,255,0,0)))
- c.add_permitted(ip_address_range((1,2,3,4,5,6,7,8,9,10,11,12,0,0,0,0),
- (255,255,255,255,255,255,255,255,
- 255,255,255,255,0,0,0,0)))
- c.add_excluded(ip_address_range((0,0,0,0),(0,0,0,0)))
- c.add_excluded(ip_address_range((0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0),
- (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)))
- generate(c, "ipaddress-excludeall.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(ip_address_range((192,168,0,0),(255,255,255,0)))
- c.add_permitted(ip_address_range((192,168,5,0,0),(255,255,255,0,0),
- enforce_length=False))
- generate(c, "ipaddress-invalid_addr.pem")
- n_us = generate_names.NameGenerator()
- n_us.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'US')
- generate(n_us, "name-us.pem")
- n_us_az = copy.deepcopy(n_us)
- n_us_az.add_rdn().add_attr('stateOrProvinceName', 'UTF8', 'Arizona')
- generate(n_us_az, "name-us-arizona.pem")
- n_us_ca = copy.deepcopy(n_us)
- n_us_ca.add_rdn().add_attr('stateOrProvinceName', 'UTF8', 'California')
- generate(n_us_ca, "name-us-california.pem")
- n_us_ca_mountain_view = copy.deepcopy(n_us_ca)
- n_us_ca_mountain_view.add_rdn().add_attr(
- 'localityName', 'UTF8', 'Mountain View')
- generate(n_us_ca_mountain_view, "name-us-california-mountain_view.pem")
- n_jp = generate_names.NameGenerator()
- n_jp.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'JP')
- generate(n_jp, "name-jp.pem")
- n_jp_tokyo = copy.deepcopy(n_jp)
- n_jp_tokyo.add_rdn().add_attr(
- 'stateOrProvinceName', 'UTF8', '\xe6\x9d\xb1\xe4\xba\xac', 'FORMAT:UTF8')
- generate(n_jp_tokyo, "name-jp-tokyo.pem")
- n_us_az_foodotcom = copy.deepcopy(n_us_az)
- n_us_az_foodotcom.add_rdn().add_attr('commonName', 'UTF8', 'foo.com')
- generate(n_us_az_foodotcom, "name-us-arizona-foo.com.pem")
- n_us_az_permittedexamplecom = copy.deepcopy(n_us_az)
- n_us_az_permittedexamplecom.add_rdn().add_attr('commonName', 'UTF8',
- 'permitted.example.com')
- generate(n_us_az_permittedexamplecom,
- "name-us-arizona-permitted.example.com.pem")
- n_us_ca_permittedexamplecom = copy.deepcopy(n_us_ca)
- n_us_ca_permittedexamplecom.add_rdn().add_attr('commonName', 'UTF8',
- 'permitted.example.com')
- generate(n_us_ca_permittedexamplecom,
- "name-us-california-permitted.example.com.pem")
- n_us_az_ip1111 = copy.deepcopy(n_us_az)
- n_us_az_ip1111.add_rdn().add_attr('commonName', 'UTF8', '1.1.1.1')
- generate(n_us_az_ip1111, "name-us-arizona-1.1.1.1.pem")
- n_us_az_192_168_1_1 = copy.deepcopy(n_us_az)
- n_us_az_192_168_1_1.add_rdn().add_attr('commonName', 'UTF8', '192.168.1.1')
- generate(n_us_az_192_168_1_1, "name-us-arizona-192.168.1.1.pem")
- n_us_az_ipv6 = copy.deepcopy(n_us_az)
- n_us_az_ipv6.add_rdn().add_attr('commonName', 'UTF8',
- '102:304:506:708:90a:b0c::1')
- generate(n_us_az_ipv6, "name-us-arizona-ipv6.pem")
- n_us_ca_192_168_1_1 = copy.deepcopy(n_us_ca)
- n_us_ca_192_168_1_1.add_rdn().add_attr('commonName', 'UTF8', '192.168.1.1')
- generate(n_us_ca_192_168_1_1, "name-us-california-192.168.1.1.pem")
- n_us_az_email = copy.deepcopy(n_us_az)
- n_us_az_email.add_rdn().add_attr('emailAddress', 'IA5STRING',
- 'bar@example.com')
- generate(n_us_az_email, "name-us-arizona-email.pem")
- n_ca = generate_names.NameGenerator()
- n_ca.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'CA')
- generate(n_ca, "name-ca.pem")
- n_de = generate_names.NameGenerator()
- n_de.add_rdn().add_attr('countryName', 'PRINTABLESTRING', 'DE')
- generate(n_de, "name-de.pem")
- n_empty = generate_names.NameGenerator()
- generate(n_empty, "name-empty.pem")
- directoryname_constraints = NameConstraintsGenerator()
- directoryname_constraints.add_permitted(directory_name(n_us))
- directoryname_constraints.add_excluded(directory_name(n_us_ca))
- directoryname_constraints.add_permitted(directory_name(n_us_ca_mountain_view))
- directoryname_constraints.add_excluded(directory_name(n_de))
- directoryname_constraints.add_permitted(directory_name(n_jp_tokyo))
- generate(directoryname_constraints, "directoryname.pem")
- c = NameConstraintsGenerator()
- c.union_from(directoryname_constraints)
- c.union_from(dnsname_constraints)
- generate(c, "directoryname_and_dnsname.pem")
- c = NameConstraintsGenerator()
- c.union_from(directoryname_constraints)
- c.union_from(dnsname_constraints)
- c.union_from(ipaddress_constraints)
- generate(c, "directoryname_and_dnsname_and_ipaddress.pem")
- c = NameConstraintsGenerator()
- c.add_excluded(directory_name(n_us_ca))
- generate(c, "directoryname-excluded.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(directory_name(n_us))
- c.add_excluded(directory_name(n_empty))
- generate(c, "directoryname-excludeall.pem")
- san = SubjectAltNameGenerator()
- san.add_name(dns_name("permitted.example.com"))
- san.add_name(ip_address((192,168,1,2)))
- san.add_name(directory_name(n_us_az))
- generate(san, "san-permitted.pem")
- san2 = copy.deepcopy(san)
- san2.add_name(
- dns_name("foo.stillnotpermitted.excluded.permitted.example.com"))
- generate(san2, "san-excluded-dnsname.pem")
- san2 = copy.deepcopy(san)
- san2.add_name(ip_address((192,168,5,5)))
- generate(san2, "san-excluded-ipaddress.pem")
- san2 = copy.deepcopy(san)
- san2.add_name(directory_name(n_us_ca_mountain_view))
- generate(san2, "san-excluded-directoryname.pem")
- san = SubjectAltNameGenerator()
- san.add_name(other_name())
- generate(san, "san-othername.pem")
- san = SubjectAltNameGenerator()
- san.add_name(rfc822_name("foo@example.com"))
- generate(san, "san-rfc822name.pem")
- san = SubjectAltNameGenerator()
- san.add_name(dns_name("foo.example.com"))
- generate(san, "san-dnsname.pem")
- san = SubjectAltNameGenerator()
- san.add_name(x400_address())
- generate(san, "san-x400address.pem")
- san = SubjectAltNameGenerator()
- san.add_name(directory_name(n_us))
- generate(san, "san-directoryname.pem")
- san = SubjectAltNameGenerator()
- san.add_name(uniform_resource_identifier('http://example.com'))
- generate(san, "san-uri.pem")
- san = SubjectAltNameGenerator()
- san.add_name(ip_address((192,168,6,7)))
- generate(san, "san-ipaddress4.pem")
- san = SubjectAltNameGenerator()
- san.add_name(ip_address((0xFE, 0x80, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12,
- 13, 14)))
- generate(san, "san-ipaddress6.pem")
- san = SubjectAltNameGenerator()
- san.add_name(registered_id("1.2.3.4"))
- generate(san, "san-registeredid.pem")
- san = SubjectAltNameGenerator()
- generate(san, "san-invalid-empty.pem")
- san = SubjectAltNameGenerator()
- san.add_name(ip_address((192,168,0,5,0), enforce_length=False))
- generate(san, "san-invalid-ipaddress.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(other_name())
- generate(c, "othername-permitted.pem")
- c = NameConstraintsGenerator()
- c.add_excluded(other_name())
- generate(c, "othername-excluded.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(rfc822_name("foo@example.com"))
- generate(c, "rfc822name-permitted.pem")
- c = NameConstraintsGenerator()
- c.add_excluded(rfc822_name("foo@example.com"))
- generate(c, "rfc822name-excluded.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(x400_address())
- generate(c, "x400address-permitted.pem")
- c = NameConstraintsGenerator()
- c.add_excluded(x400_address())
- generate(c, "x400address-excluded.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(edi_party_name())
- generate(c, "edipartyname-permitted.pem")
- c = NameConstraintsGenerator()
- c.add_excluded(edi_party_name())
- generate(c, "edipartyname-excluded.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(uniform_resource_identifier("http://example.com"))
- generate(c, "uri-permitted.pem")
- c = NameConstraintsGenerator()
- c.add_excluded(uniform_resource_identifier("http://example.com"))
- generate(c, "uri-excluded.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(registered_id("1.2.3.4"))
- generate(c, "registeredid-permitted.pem")
- c = NameConstraintsGenerator()
- c.add_excluded(registered_id("1.2.3.4"))
- generate(c, "registeredid-excluded.pem")
- c = NameConstraintsGenerator()
- generate(c, "invalid-no_subtrees.pem")
- c = NameConstraintsGenerator(force_permitted_sequence=True)
- generate(c, "invalid-empty_permitted_subtree.pem")
- c = NameConstraintsGenerator(force_excluded_sequence=True)
- generate(c, "invalid-empty_excluded_subtree.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(with_min_max(dns_name("permitted.example.com"), minimum=0))
- generate(c, "dnsname-with_min_0.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(with_min_max(dns_name("permitted.example.com"), minimum=1))
- generate(c, "dnsname-with_min_1.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(with_min_max(
- dns_name("permitted.example.com"), minimum=0, maximum=2))
- generate(c, "dnsname-with_min_0_and_max.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(with_min_max(
- dns_name("permitted.example.com"), minimum=1, maximum=2))
- generate(c, "dnsname-with_min_1_and_max.pem")
- c = NameConstraintsGenerator()
- c.add_permitted(with_min_max(dns_name("permitted.example.com"), maximum=2))
- generate(c, "dnsname-with_max.pem")
- if __name__ == '__main__':
- main()
|