56 lines
2.0 KiB
Python
56 lines
2.0 KiB
Python
import plistlib
|
|
|
|
from cryptography.hazmat.primitives import hashes
|
|
from cryptography.hazmat.primitives.serialization import pkcs7
|
|
from tests.helpers import issue_test_ca
|
|
|
|
from cert_portal.enrollment import export_pkcs12
|
|
from cert_portal.profile import (
|
|
PKCS12_PAYLOAD_TYPE,
|
|
build_unsigned_mobileconfig,
|
|
load_signing_identity,
|
|
sign_mobileconfig,
|
|
)
|
|
|
|
|
|
def test_unsigned_profile_embeds_pkcs12_and_password():
|
|
key, cert = issue_test_ca()
|
|
p12, password = export_pkcs12(key=key, certificate=cert, friendly_name="[email protected]")
|
|
unsigned = build_unsigned_mobileconfig(
|
|
identity_p12=p12,
|
|
identity_password=password,
|
|
display_name="User Certificate",
|
|
organization="Example",
|
|
identifier_prefix="com.example.cert-portal",
|
|
username="[email protected]",
|
|
)
|
|
profile = plistlib.loads(unsigned)
|
|
payloads = profile["PayloadContent"]
|
|
types = [p["PayloadType"] for p in payloads]
|
|
assert PKCS12_PAYLOAD_TYPE in types
|
|
assert "com.apple.security.scep" not in types
|
|
identity = next(p for p in payloads if p["PayloadType"] == PKCS12_PAYLOAD_TYPE)
|
|
assert identity["Password"] == password
|
|
assert identity["PayloadContent"] == p12
|
|
|
|
|
|
def test_signed_profile_is_cms_and_contains_plist(signing_p12):
|
|
key, cert = issue_test_ca()
|
|
p12, password = export_pkcs12(key=key, certificate=cert)
|
|
unsigned = build_unsigned_mobileconfig(
|
|
identity_p12=p12,
|
|
identity_password=password,
|
|
display_name="User Certificate",
|
|
organization="Example",
|
|
identifier_prefix="com.example.cert-portal",
|
|
username="[email protected]",
|
|
)
|
|
identity = load_signing_identity(signing_p12, "signer-secret")
|
|
signed = sign_mobileconfig(unsigned, identity)
|
|
assert signed != unsigned
|
|
assert signed[:1] == b"\x30" # DER SEQUENCE
|
|
assert b"com.apple.security.pkcs12" in signed
|
|
certs = pkcs7.load_der_pkcs7_certificates(signed)
|
|
fps = {c.fingerprint(hashes.SHA256()) for c in certs}
|
|
assert identity.certificate.fingerprint(hashes.SHA256()) in fps
|