1# This file is dual licensed under the terms of the Apache License, Version 2# 2.0, and the BSD License. See the LICENSE file in the root of this repository 3# for complete details. 4 5from __future__ import absolute_import, division, print_function 6 7from cryptography.hazmat._oid import ObjectIdentifier 8from cryptography.hazmat.primitives import hashes 9 10 11class ExtensionOID(object): 12 SUBJECT_DIRECTORY_ATTRIBUTES = ObjectIdentifier("2.5.29.9") 13 SUBJECT_KEY_IDENTIFIER = ObjectIdentifier("2.5.29.14") 14 KEY_USAGE = ObjectIdentifier("2.5.29.15") 15 SUBJECT_ALTERNATIVE_NAME = ObjectIdentifier("2.5.29.17") 16 ISSUER_ALTERNATIVE_NAME = ObjectIdentifier("2.5.29.18") 17 BASIC_CONSTRAINTS = ObjectIdentifier("2.5.29.19") 18 NAME_CONSTRAINTS = ObjectIdentifier("2.5.29.30") 19 CRL_DISTRIBUTION_POINTS = ObjectIdentifier("2.5.29.31") 20 CERTIFICATE_POLICIES = ObjectIdentifier("2.5.29.32") 21 POLICY_MAPPINGS = ObjectIdentifier("2.5.29.33") 22 AUTHORITY_KEY_IDENTIFIER = ObjectIdentifier("2.5.29.35") 23 POLICY_CONSTRAINTS = ObjectIdentifier("2.5.29.36") 24 EXTENDED_KEY_USAGE = ObjectIdentifier("2.5.29.37") 25 FRESHEST_CRL = ObjectIdentifier("2.5.29.46") 26 INHIBIT_ANY_POLICY = ObjectIdentifier("2.5.29.54") 27 ISSUING_DISTRIBUTION_POINT = ObjectIdentifier("2.5.29.28") 28 AUTHORITY_INFORMATION_ACCESS = ObjectIdentifier("1.3.6.1.5.5.7.1.1") 29 SUBJECT_INFORMATION_ACCESS = ObjectIdentifier("1.3.6.1.5.5.7.1.11") 30 OCSP_NO_CHECK = ObjectIdentifier("1.3.6.1.5.5.7.48.1.5") 31 TLS_FEATURE = ObjectIdentifier("1.3.6.1.5.5.7.1.24") 32 CRL_NUMBER = ObjectIdentifier("2.5.29.20") 33 DELTA_CRL_INDICATOR = ObjectIdentifier("2.5.29.27") 34 PRECERT_SIGNED_CERTIFICATE_TIMESTAMPS = ( 35 ObjectIdentifier("1.3.6.1.4.1.11129.2.4.2") 36 ) 37 PRECERT_POISON = ( 38 ObjectIdentifier("1.3.6.1.4.1.11129.2.4.3") 39 ) 40 41 42class OCSPExtensionOID(object): 43 NONCE = ObjectIdentifier("1.3.6.1.5.5.7.48.1.2") 44 45 46class CRLEntryExtensionOID(object): 47 CERTIFICATE_ISSUER = ObjectIdentifier("2.5.29.29") 48 CRL_REASON = ObjectIdentifier("2.5.29.21") 49 INVALIDITY_DATE = ObjectIdentifier("2.5.29.24") 50 51 52class NameOID(object): 53 COMMON_NAME = ObjectIdentifier("2.5.4.3") 54 COUNTRY_NAME = ObjectIdentifier("2.5.4.6") 55 LOCALITY_NAME = ObjectIdentifier("2.5.4.7") 56 STATE_OR_PROVINCE_NAME = ObjectIdentifier("2.5.4.8") 57 STREET_ADDRESS = ObjectIdentifier("2.5.4.9") 58 ORGANIZATION_NAME = ObjectIdentifier("2.5.4.10") 59 ORGANIZATIONAL_UNIT_NAME = ObjectIdentifier("2.5.4.11") 60 SERIAL_NUMBER = ObjectIdentifier("2.5.4.5") 61 SURNAME = ObjectIdentifier("2.5.4.4") 62 GIVEN_NAME = ObjectIdentifier("2.5.4.42") 63 TITLE = ObjectIdentifier("2.5.4.12") 64 GENERATION_QUALIFIER = ObjectIdentifier("2.5.4.44") 65 X500_UNIQUE_IDENTIFIER = ObjectIdentifier("2.5.4.45") 66 DN_QUALIFIER = ObjectIdentifier("2.5.4.46") 67 PSEUDONYM = ObjectIdentifier("2.5.4.65") 68 USER_ID = ObjectIdentifier("0.9.2342.19200300.100.1.1") 69 DOMAIN_COMPONENT = ObjectIdentifier("0.9.2342.19200300.100.1.25") 70 EMAIL_ADDRESS = ObjectIdentifier("1.2.840.113549.1.9.1") 71 JURISDICTION_COUNTRY_NAME = ObjectIdentifier("1.3.6.1.4.1.311.60.2.1.3") 72 JURISDICTION_LOCALITY_NAME = ObjectIdentifier("1.3.6.1.4.1.311.60.2.1.1") 73 JURISDICTION_STATE_OR_PROVINCE_NAME = ObjectIdentifier( 74 "1.3.6.1.4.1.311.60.2.1.2" 75 ) 76 BUSINESS_CATEGORY = ObjectIdentifier("2.5.4.15") 77 POSTAL_ADDRESS = ObjectIdentifier("2.5.4.16") 78 POSTAL_CODE = ObjectIdentifier("2.5.4.17") 79 80 81class SignatureAlgorithmOID(object): 82 RSA_WITH_MD5 = ObjectIdentifier("1.2.840.113549.1.1.4") 83 RSA_WITH_SHA1 = ObjectIdentifier("1.2.840.113549.1.1.5") 84 # This is an alternate OID for RSA with SHA1 that is occasionally seen 85 _RSA_WITH_SHA1 = ObjectIdentifier("1.3.14.3.2.29") 86 RSA_WITH_SHA224 = ObjectIdentifier("1.2.840.113549.1.1.14") 87 RSA_WITH_SHA256 = ObjectIdentifier("1.2.840.113549.1.1.11") 88 RSA_WITH_SHA384 = ObjectIdentifier("1.2.840.113549.1.1.12") 89 RSA_WITH_SHA512 = ObjectIdentifier("1.2.840.113549.1.1.13") 90 RSASSA_PSS = ObjectIdentifier("1.2.840.113549.1.1.10") 91 ECDSA_WITH_SHA1 = ObjectIdentifier("1.2.840.10045.4.1") 92 ECDSA_WITH_SHA224 = ObjectIdentifier("1.2.840.10045.4.3.1") 93 ECDSA_WITH_SHA256 = ObjectIdentifier("1.2.840.10045.4.3.2") 94 ECDSA_WITH_SHA384 = ObjectIdentifier("1.2.840.10045.4.3.3") 95 ECDSA_WITH_SHA512 = ObjectIdentifier("1.2.840.10045.4.3.4") 96 DSA_WITH_SHA1 = ObjectIdentifier("1.2.840.10040.4.3") 97 DSA_WITH_SHA224 = ObjectIdentifier("2.16.840.1.101.3.4.3.1") 98 DSA_WITH_SHA256 = ObjectIdentifier("2.16.840.1.101.3.4.3.2") 99 100 101_SIG_OIDS_TO_HASH = { 102 SignatureAlgorithmOID.RSA_WITH_MD5: hashes.MD5(), 103 SignatureAlgorithmOID.RSA_WITH_SHA1: hashes.SHA1(), 104 SignatureAlgorithmOID._RSA_WITH_SHA1: hashes.SHA1(), 105 SignatureAlgorithmOID.RSA_WITH_SHA224: hashes.SHA224(), 106 SignatureAlgorithmOID.RSA_WITH_SHA256: hashes.SHA256(), 107 SignatureAlgorithmOID.RSA_WITH_SHA384: hashes.SHA384(), 108 SignatureAlgorithmOID.RSA_WITH_SHA512: hashes.SHA512(), 109 SignatureAlgorithmOID.ECDSA_WITH_SHA1: hashes.SHA1(), 110 SignatureAlgorithmOID.ECDSA_WITH_SHA224: hashes.SHA224(), 111 SignatureAlgorithmOID.ECDSA_WITH_SHA256: hashes.SHA256(), 112 SignatureAlgorithmOID.ECDSA_WITH_SHA384: hashes.SHA384(), 113 SignatureAlgorithmOID.ECDSA_WITH_SHA512: hashes.SHA512(), 114 SignatureAlgorithmOID.DSA_WITH_SHA1: hashes.SHA1(), 115 SignatureAlgorithmOID.DSA_WITH_SHA224: hashes.SHA224(), 116 SignatureAlgorithmOID.DSA_WITH_SHA256: hashes.SHA256() 117} 118 119 120class ExtendedKeyUsageOID(object): 121 SERVER_AUTH = ObjectIdentifier("1.3.6.1.5.5.7.3.1") 122 CLIENT_AUTH = ObjectIdentifier("1.3.6.1.5.5.7.3.2") 123 CODE_SIGNING = ObjectIdentifier("1.3.6.1.5.5.7.3.3") 124 EMAIL_PROTECTION = ObjectIdentifier("1.3.6.1.5.5.7.3.4") 125 TIME_STAMPING = ObjectIdentifier("1.3.6.1.5.5.7.3.8") 126 OCSP_SIGNING = ObjectIdentifier("1.3.6.1.5.5.7.3.9") 127 ANY_EXTENDED_KEY_USAGE = ObjectIdentifier("2.5.29.37.0") 128 129 130class AuthorityInformationAccessOID(object): 131 CA_ISSUERS = ObjectIdentifier("1.3.6.1.5.5.7.48.2") 132 OCSP = ObjectIdentifier("1.3.6.1.5.5.7.48.1") 133 134 135class CertificatePoliciesOID(object): 136 CPS_QUALIFIER = ObjectIdentifier("1.3.6.1.5.5.7.2.1") 137 CPS_USER_NOTICE = ObjectIdentifier("1.3.6.1.5.5.7.2.2") 138 ANY_POLICY = ObjectIdentifier("2.5.29.32.0") 139 140 141_OID_NAMES = { 142 NameOID.COMMON_NAME: "commonName", 143 NameOID.COUNTRY_NAME: "countryName", 144 NameOID.LOCALITY_NAME: "localityName", 145 NameOID.STATE_OR_PROVINCE_NAME: "stateOrProvinceName", 146 NameOID.STREET_ADDRESS: "streetAddress", 147 NameOID.ORGANIZATION_NAME: "organizationName", 148 NameOID.ORGANIZATIONAL_UNIT_NAME: "organizationalUnitName", 149 NameOID.SERIAL_NUMBER: "serialNumber", 150 NameOID.SURNAME: "surname", 151 NameOID.GIVEN_NAME: "givenName", 152 NameOID.TITLE: "title", 153 NameOID.GENERATION_QUALIFIER: "generationQualifier", 154 NameOID.X500_UNIQUE_IDENTIFIER: "x500UniqueIdentifier", 155 NameOID.DN_QUALIFIER: "dnQualifier", 156 NameOID.PSEUDONYM: "pseudonym", 157 NameOID.USER_ID: "userID", 158 NameOID.DOMAIN_COMPONENT: "domainComponent", 159 NameOID.EMAIL_ADDRESS: "emailAddress", 160 NameOID.JURISDICTION_COUNTRY_NAME: "jurisdictionCountryName", 161 NameOID.JURISDICTION_LOCALITY_NAME: "jurisdictionLocalityName", 162 NameOID.JURISDICTION_STATE_OR_PROVINCE_NAME: ( 163 "jurisdictionStateOrProvinceName" 164 ), 165 NameOID.BUSINESS_CATEGORY: "businessCategory", 166 NameOID.POSTAL_ADDRESS: "postalAddress", 167 NameOID.POSTAL_CODE: "postalCode", 168 169 SignatureAlgorithmOID.RSA_WITH_MD5: "md5WithRSAEncryption", 170 SignatureAlgorithmOID.RSA_WITH_SHA1: "sha1WithRSAEncryption", 171 SignatureAlgorithmOID.RSA_WITH_SHA224: "sha224WithRSAEncryption", 172 SignatureAlgorithmOID.RSA_WITH_SHA256: "sha256WithRSAEncryption", 173 SignatureAlgorithmOID.RSA_WITH_SHA384: "sha384WithRSAEncryption", 174 SignatureAlgorithmOID.RSA_WITH_SHA512: "sha512WithRSAEncryption", 175 SignatureAlgorithmOID.RSASSA_PSS: "RSASSA-PSS", 176 SignatureAlgorithmOID.ECDSA_WITH_SHA1: "ecdsa-with-SHA1", 177 SignatureAlgorithmOID.ECDSA_WITH_SHA224: "ecdsa-with-SHA224", 178 SignatureAlgorithmOID.ECDSA_WITH_SHA256: "ecdsa-with-SHA256", 179 SignatureAlgorithmOID.ECDSA_WITH_SHA384: "ecdsa-with-SHA384", 180 SignatureAlgorithmOID.ECDSA_WITH_SHA512: "ecdsa-with-SHA512", 181 SignatureAlgorithmOID.DSA_WITH_SHA1: "dsa-with-sha1", 182 SignatureAlgorithmOID.DSA_WITH_SHA224: "dsa-with-sha224", 183 SignatureAlgorithmOID.DSA_WITH_SHA256: "dsa-with-sha256", 184 ExtendedKeyUsageOID.SERVER_AUTH: "serverAuth", 185 ExtendedKeyUsageOID.CLIENT_AUTH: "clientAuth", 186 ExtendedKeyUsageOID.CODE_SIGNING: "codeSigning", 187 ExtendedKeyUsageOID.EMAIL_PROTECTION: "emailProtection", 188 ExtendedKeyUsageOID.TIME_STAMPING: "timeStamping", 189 ExtendedKeyUsageOID.OCSP_SIGNING: "OCSPSigning", 190 ExtensionOID.SUBJECT_DIRECTORY_ATTRIBUTES: "subjectDirectoryAttributes", 191 ExtensionOID.SUBJECT_KEY_IDENTIFIER: "subjectKeyIdentifier", 192 ExtensionOID.KEY_USAGE: "keyUsage", 193 ExtensionOID.SUBJECT_ALTERNATIVE_NAME: "subjectAltName", 194 ExtensionOID.ISSUER_ALTERNATIVE_NAME: "issuerAltName", 195 ExtensionOID.BASIC_CONSTRAINTS: "basicConstraints", 196 ExtensionOID.PRECERT_SIGNED_CERTIFICATE_TIMESTAMPS: ( 197 "signedCertificateTimestampList" 198 ), 199 CRLEntryExtensionOID.CRL_REASON: "cRLReason", 200 CRLEntryExtensionOID.INVALIDITY_DATE: "invalidityDate", 201 CRLEntryExtensionOID.CERTIFICATE_ISSUER: "certificateIssuer", 202 ExtensionOID.NAME_CONSTRAINTS: "nameConstraints", 203 ExtensionOID.CRL_DISTRIBUTION_POINTS: "cRLDistributionPoints", 204 ExtensionOID.CERTIFICATE_POLICIES: "certificatePolicies", 205 ExtensionOID.POLICY_MAPPINGS: "policyMappings", 206 ExtensionOID.AUTHORITY_KEY_IDENTIFIER: "authorityKeyIdentifier", 207 ExtensionOID.POLICY_CONSTRAINTS: "policyConstraints", 208 ExtensionOID.EXTENDED_KEY_USAGE: "extendedKeyUsage", 209 ExtensionOID.FRESHEST_CRL: "freshestCRL", 210 ExtensionOID.INHIBIT_ANY_POLICY: "inhibitAnyPolicy", 211 ExtensionOID.ISSUING_DISTRIBUTION_POINT: ( 212 "issuingDistributionPoint" 213 ), 214 ExtensionOID.AUTHORITY_INFORMATION_ACCESS: "authorityInfoAccess", 215 ExtensionOID.SUBJECT_INFORMATION_ACCESS: "subjectInfoAccess", 216 ExtensionOID.OCSP_NO_CHECK: "OCSPNoCheck", 217 ExtensionOID.CRL_NUMBER: "cRLNumber", 218 ExtensionOID.DELTA_CRL_INDICATOR: "deltaCRLIndicator", 219 ExtensionOID.TLS_FEATURE: "TLSFeature", 220 AuthorityInformationAccessOID.OCSP: "OCSP", 221 AuthorityInformationAccessOID.CA_ISSUERS: "caIssuers", 222 CertificatePoliciesOID.CPS_QUALIFIER: "id-qt-cps", 223 CertificatePoliciesOID.CPS_USER_NOTICE: "id-qt-unotice", 224 OCSPExtensionOID.NONCE: "OCSPNonce", 225} 226