python - 将证书签名请求转换为类型 cryptography.x509.base.CertificateSigningRequestBuilder 以便为签名做好准备

Question

步骤 1. 我使用 cryptography 生成了证书签名请求 (csr)图书馆。

from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives import serialization


csr = x509.CertificateSigningRequestBuilder().subject_name(x509.Name([
        # Provide various details about who we are.

        x509.NameAttribute(NameOID.COUNTRY_NAME, u"US"),
        x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, u"California")
    ])).add_extension(
        x509.SubjectAlternativeName([
            # Describe what sites we want this certificate for.
            x509.DNSName(u"mysite.com"),
        ]),
        critical=False
    )

type(csr) = cryptography.x509.base.CertificateSigningRequestBuilder

第 2 步。然后我签署了证书

cert = csr.sign(private_key, hashes.SHA256())

它现在具有以下类型:

type(cert) = CertificateSigningRequest

Step 3. csr需要序列化，可以将数据写入文件保存或通过网络发送

serialized = cert.public_bytes(
        serialization.Encoding.PEM
    )

类型:

type(serialized) = bytes

保存证书

with open('cert_name.cert', 'wb') as f:
        f.write(serialized)

当我需要读取证书以获取另一个签名时，就会出现问题。

with open('cert_name.cert', 'rb') as f:
    load_cert = f.read()

type(load_cert) = byte

我猜，与第 2 步一样， load_cert需要是 cryptography.x509.base.CertificateSigningRequestBuilder 类型进行签名，然后，与步骤 3 一样，它将被序列化以再次保存。
如何转换 load_cert输入 cryptography.x509.base.CertificateSigningRequestBuilder准备签名。或者有没有人可以替代这里描述的过程？

Answer 1

我不确定你为什么要多次签署 CSR，它应该由你签署一次，然后由 CA 验证，CA 会给你一个证书。 This tutorial可能会为您解决问题。
要反序列化您的 CSR，您应该执行以下操作:

with open('cert_name.cert', 'rb') as f:
  data = f.read()
load_cert = cryptography.x509.load_pem_x509_csr(data)

您可以验证反序列化的 CSR 是否已经具有以下签名:

load_cert.is_signature_valid