From 02b24cdda98db4f130572752d69c531d91f2eb67 Mon Sep 17 00:00:00 2001
From: Matt Prahl <mprahl@redhat.com>
Date: Fri, 23 Sep 2016 11:41:28 -0400
Subject: [PATCH] Replace generate_localhost_cert.sh with `python manage.py
 generatelocalhostcert`

---
 Dockerfile                 |  2 +-
 Vagrantfile                |  2 +-
 generate_localhost_cert.sh |  3 ---
 manage.py                  | 37 +++++++++++++++++++++++++++++++++++++
 4 files changed, 39 insertions(+), 5 deletions(-)
 delete mode 100755 generate_localhost_cert.sh

diff --git a/Dockerfile b/Dockerfile
index c5bf9f13..7f04e0fb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,5 +12,5 @@ COPY koji.conf /etc/rida/
 
 COPY . /opt/fm-orchestrator/
 
-RUN python2 ./manage.py upgradedb && ./generate_localhost_cert.sh
+RUN python2 ./manage.py upgradedb && python2 manage.py generatelocalhostcert
 CMD ["python2", "manage.py", "runssl"]
diff --git a/Vagrantfile b/Vagrantfile
index 786f05e5..332b668c 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -9,7 +9,7 @@ $script = <<SCRIPT
     mkdir -p /etc/rida
     cp -av koji.conf /etc/rida/
     python manage.py upgradedb
-    ./generate_localhost_cert.sh
+    python manage.py generatelocalhostcert
 SCRIPT
 
 Vagrant.configure("2") do |config|
diff --git a/generate_localhost_cert.sh b/generate_localhost_cert.sh
deleted file mode 100755
index 0ffe5dc8..00000000
--- a/generate_localhost_cert.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/bash
-
-openssl req -subj '/CN=localhost/O=My Company Name LTD./C=US' -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout server.key -out server.crt
diff --git a/manage.py b/manage.py
index 7a2f7e71..0632802d 100644
--- a/manage.py
+++ b/manage.py
@@ -196,6 +196,43 @@ def gendevfedmsgcert(pki_dir='/opt/fm-orchestrator/pki', force=False):
                                 days=3650, digest='sha256'))
 
 
+@manager.command
+def generatelocalhostcert():
+    # Create a key pair for the message signing cert
+    from OpenSSL import crypto
+    cert_key = crypto.PKey()
+    cert_key.generate_key(crypto.TYPE_RSA, 2048)
+
+    with open('server.key', 'w') as cert_key_file:
+        cert_key_file.write(
+            crypto.dump_privatekey(crypto.FILETYPE_PEM, cert_key))
+
+    cert = crypto.X509()
+    msg_cert_subject = cert.get_subject()
+    msg_cert_subject.C = 'US'
+    msg_cert_subject.ST = 'MA'
+    msg_cert_subject.L = 'Boston'
+    msg_cert_subject.O = 'Development'
+    msg_cert_subject.CN = 'localhost'
+    cert.set_serial_number(2)
+    cert.gmtime_adj_notBefore(0)
+    cert.gmtime_adj_notAfter(315360000)  # 10 years
+    cert.set_issuer(cert.get_subject())
+    cert.set_pubkey(cert_key)
+    cert_extensions = [
+        crypto.X509Extension(
+            'keyUsage', True,
+            'digitalSignature, keyEncipherment, nonRepudiation'),
+        crypto.X509Extension('extendedKeyUsage', True, 'serverAuth'),
+    ]
+    cert.add_extensions(cert_extensions)
+    cert.sign(cert_key, 'sha256')
+
+    with open('server.crt', 'w') as cert_file:
+        cert_file.write(
+            crypto.dump_certificate(crypto.FILETYPE_PEM, cert))
+
+
 @manager.command
 def runssl(host=conf.host, port=conf.port, debug=False):
     """ Runs the Flask app with the HTTPS settings configured in config.py