3737PRODUCTION_NODE_URL_REST = "https://on.dcl.csa-iot.org"
3838TEST_NODE_URL_REST = "https://on.test-net.dcl.csa-iot.org"
3939
40+ MATTER_CERT_CA_SUBJECT = "MFIxDDAKBgNVBAoMA0NTQTEsMCoGA1UEAwwjTWF0dGVyIENlcnRpZmljYXRpb24gYW5kIFRlc3RpbmcgQ0ExFDASBgorBgEEAYKifAIBDARDNUEw"
41+ MATTER_CERT_CA_SUBJECT_KEY_ID = "97:E4:69:D0:C5:04:14:C2:6F:C7:01:F7:7E:94:77:39:09:8D:F6:A5"
42+
4043
4144def parse_paa_root_certs (cmdpipe , paa_list ):
4245 """
@@ -73,13 +76,14 @@ def parse_paa_root_certs(cmdpipe, paa_list):
7376 else :
7477 if b': ' in line :
7578 key , value = line .split (b': ' )
76- result [key .strip (b' -' ).decode ("utf-8" )] = value .strip ().decode ("utf-8" )
79+ result [key .strip (b' -' ).decode ("utf-8" )
80+ ] = value .strip ().decode ("utf-8" )
7781 parse_paa_root_certs .counter += 1
7882 if parse_paa_root_certs .counter % 2 == 0 :
7983 paa_list .append (copy .deepcopy (result ))
8084
8185
82- def write_paa_root_cert (certificate , subject ):
86+ def write_cert (certificate , subject ):
8387 filename = 'dcld_mirror_' + \
8488 re .sub ('[^a-zA-Z0-9_-]' , '' , re .sub ('[=, ]' , '_' , subject ))
8589 with open (filename + '.pem' , 'w+' ) as outfile :
@@ -93,7 +97,8 @@ def write_paa_root_cert(certificate, subject):
9397 serialization .Encoding .DER )
9498 outfile .write (der_certificate )
9599 except (IOError , ValueError ) as e :
96- print (f"ERROR: Failed to convert { filename + '.pem' } { str (e )} )
100+ print (
101+ f"ERROR: Failed to convert { filename + '.pem' } { str (e )} )
97102
98103
99104def parse_paa_root_cert_from_dcld (cmdpipe ):
@@ -133,7 +138,38 @@ def use_dcld(dcld, production, cmdlist):
133138@optgroup .option ('--paa-trust-store-path' , default = 'paa-root-certs' , type = str , metavar = 'PATH' , help = "PAA trust store path (default: paa-root-certs)" )
134139def main (use_main_net_dcld , use_test_net_dcld , use_main_net_http , use_test_net_http , paa_trust_store_path ):
135140 """DCL PAA mirroring tools"""
141+ fetch_paa_certs (use_main_net_dcld , use_test_net_dcld , use_main_net_http , use_test_net_http , paa_trust_store_path )
142+
143+
144+ def get_cert_from_rest (rest_node_url , subject , subject_key_id ):
145+ response = requests .get (
146+ f"{ rest_node_url } { subject } { subject_key_id } ).json ()["approvedCertificates" ]["certs" ][0 ]
147+ certificate = response ["pemCert" ].rstrip ("\n " )
148+ subject = response ["subjectAsText" ]
149+ return certificate , subject
150+
151+
152+ def fetch_cd_signing_certs (store_path ):
153+ ''' Only supports using main net http currently.'''
154+ rest_node_url = PRODUCTION_NODE_URL_REST
155+ os .makedirs (store_path , exist_ok = True )
156+ original_dir = os .getcwd ()
157+ os .chdir (store_path )
136158
159+ cd_signer_ids = requests .get (
160+ f"{ rest_node_url } { MATTER_CERT_CA_SUBJECT } { MATTER_CERT_CA_SUBJECT_KEY_ID } ).json ()['childCertificates' ]['certIds' ]
161+ for signer in cd_signer_ids :
162+ subject = signer ['subject' ]
163+ subject_key_id = signer ['subjectKeyId' ]
164+ certificate , subject = get_cert_from_rest (rest_node_url , subject , subject_key_id )
165+
166+ print (f"Downloaded CD signing cert with subject: { subject } )
167+ write_cert (certificate , subject )
168+
169+ os .chdir (original_dir )
170+
171+
172+ def fetch_paa_certs (use_main_net_dcld , use_test_net_dcld , use_main_net_http , use_test_net_http , paa_trust_store_path ):
137173 production = False
138174 dcld = use_test_net_dcld
139175
@@ -148,36 +184,43 @@ def main(use_main_net_dcld, use_test_net_dcld, use_main_net_http, use_test_net_h
148184 rest_node_url = PRODUCTION_NODE_URL_REST if production else TEST_NODE_URL_REST
149185
150186 os .makedirs (paa_trust_store_path , exist_ok = True )
187+ original_dir = os .getcwd ()
151188 os .chdir (paa_trust_store_path )
152189
153190 if use_rest :
154- paa_list = requests .get (f"{ rest_node_url } ).json ()["approvedRootCertificates" ]["certs" ]
191+ paa_list = requests .get (
192+ f"{ rest_node_url } ).json ()["approvedRootCertificates" ]["certs" ]
155193 else :
156194 cmdlist = ['query' , 'pki' , 'all-x509-root-certs' ]
157195
158- cmdpipe = subprocess .Popen (use_dcld (dcld , production , cmdlist ), stdout = subprocess .PIPE , stderr = subprocess .PIPE )
196+ cmdpipe = subprocess .Popen (use_dcld (
197+ dcld , production , cmdlist ), stdout = subprocess .PIPE , stderr = subprocess .PIPE )
159198
160199 paa_list = []
161200 parse_paa_root_certs .counter = 0
162201 parse_paa_root_certs (cmdpipe , paa_list )
163202
164203 for paa in paa_list :
204+ if paa ['subject' ] == MATTER_CERT_CA_SUBJECT and paa ['subjectKeyId' ] == MATTER_CERT_CA_SUBJECT_KEY_ID :
205+ # Don't include the CD signing cert as a PAA root.
206+ continue
165207 if use_rest :
166- response = requests .get (
167- f"{ rest_node_url } { paa ['subject' ]} { paa ['subjectKeyId' ]} ).json ()["approvedCertificates" ]["certs" ][0 ]
168- certificate = response ["pemCert" ]
169- subject = response ["subjectAsText" ]
208+ certificate , subject = get_cert_from_rest (rest_node_url , paa ['subject' ], paa ['subjectKeyId' ])
170209 else :
171- cmdlist = ['query' , 'pki' , 'x509-cert' , '-u' , paa ['subject' ], '-k' , paa ['subjectKeyId' ]]
210+ cmdlist = ['query' , 'pki' , 'x509-cert' , '-u' ,
211+ paa ['subject' ], '-k' , paa ['subjectKeyId' ]]
172212
173- cmdpipe = subprocess .Popen (use_dcld (dcld , production , cmdlist ), stdout = subprocess .PIPE , stderr = subprocess .PIPE )
213+ cmdpipe = subprocess .Popen (use_dcld (
214+ dcld , production , cmdlist ), stdout = subprocess .PIPE , stderr = subprocess .PIPE )
174215
175216 (certificate , subject ) = parse_paa_root_cert_from_dcld (cmdpipe )
176217
177218 certificate = certificate .rstrip ('\n ' )
178219
179- print (f"Downloaded certificate with subject: { subject } )
180- write_paa_root_cert (certificate , subject )
220+ print (f"Downloaded PAA certificate with subject: { subject } )
221+ write_cert (certificate , subject )
222+
223+ os .chdir (original_dir )
181224
182225
183226if __name__ == "__main__" :
0 commit comments