sep2cert 0.1.0__py3-none-any.whl

sep2cert/__init__.py

@@ -0,0 +1,9 @@
+"""Useful functions for working with IEEE 2030.5 (SEP2)"""
+
+from .cert_id import get_certificate_lfdi
+from .version import __version__
+
+__all__ = [
+    "__version__",
+    "get_certificate_lfdi",
+]

sep2cert/__main__.py

@@ -0,0 +1,3 @@
+from .cli import app
+
+app()

sep2cert/cert_create.py

@@ -0,0 +1,459 @@
+import logging
+import uuid
+from datetime import datetime
+from pathlib import Path
+
+import asn1
+from cryptography import x509
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.hazmat.primitives.hashes import SHA256
+from cryptography.x509.oid import ExtensionOID, NameOID, ObjectIdentifier
+from dateutil import tz
+
+log = logging.getLogger(__name__)
+
+DEFAULT_OUTPUT = Path("certs")
+
+INDEF_EXPIRY = datetime(9999, 12, 31, 23, 59, 59, 0)  # As per standard
+
+ANY_POLICY_OID = ObjectIdentifier("2.5.29.32.0")  # OID for "X509v3 Any Policy"
+
+# IEEE 2030.5 device type assignments (Section 6.11.7.2)
+SEP2_DEV_GENERIC = ObjectIdentifier("1.3.6.1.4.1.40732.1.1")
+SEP2_DEV_MOBILE = ObjectIdentifier("1.3.6.1.4.1.40732.1.2")
+SEP2_DEV_POSTMANUF = ObjectIdentifier("1.3.6.1.4.1.40732.1.3")
+
+# IEEE 2030.5 policy assignments (Section 6.11.7.3)
+SEP2_TEST_CERT = ObjectIdentifier("1.3.6.1.4.1.40732.2.1")
+SEP2_SELFSIGNED = ObjectIdentifier("1.3.6.1.4.1.40732.2.2")
+SEP2_SERVPROV = ObjectIdentifier("1.3.6.1.4.1.40732.2.3")
+SEP2_BULK_CERT = ObjectIdentifier("1.3.6.1.4.1.40732.2.4")
+
+# HardwareModuleName (Section 6.11.7.4)
+SEP2_HARDWARE_MODULE_NAME = ObjectIdentifier("1.3.6.1.5.5.7.8.4")
+
+
+DEFAULT_MICA_POLICIES = [
+    SEP2_DEV_GENERIC,
+    SEP2_TEST_CERT,
+]
+
+
+DEFAULT_DEV_POLICIES = [
+    SEP2_DEV_GENERIC,
+    SEP2_TEST_CERT,
+    SEP2_SELFSIGNED,
+    SEP2_BULK_CERT,
+]
+
+
+def random_id() -> str:
+    return str(uuid.uuid4()).replace("-", "")[:10].upper()
+
+
+def generate_csr_file(key_file: Path, hostnames: list[str] | None = None) -> Path:
+    # Load the private key
+    with open(key_file, "rb") as fh:
+        pem_data = fh.read()
+        key = serialization.load_pem_private_key(
+            pem_data, password=None, backend=default_backend()
+        )
+
+    # CSR output file path
+    csr_file = key_file.with_suffix(".csr")
+
+    # Subject Alternative Names (SANs)
+    san_list = []
+    if hostnames:
+        msg = "Note that SEP2 Certificates do not require a hostname"
+        log.warning(msg)
+        for name in hostnames:
+            san = x509.DNSName(name)
+            san_list.append(san)
+
+    cb = x509.CertificateSigningRequestBuilder()
+    subject_name = ""
+    cb = cb.subject_name(x509.Name(subject_name))
+    if hostnames:
+        cb = cb.add_extension(
+            x509.SubjectAlternativeName(san_list),
+            critical=False,
+        )
+
+    csr = cb.sign(key, SHA256())
+
+    csr_pem = csr.public_bytes(serialization.Encoding.PEM)
+    with open(csr_file, "wb") as fh:
+        fh.write(csr_pem)
+        log.info("Created CSR at %s", csr_file)
+
+    return csr_file
+
+
+def generate_key(
+    key_file: Path | None = None,
+    generate_csr: bool = True,
+    hostnames: list[str] | None = None,
+) -> tuple[Path, Path | None]:
+    """Generate a Private Key and Certificate Signing Request (CSR)"""
+
+    if not key_file:
+        output_dir = DEFAULT_OUTPUT
+        output_dir.mkdir(exist_ok=True)
+        name = random_id()
+        key_file = output_dir / f"{name}.key"
+
+    key = ec.generate_private_key(ec.SECP256R1())
+    key_pem = key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+    with open(key_file, "wb") as fh:
+        fh.write(key_pem)
+        log.info("Created Key at %s", key_file)
+
+    csr_file = None
+    if generate_csr:
+        csr_file = generate_csr_file(key_file, hostnames=hostnames)
+
+    return key_file, csr_file
+
+
+def convert_pem_to_der(pem_file: Path, der_file: Path | None = None) -> Path:
+    """Convert a PEM file to DER Certificate"""
+    with open(pem_file, "rb") as fh:
+        cert_data = fh.read()
+    cert = x509.load_pem_x509_certificate(cert_data)
+    der_data = cert.public_bytes(encoding=serialization.Encoding.DER)
+
+    if not der_file:
+        der_file = pem_file.with_suffix(".cer")
+    with open(der_file, "wb") as fh:
+        fh.write(der_data)
+        log.info("Created %s from %s", der_file, pem_file)
+    return der_file
+
+
+def generate_serca(
+    key_file: Path,
+    cert_file: Path | None = None,
+    org_name: str = "Smart Energy",
+    country_name: str = "AU",
+) -> tuple[Path, Path]:
+    """Use a CSR and MICA key pair to generate a SEP2 Certificate"""
+
+    if not cert_file:
+        output_dir = key_file.parent
+        output_dir.mkdir(exist_ok=True)
+        if key_file.suffix == "pem":
+            cert_name = f"{key_file.stem}-serca.pem"
+        else:
+            cert_name = f"{key_file.stem}.pem"
+        cert_file = output_dir / cert_name
+
+    with open(key_file, "rb") as fh:
+        pem_data = fh.read()
+    key = serialization.load_pem_private_key(pem_data, password=None)
+
+    valid_from = datetime.now(tz=tz.UTC)
+    valid_to = INDEF_EXPIRY  # as per standard
+
+    policies = [x509.PolicyInformation(ANY_POLICY_OID, None)]
+
+    # Define the Subject Name
+    subject = x509.Name(
+        [
+            x509.NameAttribute(NameOID.COUNTRY_NAME, country_name),
+            x509.NameAttribute(NameOID.ORGANIZATION_NAME, org_name),
+            x509.NameAttribute(NameOID.COMMON_NAME, "IEEE 2030.5 Root"),
+            x509.NameAttribute(NameOID.SERIAL_NUMBER, "1"),
+        ]
+    )
+
+    # Generate a Subject Key Identifier (SKI)
+    ski = key.public_key().public_bytes(
+        encoding=serialization.Encoding.DER,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+
+    ski_digest = hashes.Hash(hashes.SHA1(), backend=default_backend())
+    ski_digest.update(ski)
+    ski_value = ski_digest.finalize()
+
+    cb = x509.CertificateBuilder()
+    cb = cb.subject_name(subject)
+    cb = cb.issuer_name(subject)
+    cb = cb.public_key(key.public_key())
+    cb = cb.serial_number(x509.random_serial_number())
+    cb = cb.not_valid_before(valid_from)
+    cb = cb.not_valid_after(valid_to)
+    cb = cb.add_extension(
+        x509.BasicConstraints(ca=True, path_length=None),
+        critical=True,
+    )
+    cb = cb.add_extension(
+        x509.KeyUsage(
+            key_agreement=False,
+            key_cert_sign=True,
+            crl_sign=True,
+            digital_signature=True,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            encipher_only=False,
+            decipher_only=False,
+        ),
+        critical=True,
+    )
+    cb = cb.add_extension(
+        x509.SubjectKeyIdentifier(ski_value),
+        critical=False,
+    )
+    cb = cb.add_extension(
+        x509.CertificatePolicies(policies=policies),
+        critical=True,
+    )
+    cert = cb.sign(key, SHA256())
+
+    cert_pem = cert.public_bytes(encoding=serialization.Encoding.PEM)
+    with open(cert_file, "wb") as fh:
+        fh.write(cert_pem)
+        log.info("Created SERCA %s", cert_file)
+
+    der_file = convert_pem_to_der(cert_file)
+
+    return cert_file, der_file
+
+
+def generate_mica(
+    csr_path: Path,
+    ca_cert_path: Path,
+    ca_key_path: Path,
+    cert_file: Path | None = None,
+    org_name: str = "Example Org Name",
+    country_name: str = "AU",
+    common_name: str = "IEEE 2030.5 MICA",
+    policy_oids: list[ObjectIdentifier] = DEFAULT_MICA_POLICIES,
+) -> tuple[Path, Path]:
+    """Use a CSR and MICA key pair to generate a SEP2 Certificate"""
+
+    with open(csr_path, "rb") as fh:
+        csr_data = fh.read()
+    csr = x509.load_pem_x509_csr(csr_data)
+
+    if not cert_file:
+        output_dir = csr_path.parent
+        output_dir.mkdir(exist_ok=True)
+        if csr_path.suffix == "pem":
+            cert_name = f"{csr_path.stem}-mica.pem"
+        else:
+            cert_name = f"{csr_path.stem}.pem"
+        cert_file = output_dir / cert_name
+
+    # Load certificate authority
+    with open(ca_cert_path, "rb") as fh:
+        ca_pem_data = fh.read()
+    ca_cert = x509.load_pem_x509_certificate(ca_pem_data)
+    with open(ca_key_path, "rb") as fh:
+        pem_data = fh.read()
+    ca_key = serialization.load_pem_private_key(pem_data, password=None)
+
+    valid_from = datetime.now(tz=tz.UTC)
+    valid_to = INDEF_EXPIRY  # as per standard
+
+    policies = [x509.PolicyInformation(oid, None) for oid in policy_oids]
+
+    # Define the Subject Name
+    subject = x509.Name(
+        [
+            x509.NameAttribute(NameOID.COUNTRY_NAME, country_name),
+            x509.NameAttribute(NameOID.ORGANIZATION_NAME, org_name),
+            x509.NameAttribute(NameOID.COMMON_NAME, common_name),
+            x509.NameAttribute(NameOID.SERIAL_NUMBER, "1"),
+        ]
+    )
+
+    # Generate a Subject Key Identifier (SKI)
+    ski = csr.public_key().public_bytes(
+        encoding=serialization.Encoding.DER,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+
+    ski_digest = hashes.Hash(hashes.SHA1(), backend=default_backend())
+    ski_digest.update(ski)
+    ski_value = ski_digest.finalize()
+
+    issuer_name = ca_cert.subject
+    iname = x509.Name(issuer_name)
+
+    cb = x509.CertificateBuilder()
+
+    cb = cb.subject_name(subject)
+    cb = cb.issuer_name(iname)
+    cb = cb.public_key(csr.public_key())
+    cb = cb.serial_number(x509.random_serial_number())
+    cb = cb.not_valid_before(valid_from)
+    cb = cb.not_valid_after(valid_to)
+    cb = cb.add_extension(
+        x509.BasicConstraints(ca=True, path_length=0),
+        critical=True,
+    )
+    cb = cb.add_extension(
+        x509.KeyUsage(
+            key_agreement=False,
+            key_cert_sign=True,
+            crl_sign=False,
+            digital_signature=True,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            encipher_only=False,
+            decipher_only=False,
+        ),
+        critical=True,
+    )
+    cb = cb.add_extension(
+        x509.SubjectKeyIdentifier(ski_value),
+        critical=False,
+    )
+    cb = cb.add_extension(
+        x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(
+            ca_cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier).value
+        ),
+        critical=False,
+    )
+    cb = cb.add_extension(
+        x509.CertificatePolicies(policies=policies),
+        critical=True,
+    )
+    cert = cb.sign(ca_key, SHA256())
+
+    cert_pem = cert.public_bytes(encoding=serialization.Encoding.PEM)
+    with open(cert_file, "wb") as fh:
+        fh.write(cert_pem)
+        fh.write(ca_pem_data)  # Append the signing certificate
+        log.info("Created MICA %s", cert_file)
+
+    der_file = convert_pem_to_der(cert_file)
+
+    return cert_file, der_file
+
+
+def generate_device_certificate(
+    csr_path: Path,
+    ca_cert_path: Path,
+    ca_key_path: Path,
+    pen: int,
+    hardware_serial_number: str,
+    cert_file: Path | None = None,
+    policy_oids: list[ObjectIdentifier] = DEFAULT_DEV_POLICIES,
+    valid_to: datetime | None = None,
+) -> Path:
+    """Use a CSR and Signing Certificate key pair to generate a SEP2 Certificate"""
+
+    if not cert_file:
+        output_dir = csr_path.parent
+        cert_name = f"{csr_path.stem}-cert.pem"
+        cert_file = output_dir / cert_name
+
+    with open(csr_path, "rb") as fh:
+        csr_data = fh.read()
+    csr = x509.load_pem_x509_csr(csr_data)
+    with open(ca_cert_path, "rb") as fh:
+        ca_pem_data = fh.read()
+    ca_cert = x509.load_pem_x509_certificate(ca_pem_data)
+    with open(ca_key_path, "rb") as fh:
+        pem_data = fh.read()
+    ca_key = serialization.load_pem_private_key(pem_data, password=None)
+    valid_from = datetime.now(tz=tz.UTC)
+
+    if valid_to and valid_to.year != 9999:
+        log.warning("Using a valid to year other than 9999 is a deviation from SEP2")
+    else:
+        valid_to = INDEF_EXPIRY  # as per standard
+
+    policies = [x509.PolicyInformation(oid, None) for oid in policy_oids]
+
+    hardware_type_oid = f"1.3.6.1.4.1.40732.{pen}.1"
+
+    # SAN OtherName encoder
+    encoder = asn1.Encoder()
+    encoder.start()
+    encoder.enter(asn1.Numbers.Sequence)
+    encoder.write(str(hardware_type_oid), asn1.Numbers.ObjectIdentifier)
+    encoder.write(str(hardware_serial_number), asn1.Numbers.OctetString)
+    encoder.leave()
+    hw_module_name = encoder.output()
+    hw_other_name = x509.OtherName(SEP2_HARDWARE_MODULE_NAME, hw_module_name)
+
+    # Load Subject Alt Names from CSR if they exist
+    sans = [hw_other_name]
+    try:
+        san_oid = ExtensionOID.SUBJECT_ALTERNATIVE_NAME
+        san_extension = csr.extensions.get_extension_for_oid(san_oid)
+        san = san_extension.value
+        log.warning("Specifying a SubjectAlternativeName is a deviation from SEP2")
+        sans.extend(san)
+    except x509.ExtensionNotFound:
+        pass
+
+    # Define the Subject Name
+    subject = x509.Name("")
+
+    issuer_name = ca_cert.subject
+    iname = x509.Name(issuer_name)
+
+    cb = x509.CertificateBuilder()
+    cb = cb.subject_name(subject)
+    cb = cb.issuer_name(iname)
+    cb = cb.public_key(csr.public_key())
+    cb = cb.serial_number(x509.random_serial_number())
+    cb = cb.not_valid_before(valid_from)
+    cb = cb.not_valid_after(valid_to)
+    cb = cb.add_extension(
+        x509.BasicConstraints(ca=False, path_length=None),
+        critical=True,
+    )
+    cb = cb.add_extension(
+        x509.KeyUsage(
+            key_agreement=True,
+            key_cert_sign=False,
+            crl_sign=False,
+            digital_signature=True,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            encipher_only=False,
+            decipher_only=False,
+        ),
+        critical=True,
+    )
+    cb = cb.add_extension(
+        x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(
+            ca_cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier).value
+        ),
+        critical=False,
+    )
+    cb = cb.add_extension(
+        x509.CertificatePolicies(policies=policies),
+        critical=True,
+    )
+    cb = cb.add_extension(
+        x509.SubjectAlternativeName(general_names=sans),
+        critical=True,
+    )
+
+    cert = cb.sign(ca_key, SHA256())
+
+    cert_pem = cert.public_bytes(encoding=serialization.Encoding.PEM)
+    with open(cert_file, "wb") as fh:
+        fh.write(cert_pem)
+        # Append the intermediate certificate(s)
+        fh.write(ca_pem_data)
+        log.info("Created Cert %s", cert_file)
+
+    convert_pem_to_der(cert_file)
+    return cert_file

sep2cert/cert_id.py

@@ -0,0 +1,102 @@
+import hashlib
+import logging
+from itertools import zip_longest
+from pathlib import Path
+
+from cryptography import x509
+from cryptography.hazmat.primitives import serialization
+
+log = logging.getLogger(__name__)
+
+
+def group_hex(item: str, group_size: int = 4) -> str:
+    """Group into groups of four"""
+
+    def grouper(iterable, n, fillvalue=None):
+        args = [iter(iterable)] * n
+        return zip_longest(*args, fillvalue=fillvalue)
+
+    return "-".join("".join(x) for x in grouper(item, n=group_size))
+
+
+def get_lfdi(fingerprint: str, group: bool = True) -> str:
+    """Long-form device identifier (LFDI)
+    The LFDI SHALL be the certificate fingerprint left-truncated to 160 bits.
+    For display purposes, this SHALL be expressed as 40 hexadecimal digits in
+    groups of four.
+    """
+    lfdi = fingerprint.replace("-", "")[0:40].upper()
+    if not group:
+        return lfdi
+    return group_hex(lfdi)
+
+
+def get_sfdi(fingerprint, group: bool = True) -> str:
+    """Short-form device identifier (SFDI)
+    The SFDI SHALL be the certificate fingerprint left-truncated to 36 bits.
+    For display purposes, this SHALL be expressed as 11 decimal (base 10) digits,
+    with an additional sum-of-digits checksum digit right concatenated.
+    """
+    trunc = fingerprint.replace("-", "")[0:9]
+    sfdi = int(trunc, base=16)  # Convert from Base 16 to Base 10
+    digits = map(int, str(sfdi))
+    checksum = 10 - sum(digits) % 10
+    if checksum == 10:
+        checksum = 0
+
+    full_sfdi = str(sfdi) + str(checksum)
+    if not group:
+        return full_sfdi
+    return group_hex(full_sfdi, 3)
+
+
+def get_fingerprint(cert_path: Path) -> str:
+    """Certificate fingerprint
+    The certificate fingerprint is the result of performing a SHA256 operation
+    over the whole DER-encoded certificate and is used to derive the SFDI and LFDI.
+    """
+    with open(cert_path, "rb") as f:
+        fbytes = f.read()  # read entire file as bytes
+        readable_hash = hashlib.sha256(fbytes).hexdigest().upper()
+        return readable_hash
+
+
+def is_pem_certificate(cert_path: Path) -> bool:
+    with open(cert_path, "rb") as f:
+        first_line = f.readline()
+        return b"-----BEGIN CERTIFICATE-----" in first_line
+
+
+def get_der_certificate_lfdi(cert_path: Path, group: bool = True):
+    """Load X.509 DER Certificate and return LFDI"""
+
+    if not cert_path.exists():
+        raise ValueError(f"Cert not found at {cert_path}")
+
+    fingerprint = get_fingerprint(cert_path)
+    return get_lfdi(fingerprint, group=group)
+
+
+def get_pem_certificate_lfdi(cert_path: Path, group: bool = True):
+    """Load X.509 DER Certificate in PEM format and return LFDI"""
+
+    if not cert_path.exists():
+        raise ValueError(f"Cert not found at {cert_path}")
+
+    with open(cert_path, "rb") as pem_file:
+        cert_data = pem_file.read()
+
+    cert = x509.load_pem_x509_certificate(cert_data)
+    der_bytes = cert.public_bytes(serialization.Encoding.DER)
+    fingerprint = hashlib.sha256(der_bytes).hexdigest().upper()
+    lfdi = get_lfdi(fingerprint, group=group)
+    return lfdi
+
+
+def get_certificate_lfdi(cert_path: Path, group: bool = True):
+    """Load X.509 DER Certificate in PEM or DER format and return LFDI"""
+    if is_pem_certificate(cert_path):
+        lfdi = get_pem_certificate_lfdi(cert_path, group=group)
+    else:
+        lfdi = get_der_certificate_lfdi(cert_path, group=group)
+    return lfdi

sep2cert/cert_validate.py

@@ -0,0 +1,142 @@
+import logging
+from datetime import UTC, datetime
+from pathlib import Path
+
+from cryptography import x509
+from cryptography.x509 import Certificate
+
+from .cert_id import is_pem_certificate
+
+log = logging.getLogger(__name__)
+INDEF_EXPIRY = datetime(9999, 12, 31, 23, 59, 59, 0, UTC)  # As per standard
+
+
+def load_certificate(cert_path: Path) -> Certificate:
+    if not cert_path.exists():
+        raise ValueError(f"Cert not found at {cert_path}")
+    with open(cert_path, "rb") as pem_file:
+        cert_data = pem_file.read()
+    if is_pem_certificate(cert_path):
+        cert = x509.load_pem_x509_certificate(cert_data)
+    else:
+        cert = x509.load_der_x509_certificate(cert_data)
+    return cert
+
+
+def get_certificate_sans(cert_path: Path) -> list[str]:
+    """Load X.509 DER Certificate in PEM format and return Policy OIDs"""
+    cert = load_certificate(cert_path)
+    sans = cert.extensions.get_extension_for_oid(
+        x509.ExtensionOID.SUBJECT_ALTERNATIVE_NAME
+    ).value
+    output = []
+    for entry in sans:
+        if isinstance(entry, x509.DNSName):
+            output.append(("DNS", entry.value))
+        elif isinstance(entry, x509.OtherName):
+            oid = entry.type_id.dotted_string
+            output.append((oid, entry.value))
+    return output
+
+
+def get_certificate_policy_oids(cert_path: Path) -> list[str]:
+    """Load X.509 DER Certificate in PEM format and return Policy OIDs"""
+
+    cert = load_certificate(cert_path)
+
+    oids = []
+    cert_policies = cert.extensions.get_extension_for_oid(
+        x509.ExtensionOID.CERTIFICATE_POLICIES
+    ).value
+    for policy in cert_policies:
+        oid = policy.policy_identifier.dotted_string
+        oids.append(oid)
+    return oids
+
+
+def get_cert_san_other_names_policy_oids(cert_path: Path) -> list[str]:
+    """Load X.509 DER Certificate in PEM format and
+    return Subject Alternative Name Other Names Policy OIDs"""
+
+    cert = load_certificate(cert_path)
+    sans = cert.extensions.get_extension_for_oid(
+        x509.ExtensionOID.SUBJECT_ALTERNATIVE_NAME
+    ).value
+    other_names = []
+    for entry in sans:
+        if isinstance(entry, x509.OtherName):
+            oid = entry.type_id.dotted_string
+            other_names.append(oid)
+    return other_names
+
+
+def validate_certificate(cert_path: Path) -> bool:
+    """Load X.509 DER Certificate in PEM format and validate"""
+
+    cert = load_certificate(cert_path)
+    valid = True
+
+    # Check the validity period
+    current_time_utc = datetime.now(UTC)
+    if not cert.not_valid_before_utc <= current_time_utc:
+        msg = "Certificate is not valid yet. "
+        msg += "Not valid before {cert.not_valid_before_utc}"
+        log.error(msg)
+        valid = False
+    if not current_time_utc <= cert.not_valid_after_utc:
+        msg = "Certificate is no longer valid. "
+        msg += "Not valid after {cert.not_valid_after_utc}"
+        log.error(msg)
+        valid = False
+    if cert.not_valid_after_utc != INDEF_EXPIRY:
+        msg = f"Certificate expiry not {INDEF_EXPIRY} as per standard. "
+        msg += f"Expires {cert.not_valid_after_utc}"
+        log.warning(msg)
+        valid = False
+
+    # Verify the OIDs
+    oid_intro = "1.3.6.1.4.1"
+    oid_pen = "40732"
+
+    oid_into = f"{oid_intro}.{oid_pen}"
+    oid_device_start = f"{oid_intro}.{oid_pen}.1."
+    sep2_dev_type = False
+
+    oid_test_end = f".{oid_pen}.2.1"
+    test_oid = False
+
+    oids = get_certificate_policy_oids(cert_path)
+    for oid in oids:
+        if oid_test_end in oid:
+            test_oid = oid
+        elif oid_device_start in oid:
+            sep2_dev_type = True
+        elif oid_into in oid:
+            pass
+        else:
+            log.warning("Certificate has a non SEP2 policy specified: %s", oid)
+
+    if test_oid:
+        msg = f"Certificate is a test certificate as {test_oid} set."
+        log.warning(msg)
+
+    if not sep2_dev_type:
+        msg = "At least one SEP2 device type assignment policy must be specified. "
+        msg += f"That is an OID like {oid_device_start}X"
+        log.error(msg)
+        valid = False
+
+    # Verify the Other Name OID in the SAN
+    sep2_hw_mod_name = False
+    oid_hw_mod_name = "1.3.6.1.5.5.7.8.4"
+    san_oids = get_cert_san_other_names_policy_oids(cert_path)
+    for oid in san_oids:
+        if oid == oid_hw_mod_name:
+            sep2_hw_mod_name = True
+
+    if not sep2_hw_mod_name:
+        msg = f"SEP2 Hardware Module Name OID {oid_hw_mod_name} "
+        msg += "not found in SAN OtherName."
+        log.error(msg)
+
+    return valid

sep2cert/cli.py

@@ -0,0 +1,114 @@
+import logging
+from pathlib import Path
+
+import typer
+
+from .cert_create import (
+    generate_device_certificate,
+    generate_key,
+    generate_mica,
+    generate_serca,
+)
+from .cert_id import get_certificate_lfdi
+from .cert_validate import validate_certificate
+from .version import __version__
+
+LOG_FORMAT = "%(asctime)s %(levelname)-8s %(message)s"
+DEFAULT_DIR = Path("certs")
+app = typer.Typer(no_args_is_help=True)
+
+
+def version_callback(value: bool):
+    if value:
+        typer.echo(f"sep2cert version: {__version__}")
+        raise typer.Exit()
+
+
+@app.callback()
+def callback(
+    version: bool = typer.Option(False, "--version", callback=version_callback),
+) -> None:
+    """sep2cert
+
+    Functions for creating and validating IEEE 2030.5 (SEP2) certificates.
+    """
+    pass
+
+
+@app.command()
+def cert_lfdi(filepath: Path, verbose: bool = False) -> None:
+    log_level = "DEBUG" if verbose else "INFO"
+    logging.basicConfig(level=log_level, format=LOG_FORMAT)
+
+    if not filepath.exists():
+        msg = f"No such file {filepath}"
+        raise FileNotFoundError(msg)
+
+    lfdi = get_certificate_lfdi(filepath)
+    typer.echo(f"The LFDI is: {lfdi}")
+
+    validate_certificate(filepath)
+
+
+@app.command()
+def create_key(
+    key_file: Path | None = None,
+    hostname: str = "",
+    verbose: bool = False,
+) -> None:
+    log_level = "DEBUG" if verbose else "INFO"
+    logging.basicConfig(level=log_level, format=LOG_FORMAT)
+
+    hostnames = None if not hostname else [hostname]
+    _key, _csr = generate_key(key_file, generate_csr=True, hostnames=hostnames)
+
+
+@app.command()
+def create_serca(
+    org_name: str = "Smart Energy",
+    verbose: bool = False,
+    output_dir: Path = DEFAULT_DIR,
+) -> None:
+    log_level = "DEBUG" if verbose else "INFO"
+    logging.basicConfig(level=log_level, format=LOG_FORMAT)
+
+    output_dir.mkdir(exist_ok=True)
+    key_file = output_dir / "serca.key"
+    key, _csr = generate_key(key_file, generate_csr=False)
+    generate_serca(key, org_name=org_name)
+
+
+@app.command()
+def create_mica(
+    ca_cert: Path,
+    ca_key: Path,
+    org_name: str = "Example Org",
+    verbose: bool = False,
+    output_dir: Path = DEFAULT_DIR,
+) -> None:
+    log_level = "DEBUG" if verbose else "INFO"
+    logging.basicConfig(level=log_level, format=LOG_FORMAT)
+
+    output_dir.mkdir(exist_ok=True)
+    key_file = output_dir / "mica.key"
+    _key, csr = generate_key(key_file, generate_csr=True)
+    generate_mica(csr, ca_cert, ca_key, org_name=org_name)
+
+
+@app.command()
+def create_cert(
+    csr_path: Path,
+    ca_cert: Path,
+    ca_key: Path,
+    pen: int = 12345,
+    serno: str = "1",
+    verbose: bool = False,
+) -> None:
+    log_level = "DEBUG" if verbose else "INFO"
+    logging.basicConfig(level=log_level, format=LOG_FORMAT)
+
+    cert_fp = generate_device_certificate(
+        csr_path, ca_cert, ca_key, pen=pen, hardware_serial_number=serno
+    )
+    lfdi = get_certificate_lfdi(cert_fp)
+    typer.echo(f"The LFDI is: {lfdi}")

sep2cert/version.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

sep2cert-0.1.0.dist-info/METADATA

@@ -0,0 +1,63 @@
+Metadata-Version: 2.4
+Name: sep2cert
+Version: 0.1.0
+Summary: Useful functions for working with IEEE 2030.5 (SEP2)
+Author-email: Alex Guinman <alex@guinman.id.au>
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+License-File: LICENSE
+Requires-Dist: asn1==2.8.0
+Requires-Dist: cryptography>=44.0.1
+Requires-Dist: python-dateutil>=2.8.2
+Requires-Dist: typer>=0.15.1
+Requires-Dist: pytest>=2.7.3 ; extra == "test"
+Requires-Dist: pytest-cov>=6.0.0 ; extra == "test"
+Project-URL: Source, https://github.com/aguinane/SEP2-Certs
+Provides-Extra: test
+
+# SEP2-Certs
+
+Create and verify IEEE 2030.5 (SEP2) PKI certificates
+
+## Certificate Inspection
+
+Get the LFDI for a certificate. It will also do some validation checks.
+
+```sh
+python -m sep2cert cert-lfdi certs/dev-ABC-cert.pem
+```
+
+## Certificate Creation
+
+Note the below CLI commands are only intended for testing purposes.
+For production certificates, additional functions and policies may be required.
+
+### Signing Certificates
+
+Create a SERCA, and a MICA.
+
+```sh
+python -m sep2cert create-serca
+python -m sep2cert create-mica certs/serca.pem certs/serca.key
+```
+
+### Device Certificates
+
+To create a device certificate, first create a Key and Certificate Signing Request (CSR).
+
+```sh
+python -m sep2cert create-key --key-file certs/dev-ABC.key
+```
+
+Once you have the CSR, build the cert by signing with the MICA.
+
+```sh
+python -m sep2cert create-cert certs/dev-ABC.csr certs/mica.pem certs/mica.key --pen 12345 --serno ABC
+```
+

sep2cert-0.1.0.dist-info/RECORD

@@ -0,0 +1,12 @@
+sep2cert/__init__.py,sha256=KV6Ax6AqSvNkitZjVcc7IZRoMpCRHnMBICaMsFlfGN0,197
+sep2cert/__main__.py,sha256=wcCrL4PjG51r5wVKqJhcoJPTLfHW0wNbD31DrUN0MWI,28
+sep2cert/cert_create.py,sha256=ei4Plg5kXP5zr8q7_HorWe8eml0d2sul_5PB7RJh8ro,14363
+sep2cert/cert_id.py,sha256=b0EttAN7U_hox51DfnMkbBI4d84pnoLGholNPb2WxGg,3408
+sep2cert/cert_validate.py,sha256=r7nt8FOOBBxVY5EpIWFXPqdmJwhVaWgNgHFxQlNHUKo,4525
+sep2cert/cli.py,sha256=2bmR5FqnvAdQU5tgbyAkCRpdwakSN8bkGzSdRjRE83w,2964
+sep2cert/version.py,sha256=kUR5RAFc7HCeiqdlX36dZOHkUI5wI6V_43RpEcD8b-0,22
+sep2cert-0.1.0.dist-info/entry_points.txt,sha256=iX-btyincvnZ1Z34LMZ2_DWH137e8opD79oVS1SP0_k,45
+sep2cert-0.1.0.dist-info/licenses/LICENSE,sha256=S_wPB_kx6_LJeJwqjagIQWYn16cilgx2KNPODekCKeE,1069
+sep2cert-0.1.0.dist-info/WHEEL,sha256=G2gURzTEtmeR8nrdXUJfNiB3VYVxigPQ-bEQujpNiNs,82
+sep2cert-0.1.0.dist-info/METADATA,sha256=5VfBMXv5AKW91RWLbhUYYWQCIB4Aizy_NBSLL-rpyBY,1789
+sep2cert-0.1.0.dist-info/RECORD,,

sep2cert-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: flit 3.12.0
+Root-Is-Purelib: true
+Tag: py3-none-any

sep2cert-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+sep2cert=sep2cert.cli:app
+

sep2cert-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alex Guinman
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.