iOS的cer、p12格式证书解析监控

之前博客写过直接解析ipa包获取mobileprovision文件来监控APP是否过期来，但APP的推送证书还没有做，

大家都知道，iOS的推送证书不会放到ipa包里，只能通过直接解析p12或cer、crt格式。

解析p12格式的话，需要证书导出的密码，p12证书好处是可以授权到多台电脑。解析cer则不需要密码。

1.可以写个函数同时解析p12和cer文件：

# -*- coding = utf-8 -*-
# ------------------------------
# @time: 2021/3/29 5:18 PM
# @Author: drew_gg
# @File: certificate_parsing.py
# @Software: cover_ios_api
# ------------------------------

import os
from OpenSSL import crypto
import datetime
import time
from dateutil import parser
from pkg_common.ipa_monitor import calculation_month as cm

def deal_utc(utc_time):
    """
    UTC时间转换
    :param utc_time:
    :return:
    """
    # UTC时间格式
    utc_format = "%Y-%m-%dT%H:%M:%SZ"
    sta_time = datetime.datetime.strptime(utc_time, utc_format) + datetime.timedelta(hours=8)
    time_array = time.strptime(str(sta_time), "%Y-%m-%d %H:%M:%S")
    time_stamp = int(time.mktime(time_array))
    return sta_time, time_stamp

def parsing_p12(file, f_type, password=''):
    """
    解析p12、cer证书
    :param file:
    :param f_type:
    :param password:
    :return:
    """
    cer = ''
    if f_type == 'p12':
        p12 = crypto.load_pkcs12(open(file, 'rb').read(), password)
        cer = p12.get_certificate()
    if f_type == 'cer':
        crt_f = file.split('.cer')[0] + '.crt'
        # cer转换crt格式
        crt_cmd = "OpenSSL x509 -inform DER -in %s -out %s" % (file, crt_f)
        os.system(crt_cmd)
        with open(crt_f, "r", encoding='ISO-8859-1') as fp:
            crt_data = fp.read()
        cer = crypto.load_certificate(crypto.FILETYPE_PEM, crt_data)
        del_cmd = "rm -rf %s" % crt_f
        os.system(del_cmd)
    cer_dic = {}

    # 解析时间
    z_be_time = parser.parse(cer.get_notBefore().decode("UTF-8")).strftime('%Y-%m-%d %H:%M:%S')
    # 生成UTC时间格式并转换成北京时间
    before_time = deal_utc(z_be_time.split(' ')[0] + 'T' + z_be_time.split(' ')[1] + 'Z')[0]
    # 解析时间
    z_af_time = parser.parse(cer.get_notAfter().decode("UTF-8")).strftime('%Y-%m-%d %H:%M:%S')
    after_time = deal_utc(z_af_time.split(' ')[0] + 'T' + z_af_time.split(' ')[1] + 'Z')[0]
    # 获取时间月数差
    remaining_time = cm.cal_months(datetime.date.today(), after_time)

    cer_dic['before_time'] = before_time
    cer_dic['after_time'] = after_time
    cer_dic['remaining_time'] = remaining_time

    subject = cer.get_subject()
    s_components = subject.get_components()
    # 解析证书相关名称
    for (key, value) in s_components:
        if str(key, encoding='utf-8') == 'CN':
            cer_dic['user_id'] = str(value, encoding='utf-8')
        if str(key, encoding='utf-8') == 'OU':
            cer_dic['group'] = str(value, encoding='utf-8')
        if str(key, encoding='utf-8') == 'O':
            cer_dic['company'] = str(value, encoding='utf-8')
    if 'company' not in cer_dic.keys():
        cer_dic['company'] = ''
    if 'user_id' not in cer_dic.keys():
        cer_dic['user_id'] = ''
    if 'group' not in cer_dic.keys():
        cer_dic['group'] = ''
    return cer_dic

if __name__ == '__main__':

    f_p121 = "/Users/Work/package/notice_montor/xxx推送证书.p12"
    f_p122 = "/Users/Work/package/notice_montor/xx推送证书.p12"
    f_cer = "/Users/Work/package/notice_montor/xxx证书.cer"
    pa = '123456'
    a = parsing_p12(f_p122, 'p12', "123456")
    print(a)

需要注意的地方：

1>.证书解析出的时间是utc格式，需要转换成北京时间，和直接解析ipa获取到的格式不一样，格式里不带“T”，需要自己构建格式后再转换。

2>.cer格式不能直接解析，直接解析会报格式错误，需要先通过命令："OpenSSL x509 -inform DER -in %s -out %s" % (file, crt_f)转换成crt文件，解析完crt文件后再删除即可

3>.可能有的证书没有‘O’项，需要自己处理。

2.监控时候可以把p12和cer都放一个目录下，写个方法遍历即可：

# -*- coding = utf-8 -*-
# ------------------------------
# @time: 2021/3/29 5:18 PM
# @Author: drew_gg
# @File: notice_monitor.py
# @Software: cover_ios_api
# ------------------------------

import datetime
from pkg_dao import read_sql as rs
from pkg_dao import flask_mysql as fm
from pkg_common.handle_file import find_file as find
from pkg_common.ipa_monitor import common_mail as mail
from pkg_common.ipa_monitor import certificate_parsing as cp
from pkg_common.ipa_monitor import notice_monitor_html as html

def get_certificate_detail(to_find_path, password):
    """
    获取ipa的证书时间与描述文件时间
    :return:
    """
    company_name = ''
    to_file = ["'*.p12'", "'*.cer'"]
    f, f_l = find.find_file_more(to_file, to_find_path)
    all_dic = []
    cer_pa = {}
    for p in f_l:
        if p.split('.')[1] == 'p12':
            company_name = p.split('/')[-1].split('.p12')[0]
            cer_pa = cp.parsing_p12(p, 'p12', password)
        if p.split('.')[1] == 'cer':
            company_name = p.split('/')[-1].split('.cer')[0]
            cer_pa = cp.parsing_p12(p, 'cer')
        cer_pa['company_name'] = company_name
        all_dic.append(cer_pa)
    return all_dic

if __name__ == '__main__':

    # 需要遍历ipa文件等目录
    find_path = '/Users/Work/package/notice_montor'
    pw = 'xxxxx'
    cer_all = get_certificate_detail(find_path, pw)
    # 升序排个序列
    cer_all = sorted(cer_all, key=lambda k: k['remaining_time'])
    for i in cer_all:
        sql_result = rs.deal_mysql("get_certificate_id.sql", list([i['user_id']]))
        update_time = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
        if sql_result:
            up_sal = """
                        UPDATE certificate_parsing
                        SET `name` = '%s',
                          company = '%s',
                          `group` = '%s',
                          remaining_time = '%s',
                          before_time = '%s',
                          after_time = '%s',
                          upload_time = '%s'
                        WHERE
                          is_delete = 0
                        AND user_id = '%s'
                        LIMIT 1;
                     """ % (i['company_name'], i['company'], i['group'], i['remaining_time'], i['before_time'], i['after_time'],
                             update_time, i['user_id'])
            d = fm.Database()
            d.exec_no_query(up_sal)
        else:
            in_sql = """
                          INSERT INTO `certificate_parsing` (
                              `name`,
                              `company`,
                              `group`,
                              `user_id`,
                              `remaining_time`,
                              `before_time`,
                              `after_time`,
                              `upload_time`
                              )
                          VALUES
                              (
                                '%s',
                                '%s',
                                '%s',
                                '%s',
                                '%s',
                                '%s',
                                '%s',
                                '%s'
                                );
                        """ % (i['company_name'], i['company'], i['group'], i['user_id'], i['remaining_time'], i['before_time'],
                               i['after_time'], update_time)
            d = fm.Database()
            d.exec_no_query(in_sql)

    subject, html = html.deal_html(cer_all)
    try:
        if mail.cs_mail_send(subject, html, 'iOS'):
            print('Send success')
        else:
            print('Send failure')
    except Exception as ex:
        print(ex)

find_file_more方法和简单：

def find_file_more(file_l, path):
    """
    :param file_l:
    :param path:
    :return:
    """
    f = []
    f_a = []
    find_cmd = ''
    for index, f_t in enumerate(file_l):
        if index == 0:
            find_cmd = 'find . -iname %s' % f_t
        else:
            find_cmd += " -o -iname %s" % f_t

    file_list = cmd.run_cmd(find_cmd, path).read().split('./')
    for i in range(len(file_list)):
        if i != 0:
            file_all = path + '/' + file_list[i].strip()
            f_a.append(file_all)
            file = file_list[i].split('/')[-1].split('.')[0].strip()
            f.append(file)
    return f, f_a

拼接find . -iname ** -o -iname ** -o -iname ** 命令。

然后把获取到的证书信息写入数据库和生成邮件告警出来就行，也可以定时每周五执行一次就好。

计算月数的话，之前给的那个比较复杂，不容易懂，新写个方法，比较简单粗暴：

# -*- coding = utf-8 -*-
# ------------------------------
# @time: 2021/2/1 4:13 PM
# @Author: drew_gg
# @File: calculation_month.py
# @Software: Build_Packaging
# ------------------------------

# coding = utf-8
# 计算日期的月份差

import datetime

def cal_months(start_date, end_date):
    """
    计算两个日期的月份差，精确到小数位
    :param start_date: 日期必须为date格式
    :param end_date: 日期必须为date格式
    :return:
    """

    # 计算两个日期相隔月差
    ey = end_date.year
    em = end_date.month
    ed = end_date.day
    sy = start_date.year
    sm = start_date.month
    sd = start_date.day

    if ey < sy:
        raise AssertionError('被减日期大了！')
    elif ey == sy and em < sm:
        raise AssertionError('被减日期大了！')
    elif ey == sy and em == sm and ed < sd:
        raise AssertionError('被减日期大了！')
    else:
        aed = round((ey - sy) * 12 + (em - sm) + (ed - sd)/30.5, 2)
    return aed

if __name__ == '__main__':
    sd = datetime.date(2021, 3, 29)
    ed = datetime.date(2022, 1, 22)
    a = cal_months(sd, ed)

年月平均天数30.5天，按照这个来算月数，是不是简单粗暴，反正相差不大，就这样了。