def test_server_command_uses_same_rsa_key_size_as_ca_hierarchy(tmpdir):

    # John is setting-up a quick and dirty project to test some

    # functionality revolving around X.509 certificates. Since he does

    # not care much about the strength of private keys for it, he

    # wants to use 1024-bit RSA keys.

    # He switches to his project directory, and initialises the CA

    # hierarchy, requesting that 1024-bit RSA keys should be used.

    tmpdir.chdir()

    run_command("gimmecert", "init", "--key-specification", "rsa:1024")

    # John issues a server certificates.

    stdout, stderr, exit_code = run_command('gimmecert', 'server', 'myserver')

    # John observes that the process was completed successfully.

    assert exit_code == 0

    assert stderr == ""

    # He runs a command to see details about the generated private

    # key.

    stdout, _, _ = run_command('openssl', 'rsa', '-noout', '-text', '-in', '.gimmecert/server/myserver.key.pem')

    # And indeed, the generated private key uses the same size as the

    # one he specified for the CA hierarchy.

    assert "Private-Key: (1024 bit)" in stdout

    # He then has a look at the certificate.

    stdout, _, _ = run_command('openssl', 'x509', '-noout', '-text', '-in', '.gimmecert/server/myserver.cert.pem')

    # Likewise with the private key, the certificate is also using the

    # 1024-bit RSA key.

    assert "Public-Key: (1024 bit)" in stdout

    # Grab the issuing CA private key and certificate.

    ca_hierarchy = gimmecert.storage.read_ca_hierarchy(os.path.join(project_directory, '.gimmecert', 'ca'))

    issuer_private_key, issuer_certificate = ca_hierarchy[-1]

        key_specification = gimmecert.crypto.key_specification_from_public_key(issuer_private_key.public_key())

        key_generator = gimmecert.crypto.KeyGenerator(key_specification[0], key_specification[1])

        private_key = key_generator()

def key_specification_from_public_key(public_key):

    """

    Derives key specification (algorithm and associated parameters)

    from the passed-in public key. Key specification can be used for

    generating the private keys via KeyGenerator instances.

    :param public_key: Public

    :type public_key: cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey

    :returns: Key algorithm and parameter(s) for generating same type of keys as the passed-in public key.

    :rtype: tuple(str, int)

    :raises ValueError: If algorithm/parameters could not be derived from the passed-in public key.

    """

    if isinstance(public_key, cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey):

        return "rsa", public_key.key_size

    raise ValueError("Unsupported public key instance passed-in: \"%s\" (%s)" % (str(public_key), type(public_key)))

def test_server_uses_same_private_key_algorithm_and_parameters_as_issuer_when_generating_private_key(tmpdir):

    private_key_file = tmpdir.join('.gimmecert', 'server', 'myserver.key.pem')

    gimmecert.commands.init(io.StringIO(), io.StringIO(), tmpdir.strpath, tmpdir.basename, 1, ("rsa", 1024))

    gimmecert.commands.server(io.StringIO(), io.StringIO(), tmpdir.strpath, 'myserver', None, None)

    private_key = gimmecert.storage.read_private_key(private_key_file.strpath)

    assert private_key.key_size == 1024

@pytest.mark.parametrize("specification", [

    ("rsa", 1024),

    ("rsa", 2048)

])

def test_key_specification_from_public_key_returns_correct_algorithm_and_parameters(specification):

    key_generator = gimmecert.crypto.KeyGenerator(specification[0], specification[1])

    public_key = key_generator().public_key()

    algorithm, parameters = gimmecert.crypto.key_specification_from_public_key(public_key)

    assert (algorithm, parameters) == specification

def test_key_specification_raises_exception_for_invalid_public_key():

    public_key = "not_a_public_key_instance"

    with pytest.raises(ValueError) as e_info:

        gimmecert.crypto.key_specification_from_public_key(public_key)

    assert str(e_info.value) == "Unsupported public key instance passed-in: \"not_a_public_key_instance\" (<class 'str'>)"