Support encoding KeyUsage into certificate signing requests

1 files changed, 64 insertions, 2 deletions

diff --git a/tests/test_x509.py b/tests/test_x509.py
index b2262c71..af7d9421 100644
--- a/tests/test_x509.py
+++ b/tests/test_x509.py
@@ -962,6 +962,20 @@ class TestCertificateSigningRequestBuilder(object):
             x509.SubjectAlternativeName([x509.DNSName(u"cryptography.io")]),
             critical=False,
         ).add_extension(
+            x509.InhibitAnyPolicy(0),
+            critical=False
+        )
+        with pytest.raises(NotImplementedError):
+            builder.sign(private_key, hashes.SHA256(), backend)
+
+    def test_key_usage(self, backend):
+        private_key = RSA_KEY_2048.private_key(backend)
+        builder = x509.CertificateSigningRequestBuilder()
+        request = builder.subject_name(
+            x509.Name([
+                x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'),
+            ])
+        ).add_extension(
             x509.KeyUsage(
                 digital_signature=True,
                 content_commitment=True,
@@ -974,9 +988,57 @@ class TestCertificateSigningRequestBuilder(object):
                 decipher_only=False
             ),
             critical=False
+        ).sign(private_key, hashes.SHA256(), backend)
+        assert len(request.extensions) == 1
+        ext = request.extensions.get_extension_for_oid(x509.OID_KEY_USAGE)
+        assert ext.critical is False
+        assert ext.value == x509.KeyUsage(
+            digital_signature=True,
+            content_commitment=True,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=False,
+            key_cert_sign=True,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=False
+        )
+
+    def test_key_usage_key_agreement_bit(self, backend):
+        private_key = RSA_KEY_2048.private_key(backend)
+        builder = x509.CertificateSigningRequestBuilder()
+        request = builder.subject_name(
+            x509.Name([
+                x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'),
+            ])
+        ).add_extension(
+            x509.KeyUsage(
+                digital_signature=False,
+                content_commitment=False,
+                key_encipherment=False,
+                data_encipherment=False,
+                key_agreement=True,
+                key_cert_sign=True,
+                crl_sign=False,
+                encipher_only=False,
+                decipher_only=True
+            ),
+            critical=False
+        ).sign(private_key, hashes.SHA256(), backend)
+        assert len(request.extensions) == 1
+        ext = request.extensions.get_extension_for_oid(x509.OID_KEY_USAGE)
+        assert ext.critical is False
+        assert ext.value == x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=True,
+            key_cert_sign=True,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=True
         )
-        with pytest.raises(NotImplementedError):
-            builder.sign(private_key, hashes.SHA256(), backend)
 
     def test_add_two_extensions(self, backend):
         private_key = RSA_KEY_2048.private_key(backend)