[api] Rest API for PKI app

README.rst

@@ -952,7 +952,8 @@ Download template configuration
 
     GET /api/v1/controller/template/{id}/configuration/
 
-The above endpoint triggers the download of a ``tar.gz`` file containing the generated configuration for that specific template.
+The above endpoint triggers the download of a ``tar.gz`` file
+containing the generated configuration for that specific template.
 
 Change details of template
 ^^^^^^^^^^^^^^^^^^^^^^^^^^
@@ -1003,7 +1004,8 @@ Download VPN configuration
 
     GET /api/v1/controller/vpn/{id}/configuration/
 
-The above endpoint triggers the download of a ``tar.gz`` file containing the generated configuration for that specific VPN.
+The above endpoint triggers the download of a ``tar.gz`` file
+containing the generated configuration for that specific VPN.
 
 Change details of VPN
 ^^^^^^^^^^^^^^^^^^^^^
@@ -1026,6 +1028,143 @@ Delete VPN
 
     DELETE /api/v1/controller/vpn/{id}/
 
+List CA
+^^^^^^^
+
+.. code-block:: text
+
+    GET /api/v1/controller/ca/
+
+Create new CA
+^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    POST /api/v1/controller/ca/
+
+Import existing CA
+^^^^^^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    POST /api/v1/controller/ca/
+
+**Note**: To import an existing CA, only ``name``, ``certificate``
+and ``private_key`` fields have to be filled in the ``HTML`` form or
+included in the ``JSON`` format.
+
+Get CA Detail
+^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    GET /api/v1/controller/ca/{id}/
+
+Change details of CA
+^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    PUT /api/v1/controller/ca/{id}/
+
+Patch details of CA
+^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    PATCH /api/v1/controller/ca/{id}/
+
+Download CA(crl)
+^^^^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    GET /api/v1/controller/ca/{id}/crl/
+
+The above endpoint triggers the download of ``{id}.crl`` file containing 
+up to date CRL of that specific CA.
+
+Delete CA
+^^^^^^^^^
+
+.. code-block:: text
+
+    DELETE /api/v1/controller/ca/{id}/
+
+Renew CA
+^^^^^^^^
+
+.. code-block:: text
+
+    POST /api/v1/controller/ca/{id}/renew/
+
+List Cert
+^^^^^^^^^
+
+.. code-block:: text
+
+    GET /api/v1/controller/cert/
+
+Create new Cert
+^^^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    POST /api/v1/controller/cert/
+
+Import existing Cert
+^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    POST /api/v1/controller/cert/
+
+**Note**: To import an existing Cert, only ``name``, ``ca``,
+``certificate`` and ``private_key`` fields have to be filled
+in the ``HTML`` form or included in the ``JSON`` format.
+
+Get Cert Detail
+^^^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    GET /api/v1/controller/cert/{id}/
+
+Change details of Cert
+^^^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    PUT /api/v1/controller/cert/{id}/
+
+Patch details of Cert
+^^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: text
+
+    PATCH /api/v1/controller/cert/{id}/
+
+Delete Cert
+^^^^^^^^^^^
+
+.. code-block:: text
+
+    DELETE /api/v1/controller/cert/{id}/
+
+Renew Cert
+^^^^^^^^^^
+
+.. code-block:: text
+
+    POST /api/v1/controller/cert/{id}/renew/
+
+Revoke Cert
+^^^^^^^^^^^
+
+.. code-block:: text
+
+    POST /api/v1/controller/cert/{id}/revoke/
+
 Default Alerts / Notifications
 ------------------------------
 

openwisp_controller/pki/api/serializers.py

@@ -0,0 +1,196 @@
+from django.utils.translation import ugettext_lazy as _
+from django_x509.base.models import (
+    default_ca_validity_end,
+    default_cert_validity_end,
+    default_validity_start,
+)
+from rest_framework import serializers
+from swapper import load_model
+
+from openwisp_users.api.mixins import FilterSerializerByOrgManaged
+from openwisp_utils.api.serializers import ValidatedModelSerializer
+
+Ca = load_model('django_x509', 'Ca')
+Cert = load_model('django_x509', 'Cert')
+
+
+class BaseSerializer(FilterSerializerByOrgManaged, ValidatedModelSerializer):
+    pass
+
+
+class CaListSerializer(BaseSerializer):
+
+    extensions = serializers.JSONField(
+        initial=[],
+        help_text=_('additional x509 certificate extensions'),
+        required=False,
+    )
+
+    class Meta:
+        model = Ca
+        fields = [
+            'id',
+            'name',
+            'organization',
+            'notes',
+            'key_length',
+            'digest',
+            'validity_start',
+            'validity_end',
+            'country_code',
+            'state',
+            'city',
+            'organization_name',
+            'organizational_unit_name',
+            'email',
+            'common_name',
+            'extensions',
+            'serial_number',
+            'certificate',
+            'private_key',
+            'passphrase',
+            'created',
+            'modified',
+        ]
+        read_only_fields = ['created', 'modified']
+        extra_kwargs = {
+            'organization': {'required': True},
+            'key_length': {'initial': '2048'},
+            'digest': {'initial': 'sha256'},
+            'validity_start': {'default': default_validity_start()},
+            'validity_end': {'default': default_ca_validity_end()},
+        }
+
+    def validate(self, data):
+        instance = self.instance or self.Meta.model(**data)
+        instance.full_clean()
+        if data.get('certificate') and data.get('private_key'):
+            data = get_import_data(instance)
+        return data
+
+    def validate_validity_start(self, value):
+        if value is None:
+            value = default_validity_start()
+        return value
+
+    def validate_validity_end(self, value):
+        if value is None:
+            value = default_ca_validity_end()
+        return value
+
+
+def CaDetail_fields(fields=None):
+    """
+    Returns the fields for the `CADetailSerializer`.
+    """
+    fields.remove('extensions')
+    fields.remove('passphrase')
+    return fields
+
+
+class CaDetailSerializer(BaseSerializer):
+    class Meta:
+        model = Ca
+        fields = CaDetail_fields(CaListSerializer.Meta.fields[:])
+        read_only_fields = fields[4:]
+
+
+class CaRenewSerializer(CaDetailSerializer):
+    class Meta(CaDetailSerializer.Meta):
+        read_only_fields = CaDetailSerializer.Meta.fields
+
+
+def get_import_data(instance):
+    data = {
+        'name': instance.name,
+        'organization': instance.organization,
+        'key_length': instance.key_length,
+        'digest': instance.digest,
+        'validity_start': instance.validity_start,
+        'validity_end': instance.validity_end,
+        'country_code': instance.country_code,
+        'state': instance.state,
+        'city': instance.city,
+        'organization_name': instance.organization_name,
+        'organizational_unit_name': instance.organizational_unit_name,
+        'email': instance.email,
+        'common_name': instance.common_name,
+        'extensions': instance.extensions,
+        'serial_number': instance.serial_number,
+        'certificate': instance.certificate,
+        'private_key': instance.private_key,
+        'passphrase': instance.passphrase,
+    }
+    return data
+
+
+def CertList_fields(fields=None):
+    """
+    Returns the fields for the `CertListSerializer`.
+    """
+    fields.insert(3, 'ca')
+    fields.insert(5, 'revoked')
+    fields.insert(6, 'revoked_at')
+    return fields
+
+
+class CertListSerializer(BaseSerializer):
+
+    extensions = serializers.JSONField(
+        initial=[],
+        help_text=_('additional x509 certificate extensions'),
+        required=False,
+    )
+    include_shared = True
+
+    class Meta:
+        model = Cert
+        fields = CertList_fields(CaListSerializer.Meta.fields[:])
+        read_only_fields = ['created', 'modified']
+        extra_kwargs = {
+            'revoked': {'read_only': True},
+            'revoked_at': {'read_only': True},
+            'key_length': {'initial': '2048'},
+            'digest': {'initial': 'sha256'},
+            'validity_start': {'default': default_validity_start()},
+            'validity_end': {'default': default_cert_validity_end()},
+        }
+
+    def validate(self, data):
+        instance = self.instance or self.Meta.model(**data)
+        instance.full_clean()
+        if data.get('certificate') and data.get('private_key'):
+            data = get_import_data(instance)
+            data.update({'ca': instance.ca})
+        return data
+
+    def validate_validity_start(self, value):
+        if value is None:
+            value = default_validity_start()
+        return value
+
+    def validate_validity_end(self, value):
+        if value is None:
+            value = default_cert_validity_end()
+        return value
+
+
+def CertDetail_fields(fields=None):
+    """
+    Returns the fields for the `CertDetailSerializer`.
+    """
+    fields.remove('extensions')
+    fields.remove('passphrase')
+    return fields
+
+
+class CertDetailSerializer(BaseSerializer):
+    class Meta:
+        model = Cert
+        fields = CertDetail_fields(CertListSerializer.Meta.fields[:])
+        read_only_fields = ['ca'] + fields[5:]
+
+
+class CertRevokeRenewSerializer(CertDetailSerializer):
+    class Meta(CertDetailSerializer.Meta):
+        read_only_fields = CertDetailSerializer.Meta.fields