Use jwcrypto to generate JWK instead of `cryptography.hazmat` directly
@@ -34,10 +34,10 @@ import sys
import tempfile
import uuid
-import uvloop
-
import click
+from jwcrypto import jwk
import setproctitle
+import uvloop
from . import logsetup
logsetup.early_setup()
@@ -332,20 +332,10 @@ def _generate_cert(
def _generate_jose_keys(keys_file: pathlib.Path) -> None:
logger.info(f'generating JOSE key pair in "{keys_file}"')
- from cryptography.hazmat import backends
- from cryptography.hazmat.primitives import serialization
- from cryptography.hazmat.primitives.asymmetric import ec
-
- backend = backends.default_backend()
- private_key = ec.generate_private_key(ec.SECP256R1(), backend=backend)
+ key = jwk.JWK(generate='EC')
with keys_file.open("wb") as f:
- f.write(
- private_key.private_bytes(
- encoding=serialization.Encoding.PEM,
- format=serialization.PrivateFormat.PKCS8,
- encryption_algorithm=serialization.NoEncryption(),
- )
- )
+ f.write(key.export_to_pem(private_key=True, password=None))
+
keys_file.chmod(0o600)
