cert-utils 0.2.0__tar.gz → 1.0.0__tar.gz

{cert_utils-0.2.0 → cert_utils-1.0.0}/CHANGES.txt

@@ -1,3 +1,20 @@
+1.0.0
+    * new_account_key supports LetsEncrypt updates to EC
+    * ALLOWED_CURVES_ECDSA is now a list of strings
+    * new_ec_key named argument is now curve(str)
+    * functions now require KeyTechnologyEnum, not KeyTechnology for key_technology_id
+    * added account_key__verify
+    * extended account_key__sign to accept `standardize_signature`; default True
+      for converting the EC signature to the encoding ACME requires
+    * corrected use of `secp256k1` to `secp256r1`
+    * `key_technology` concept of "RSA" and "EC" has been renamed to `key_technology_basic`
+    * `key_technology` concept is now a tuple of `(key_technology_basic, (data, ))`
+      For a RSA, the payload is:
+            ("rsa", (rsa_bits,))
+      For an EC, the payload is:
+            ("ec", (nist_curve_name,))
+    * validate_domains now accepts a wildcard
+
 0.2.0
     * replaced pyopenssl with cryptography.
       pyopenssl was originally used because certbot required it and this package

cert_utils-1.0.0/PKG-INFO

@@ -0,0 +1,208 @@
+Metadata-Version: 2.1
+Name: cert_utils
+Version: 1.0.0
+Summary: TLS/SSL Certiicate Utilities
+Home-page: https://github.com/aptise/cert_utils
+Author: Jonathan Vanasco
+Author-email: jonathan@findmeon.com
+License: MIT
+Description: ![Python package](https://github.com/jvanasco/cert_utils/workflows/Python%20package/badge.svg)
+        
+        cert_utils
+        ==========
+        
+        **cert_utils** offers support for common operations when dealing with SSL
+        Certificates, specifically within the LetsEncrypt ecosystem.
+        
+        This library was originally developed as a toolkit for bugfixing and
+        troubleshooting large ACME installations.
+        
+        **cert_utils** will attempt to process operations with Python via the modern
+        [Cryptography](https://cryptography.io/en/latest/) package when possible.
+        If the required Python libraries are not installed, it will fallback to using
+        OpenSSL commandline via subprocesses.  **cert_utils** does a bit of work to
+        standardize certificate operations across versions of Python and OpenSSL that
+        do not share the same inputs, outputs or invocations.
+        
+        **cert_utils** was formerly part of the
+        **[peter_sslers](https://github.com/aptise/peter_sslers)** ACME Client and
+        Certificate Management System, and has been descoped into it's own library.
+        
+        This library *does not* process Certificates and Certificate Data itself.
+        Instead, it offers a simplified API to invoke other libraries and extract data
+        from Certificates.  It was designed for developers and system administrators to
+        more easily use the various libraries to accomplish specific tasks on the
+        commandline or as part of other projects.
+        
+        This library now includes a utility, `cert_info`:
+        
+        Examples CLI:
+        -------------
+        
+        The CLI tool `cert_info` can parse a cert and pull the active ARI info.
+        
+        The tool accepts a filepath to a local file OR a https URL to be inspected live:
+        
+        > cert_info https://letsencrypt.org
+        
+        This will gnerate the output:
+        
+            ********************************************************************************
+            ********************************************************************************
+            Process URL:
+            url:  https://letsencrypt.org
+            =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+            Connection Data:
+            {'cert_dict': {'OCSP': ('http://e6.o.lencr.org',),
+                           'caIssuers': ('http://e6.i.lencr.org/',),
+                           'issuer': ((('countryName', 'US'),),
+                                      (('organizationName', "Let's Encrypt"),),
+                                      (('commonName', 'E6'),)),
+                           'notAfter': 'Mar  7 14:44:04 2025 GMT',
+                           'notBefore': 'Dec  7 14:44:05 2024 GMT',
+                           'serialNumber': '04C7A73A361AC02B67BDBD6AF210285B1CC7',
+                           'subject': ((('commonName', 'letsencrypt.org'),),),
+                           'subjectAltName': (('DNS', 'lencr.org'),
+                                              ('DNS', 'letsencrypt.com'),
+                                              ('DNS', 'letsencrypt.org'),
+                                              ('DNS', 'www.lencr.org'),
+                                              ('DNS', 'www.letsencrypt.com'),
+                                              ('DNS', 'www.letsencrypt.org')),
+                           'version': 3},
+             'cert_pem': '-----BEGIN CERTIFICATE-----\n'
+                         'MIID1DCCA1qgAwIBAgISBMenOjYawCtnvb1q8hAoWxzHMAoGCCqGSM49BAMDMDIx\n'
+                         'CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF\n'
+                         'NjAeFw0yNDEyMDcxNDQ0MDVaFw0yNTAzMDcxNDQ0MDRaMBoxGDAWBgNVBAMTD2xl\n'
+                         'dHNlbmNyeXB0Lm9yZzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDgHHaIeMwYz\n'
+                         'APO9ZgfeGansUeFRN0sW4K23nrVppRXfjHvN+83vtH170hshCrIAZRJCL+CPcA2N\n'
+                         'UqmLiSdM/M+jggJmMIICYjAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYB\n'
+                         'BQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFD2MLtcnwBWM\n'
+                         'FukcX4wMfYCQUCMAMB8GA1UdIwQYMBaAFJMnRpgDqVFojpjWxEJI2yO/WJTSMFUG\n'
+                         'CCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0cDovL2U2Lm8ubGVuY3Iub3Jn\n'
+                         'MCIGCCsGAQUFBzAChhZodHRwOi8vZTYuaS5sZW5jci5vcmcvMG8GA1UdEQRoMGaC\n'
+                         'CWxlbmNyLm9yZ4IPbGV0c2VuY3J5cHQuY29tgg9sZXRzZW5jcnlwdC5vcmeCDXd3\n'
+                         'dy5sZW5jci5vcmeCE3d3dy5sZXRzZW5jcnlwdC5jb22CE3d3dy5sZXRzZW5jcnlw\n'
+                         'dC5vcmcwEwYDVR0gBAwwCjAIBgZngQwBAgEwggEEBgorBgEEAdZ5AgQCBIH1BIHy\n'
+                         'APAAdgB9WR4S4XgqexxhZ3xe/fjQh1wUoE6VnrkDL9kOjC55uAAAAZOhyXh9AAAE\n'
+                         'AwBHMEUCIAXoVc0BRK6ELL0Q1lHv+QbrobnBiPthcr2E7g0IulkHAiEAlVkiVkF9\n'
+                         '7KeR/At3XdJNRYbJda0iKaKtqKy0KH7igZgAdgATSt8atZhCCXgMb+9MepGkFrcj\n'
+                         'Sc5YV2rfrtqnwqvgIgAAAZOhyXk0AAAEAwBHMEUCIQD+yhm/6lwMMWyxBaB15Mkh\n'
+                         'g3tsQCtr0DOD4uvAzc63FAIgHgjXduGCbB/3VTtRCGWfmkWSS9z+CjfO1O6hkzGW\n'
+                         'XBowCgYIKoZIzj0EAwMDaAAwZQIxAKVLzxW03Kk8qJMBtWQCw5dgSHNWOGG9Oq03\n'
+                         'XOGr8092sx9Ezz3XsXWeq8JvokFjhAIwCZOX/UjxdHfgV/O6gkiNARQ1FokDyfS0\n'
+                         'ClynPk9psMTPVl5QWgYJzjVrJagAjtJm\n'
+                         '-----END CERTIFICATE-----\n',
+             'peername': ('100.28.201.155', 443)}
+            =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+            =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+            Cert Data:
+            ARI ID: kydGmAOpUWiOmNbEQkjbI79YlNI.BMenOjYawCtnvb1q8hAoWxzH
+            =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+            Requesting ARI
+            ari_url: https://acme-v02.api.letsencrypt.org/draft-ietf-acme-ari-03/renewalInfo/kydGmAOpUWiOmNbEQkjbI79YlNI.BMenOjYawCtnvb1q8hAoWxzH
+            {'Server': 'nginx', 'Date': 'Tue, 10 Dec 2024 18:29:04 GMT', 'Content-Type': 'application/json', 'Content-Length': '101', 'Connection': 'keep-alive', 'Cache-Control': 'public, max-age=0, no-cache', 'Link': '<https://acme-v02.api.letsencrypt.org/directory>;rel="index"', 'Retry-After': '21600', 'X-Frame-Options': 'DENY', 'Strict-Transport-Security': 'max-age=604800'}
+            - - - - - - - - - - 
+            {'suggestedWindow': {'end': '2025-02-06T15:03:34Z',
+                                 'start': '2025-02-04T15:03:34Z'}}
+        
+        
+        Examples API:
+        -------------
+        
+        For example, `cert_utils.parse_cert` returns a Python dict of key fields in a
+        certificate.  This can make writing a script to analyze large directories of
+        certificates fairly simple.
+        
+        
+        ### Parse a Leaf/End-Entity
+        
+        Example Script:
+        
+        ```!python
+        import cert_utils
+        import pprint
+        
+        cert_path = "./tests/test_data/unit_tests/cert_001/cert.pem"
+        cert_pem = open(cert_path, 'r').read()
+        data = cert_utils.parse_cert(cert_pem)
+        pprint.pprint(data)
+        ```
+        
+        Result:
+        
+            {'SubjectAlternativeName': ['a.example.com',
+                                        'b.example.com',
+                                        'c.example.com',
+                                        'd.example.com'],
+             'authority_key_identifier': 'D159010094B0A62ADBABE54B2321CA1B6EBA93E7',
+             'enddate': datetime.datetime(2025, 6, 16, 20, 19, 30),
+             'fingerprint_sha1': 'F63C5C66B52551EEDADF7CE44301D646680B8F5D',
+             'issuer': 'CN=Pebble Intermediate CA 601ea1',
+             'issuer_uri': None,
+             'key_technology': 'RSA',
+             'spki_sha256': '34E67CC615761CBADAF430B2E02E0EC39C99EEFC73CCE469B18AE54A37EF6942',
+             'startdate': datetime.datetime(2020, 6, 16, 20, 19, 30),
+             'subject': 'CN=a.example.com'}
+        
+        The payload contains `SubjectAlternativeName` listing all the domains, along
+        with `enddate` and `startdate` in Python datetime objects for easy comparison.
+        
+        ### Parse a Trusted Root
+        
+        Example Script:
+        
+        ```!python
+        import cert_utils
+        import pprint
+        
+        cert_path = "./src/cert_utils/letsencrypt-certs/isrgrootx1.pem"
+        cert_pem = open(cert_path, 'r').read()
+        data = cert_utils.parse_cert(cert_pem)
+        pprint.pprint(data)
+        ```
+        
+        Result:
+        
+            {'SubjectAlternativeName': None,
+             'authority_key_identifier': None,
+             'enddate': datetime.datetime(2035, 6, 4, 11, 4, 38),
+             'fingerprint_sha1': 'CABD2A79A1076A31F21D253635CB039D4329A5E8',
+             'issuer': 'C=US\nO=Internet Security Research Group\nCN=ISRG Root X1',
+             'issuer_uri': None,
+             'key_technology': 'RSA',
+             'spki_sha256': '0B9FA5A59EED715C26C1020C711B4F6EC42D58B0015E14337A39DAD301C5AFC3',
+             'startdate': datetime.datetime(2015, 6, 4, 11, 4, 38),
+             'subject': 'C=US\nO=Internet Security Research Group\nCN=ISRG Root X1'}
+        
+        The payload on Trusted Roots is identical.
+        
+        
+        Why does this exist?
+        --------------------
+        
+        The [peter_sslers](https://github.com/aptise/peter_sslers) project was designed
+        to deploy on a wide variety of production servers that did not share common
+        Python and OpenSSL installations.  Earlier versions of the library
+        (within peter_sslers) supported both Python2.7 and Python3, as it was common to
+        encounter a machine that did not have Python3 installed.  Although it is still
+        common to find these machines, Python2.7 was dropped to take advantage of
+        typing.  Depending on the version of OpenSSL installed on a system,
+        **cert_utils** will invoke the binary or regex the output to bridge support
+        through a unified interface.
+        
+Keywords: web
+Platform: UNKNOWN
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: License :: OSI Approved :: MIT License
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+Provides-Extra: testing

{cert_utils-0.2.0 → cert_utils-1.0.0}/setup.py

@@ -1,5 +1,6 @@
 """metadata_utils installation script.
 """
+
 import os
 import re
 
@@ -21,7 +22,7 @@ requires = [
     "python-dateutil",
     "psutil>=4.4.0",  # for Python2/3 compat
     "requests",
-    "typing_extensions",
+    "typing_extensions",  # Literal, Required, TypeDict
 ]
 tests_require = [
     "certbot",
@@ -46,7 +47,7 @@ setup(
     author="Jonathan Vanasco",
     author_email="jonathan@findmeon.com",
     zip_safe=False,
-    python_requires=">=3.6",
+    python_requires=">=3.7",
     keywords="web",
     install_requires=requires,
     tests_require=tests_require,

{cert_utils-0.2.0 → cert_utils-1.0.0}/src/cert_utils/__init__.py

@@ -1,7 +1,8 @@
 from .convert import *  # noqa: F401, F403
 from .core import *  # noqa: F401, F403
+from .model import *  # noqa: F401, F403
 from .utils import *  # noqa: F401, F403
 
 # ==============================================================================
 
-__VERSION__ = "0.2.0"
+__VERSION__ = "1.0.0"

{cert_utils-0.2.0 → cert_utils-1.0.0}/src/cert_utils/compat/cryptography.py

@@ -11,6 +11,8 @@ from typing import Union
 # locals
 from .. import conditionals
 from ..utils import CERT_PEM_REGEX
+from ..utils import curve_to_nist
+from ..utils import TECHNOLOGY_RETURN_VALUES
 
 if TYPE_CHECKING:
     from cryptography.x509 import Certificate
@@ -52,20 +54,24 @@ def _format_cryptography_components(
 
 def _cryptography__public_key_technology(
     publickey: "_TYPES_CRYPTOGRAPHY_PUBLICKEY",
-) -> Optional[str]:
+) -> Optional[TECHNOLOGY_RETURN_VALUES]:
     """
     :param key: key object
     :type key: instance of
-    :returns: type of key: RSA, EC, DSA
-    :rtype: str
+    :returns: If the key is valid, it will return a Tuple wherein
+        - The first element is the Key's technology (EC, RSA)
+        - The second element is a Tuple with the key's type.
+            (RSA, (bits, ))
+            (EC, (curve_name, ))
     """
     if TYPE_CHECKING:
         assert conditionals.crypto_rsa is not None
         assert conditionals.crypto_ec is not None
     if isinstance(publickey, conditionals.crypto_rsa.RSAPublicKey):
-        return "RSA"
+        return ("RSA", (publickey.key_size,))
     elif isinstance(publickey, conditionals.crypto_ec.EllipticCurvePublicKey):
-        return "EC"
+        curve_name = curve_to_nist(publickey.curve.name)
+        return ("EC", (curve_name,))
     return None
 
 

{cert_utils-0.2.0 → cert_utils-1.0.0}/src/cert_utils/compat/openssl.py

@@ -1,5 +1,6 @@
 # stdlib
 import binascii
+import re
 import subprocess
 from typing import List
 from typing import Optional
@@ -18,10 +19,59 @@ from ..errors import OpenSslError_InvalidCSR
 from ..errors import OpenSslError_InvalidKey
 from ..errors import OpenSslError_VersionTooLow
 from ..utils import new_pem_tempfile
+from ..utils import TECHNOLOGY_RETURN_VALUES
 
 # ==============================================================================
 
 
+# note the conditional whitespace before/after `CN`
+# this is because of differing openssl versions
+RE_openssl_x509_subject = re.compile(r"Subject:.*? CN ?= ?([^\s,;/]+)")
+RE_openssl_x509_san = re.compile(
+    r"X509v3 Subject Alternative Name: ?\n +([^\n]+)\n?", re.MULTILINE | re.DOTALL
+)
+
+
+# openssl 3 does not have "keyid:" as a prefix
+# a keyid prefix is okay!
+# we do not want the alternates, which are uri+serial; but take that out in results
+RE_openssl_x509_authority_key_identifier = re.compile(
+    r"X509v3 Authority Key Identifier: ?\n +(?:keyid:)?([^\n]+)\n?",
+    re.MULTILINE | re.DOTALL,
+)
+# we have a potential line in there for the OSCP or something else.
+RE_openssl_x509_issuer_uri = re.compile(
+    r"Authority Information Access: ?\n(?:[^\n]*^\n)? +CA Issuers - URI:([^\n]+)\n?",
+    re.MULTILINE | re.DOTALL,
+)
+
+RE_openssl_x509_serial = re.compile(r"Serial Number: ?(\d+)")
+
+
+# depending on openssl version, the "Public key: " text might list the bits
+# it may or may not also have a dash in the phrase "Public Key"
+# it may or may not be prefaced with the PublicKey type
+RE_openssl_x509_keytype_rsa = re.compile(
+    r"Subject Public Key Info:\n"
+    r"\s+Public Key Algorithm: rsaEncryption\n"
+    r"\s+(?:RSA )?Public[\-\ ]?Key: \((\d+) bits?\)",
+    re.MULTILINE,
+)
+RE_openssl_x509_keytype_ec = re.compile(
+    r"Subject Public Key Info:\n"
+    r"\s+Public Key Algorithm: id-ecPublicKey\n"
+    r"\s+(?:EC )?Public[\-\ ]?Key: \((\d+) bits?\)\n"
+    r"\s+pub:\n"
+    r"[\s\d\w\:]+"
+    r"(?:"
+    r"(?:\s+ASN1 OID: ([\w]+)\n)"
+    r"|"
+    r"(?:\s+NIST CURVE: ([\-\w]+)\n)"
+    r")",
+    re.MULTILINE,
+)
+
+
 def _cleanup_openssl_modulus(data: str) -> str:
     data = data.strip()
     if data[:8] == "Modulus=":
@@ -144,13 +194,13 @@ def _openssl_cert__normalize_pem(cert_pem: str) -> str:
 
 
 def _openssl_spki_hash_cert(
-    key_technology: str = "",
+    key_technology_basic: str = "",
     cert_pem_filepath: str = "",
     as_b64: Optional[bool] = None,
 ) -> str:
     """
-    :param key_technology: Is the key an "EC" or "RSA" key?
-    :type key_technology: str
+    :param key_technology_basic: Is the key an "EC" or "RSA" key?
+    :type key_technology_basic: str
     :param cert_pem_filepath: REQUIRED filepath to PEM Certificate.
                               Used for commandline OpenSSL fallback operations.
     :type cert_pem_filepath: str
@@ -162,13 +212,13 @@ def _openssl_spki_hash_cert(
     The OpenSSL Equivalent / Fallback is::
 
         openssl x509 -pubkey -noout -in {CERT_FILEPATH} | \
-        openssl {key_technology} -pubout -outform DER -pubin | \
+        openssl {key_technology_basic} -pubout -outform DER -pubin | \
         openssl dgst -sha256 -binary | \
         openssl enc -base64
     """
-    if key_technology not in ("EC", "RSA"):
-        raise ValueError("must submit `key_technology`")
-    key_technology = key_technology.lower()
+    if key_technology_basic not in ("EC", "RSA"):
+        raise ValueError("must submit `key_technology_basic`")
+    key_technology_basic = key_technology_basic.lower()
     if not cert_pem_filepath:
         raise FallbackError_FilepathRequired("Must submit `cert_pem_filepath`.")
     if core.openssl_version is None:
@@ -195,7 +245,7 @@ def _openssl_spki_hash_cert(
         p2 = psutil.Popen(
             [
                 core.openssl_path,
-                key_technology,
+                key_technology_basic,
                 "-pubin",
                 "-pubout",
                 "-outform",
@@ -261,13 +311,13 @@ def _openssl_spki_hash_cert(
 
 
 def _openssl_spki_hash_csr(
-    key_technology: str = "",
+    key_technology_basic: str = "",
     csr_pem_filepath: str = "",
     as_b64: Optional[bool] = None,
 ) -> str:
     """
-    :param key_technology: Is the key an "EC" or "RSA" key?
-    :type key_technology: str
+    :param key_technology_basic: Is the key an "EC" or "RSA" key?
+    :type key_technology_basic: str
     :param csr_pem_filepath: REQUIRED filepath to PEM CSR.
                              Used for commandline OpenSSL fallback operations.
     :type csr_pem_filepath: str
@@ -279,13 +329,13 @@ def _openssl_spki_hash_csr(
     The OpenSSL Equivalent / Fallback is::
 
         openssl REQ -pubkey -noout -in {CSR_FILEPATH} | \
-        openssl {key_technology} -pubout -outform DER -pubin | \
+        openssl {key_technology_basic} -pubout -outform DER -pubin | \
         openssl dgst -sha256 -binary | \
         openssl enc -base64
     """
-    if key_technology not in ("EC", "RSA"):
-        raise ValueError("must submit `key_technology`")
-    key_technology = key_technology.lower()
+    if key_technology_basic not in ("EC", "RSA"):
+        raise ValueError("must submit `key_technology_basic`")
+    key_technology_basic = key_technology_basic.lower()
     if not csr_pem_filepath:
         raise FallbackError_FilepathRequired("Must submit `csr_pem_filepath`.")
     if core.openssl_version is None:
@@ -312,7 +362,7 @@ def _openssl_spki_hash_csr(
         p2 = psutil.Popen(
             [
                 core.openssl_path,
-                key_technology,
+                key_technology_basic,
                 "-pubin",
                 "-pubout",
                 "-outform",
@@ -377,13 +427,13 @@ def _openssl_spki_hash_csr(
 
 
 def _openssl_spki_hash_pkey(
-    key_technology: str = "",
+    key_technology_basic: str = "",
     key_pem_filepath: str = "",
     as_b64: Optional[bool] = None,
 ) -> str:
     """
-    :param key_technology: Is the key an "EC" or "RSA" key?
-    :type key_technology: str
+    :param key_technology_basic: Is the key an "EC" or "RSA" key?
+    :type key_technology_basic: str
     :param key_pem_filepath: REQUIRED filepath to PEM encoded PrivateKey.
                              Used for commandline OpenSSL fallback operations.
     :type key_pem_filepath: str
@@ -398,9 +448,9 @@ def _openssl_spki_hash_pkey(
         openssl dgst -sha256 -binary | \
         openssl enc -base64
     """
-    if key_technology not in ("EC", "RSA"):
-        raise ValueError("must submit `key_technology`")
-    key_technology = key_technology.lower()
+    if key_technology_basic not in ("EC", "RSA"):
+        raise ValueError("must submit `key_technology_basic`")
+    key_technology_basic = key_technology_basic.lower()
     if not key_pem_filepath:
         raise FallbackError_FilepathRequired("Must submit `key_pem_filepath`.")
     if core.openssl_version is None:
@@ -414,7 +464,7 @@ def _openssl_spki_hash_pkey(
         p1 = psutil.Popen(
             [
                 core.openssl_path,
-                key_technology,
+                key_technology_basic,
                 "-pubout",
                 "-outform",
                 "DER",
@@ -699,3 +749,109 @@ def key_single_op__pem_filepath(
         data_str = data_bytes.decode("utf8")
         data_str = data_str.strip()
     return data_str
+
+
+def san_domains_from_text(text: str) -> List[str]:
+    """
+    Helper function to extract SAN domains from a chunk of text in a x509 object
+
+    :param text: string extracted from a x509 document
+    :type text: str
+    :returns: list of domains
+    :rtype: list
+    """
+    san_domains = set([])
+    _subject_alt_names = RE_openssl_x509_san.search(text)
+    if _subject_alt_names is not None:
+        for _san in _subject_alt_names.group(1).split(", "):
+            if _san.startswith("DNS:"):
+                san_domains.add(_san[4:].lower())
+    return sorted(list(san_domains))
+
+
+def authority_key_identifier_from_text(text: str) -> Optional[str]:
+    """
+    :param text: string extracted from a x509 document
+    :type text: str
+    :returns: authority_key_identifier
+    :rtype: str
+
+    openssl will print a uppercase hex pairs, separated by a colon
+    we should remove the colons
+    """
+    results = RE_openssl_x509_authority_key_identifier.findall(text)
+    if results:
+        authority_key_identifier = results[0]
+        # ensure we have a key_id and not "URI:" or other convention
+        if authority_key_identifier[2] == ":":
+            return authority_key_identifier.replace(":", "")
+    return None
+
+
+def serial_from_text(text: str) -> Optional[int]:
+    """
+    :param text: string extracted from a x509 document
+    :type text: str
+    :returns: serial
+    :rtype: int
+    """
+    results = RE_openssl_x509_serial.findall(text)
+    if results:
+        serial = results[0]
+        return int(serial)
+    return None
+
+
+def issuer_uri_from_text(text: str) -> Optional[str]:
+    """
+    :param text: string extracted from a x509 document
+    :type text: str
+    :returns: issuer_uri
+    :rtype: str
+    """
+    results = RE_openssl_x509_issuer_uri.findall(text)
+    if results:
+        return results[0]
+    return None
+
+
+def _x509_pubkey_technology__text(cert_text: str) -> Optional[TECHNOLOGY_RETURN_VALUES]:
+    m = RE_openssl_x509_keytype_rsa.search(cert_text)
+    if m:
+        v = m.groups()
+        return ("RSA", (int(v[0]),))
+    m = RE_openssl_x509_keytype_ec.search(cert_text)
+    if m:
+        v = m.groups()
+        c = None
+        if v[2]:
+            c = v[2]
+        elif v[0]:
+            c = "P-%s" % v[0]
+        else:
+            # TODO? better parsing
+            return None
+        return ("EC", (c,))
+    return None
+
+
+def _cert_pubkey_technology__text(cert_text: str) -> Optional[TECHNOLOGY_RETURN_VALUES]:
+    """
+    :param cert_text: string extracted from a x509 document
+    :type cert_text: str
+    :returns: Pubkey type: "RSA" or "EC"
+    :rtype: strfRE_openssl_x509_keytype_rsa
+    """
+    # `cert_text` is the output of of `openssl x509 -noout -text -in MYCERT `
+    return _x509_pubkey_technology__text(cert_text)
+
+
+def _csr_pubkey_technology__text(csr_text: str) -> Optional[TECHNOLOGY_RETURN_VALUES]:
+    """
+    :param csr_text: string extracted from a CSR document
+    :type csr_text: str
+    :returns: Pubkey type: "RSA" or "EC"
+    :rtype: str
+    """
+    # `csr_text` is the output of of `openssl req -noout -text -in MYCERT`
+    return _x509_pubkey_technology__text(csr_text)

{cert_utils-0.2.0 → cert_utils-1.0.0}/src/cert_utils/compat/pyopenssl.py

@@ -8,6 +8,7 @@ more esoteric and not well documented elsewhere.
 
 Please use the other interfaces.
 """
+
 import logging
 from types import ModuleType
 from typing import List

{cert_utils-0.2.0 → cert_utils-1.0.0}/src/cert_utils/conditionals.py

@@ -1,5 +1,6 @@
 # stdlib
 from types import ModuleType
+from typing import Any
 from typing import Optional
 
 # ------------------------------------------------------------------------------
@@ -31,18 +32,22 @@ GOOD:
 
 """
 cryptography: Optional[ModuleType]
+crypto_x509: Optional[ModuleType]
+crypto_hashes: Optional[ModuleType]
+crypto_padding: Optional[ModuleType]
+crypto_serialization: Optional[ModuleType]
 crypto_dsa: Optional[ModuleType]
 crypto_ec: Optional[ModuleType]
 crypto_ed25519: Optional[ModuleType]
 crypto_ed448: Optional[ModuleType]
-crypto_hashes: Optional[ModuleType]
-crypto_padding: Optional[ModuleType]
-crypto_pkcs7: Optional[ModuleType]
 crypto_rsa: Optional[ModuleType]
-crypto_serialization: Optional[ModuleType]
-crypto_x509: Optional[ModuleType]
+crypto_utils: Optional[ModuleType]
+EllipticCurvePublicKey: Optional[Any]
+RSAPublicKey: Optional[Any]
+crypto_pkcs7: Optional[ModuleType]
 josepy: Optional[ModuleType]
 
+# first cryptography
 try:
     import cryptography
     import cryptography.x509 as crypto_x509
@@ -54,20 +59,27 @@ try:
     from cryptography.hazmat.primitives.asymmetric import ed25519 as crypto_ed25519
     from cryptography.hazmat.primitives.asymmetric import ed448 as crypto_ed448
     from cryptography.hazmat.primitives.asymmetric import rsa as crypto_rsa
+    from cryptography.hazmat.primitives.asymmetric import utils as crypto_utils
+    from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey
+    from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
     from cryptography.hazmat.primitives.serialization import pkcs7 as crypto_pkcs7
 except ImportError:
     cryptography = None
     crypto_x509 = None
+    crypto_hashes = None
+    crypto_padding = None
+    crypto_serialization = None
     crypto_dsa = None
     crypto_ec = None
     crypto_ed25519 = None
     crypto_ed448 = None
-    crypto_hashes = None
-    crypto_padding = None
-    crypto_pkcs7 = None
     crypto_rsa = None
-    crypto_serialization = None
+    crypto_utils = None
+    EllipticCurvePublicKey = None
+    RSAPublicKey = None
+    crypto_pkcs7 = None
 
+# then josepy
 try:
     import josepy
 except ImportError: