certapi 0.1.0__py3-none-any.whl

certapi/Acme.py

@@ -0,0 +1,386 @@
+import os
+import re
+import threading
+from typing import Union, List, Tuple
+import json
+from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+from cryptography.x509 import CertificateSigningRequest, Certificate
+from . import crypto
+import requests
+from .crypto import sign, digest_sha256, csr_to_der, jwk, get_algorithm_name
+from .util import b64_encode, b64_string
+
+# acme_url = os.environ.get("LETSENCRYPT_API", "https://acme-staging-v02.api.letsencrypt.org/directory")
+acme_url = os.environ.get("LETSENCRYPT_API", "https://acme-v02.api.letsencrypt.org/directory")
+
+
+class AcmeError(Exception):
+    def __init__(self, message, detail, step):
+        super().__init__(step,message)
+        self.message: str = message
+        self.step: str = step
+        self.detail: dict = detail
+
+    def json_obj(self) -> dict:
+        return {"message": self.message, "step": self.step, "detail": self.detail}
+
+
+class AcmeNetworkError(AcmeError, requests.RequestException):
+    """
+    There was an error connecting/communicating with the AcmeServer.
+    """
+
+    def __init__(self, request: requests.Request, message, detail, step):
+        # Initialize both parent classes
+        requests.RequestException.__init__(self, request=request)
+        AcmeError.__init__(self, message, detail, step)
+        requests.RequestException.__init__(self, request=request)  # Pass message to RequestException
+
+
+class AcmeHttpError(AcmeError, requests.HTTPError):
+    """
+    Acme Server replied with error status.
+    """
+
+    def __init__(self, response: requests.Response, step: str):
+        requests.HTTPError.__init__(self, response=response)
+        self.response=response
+        (message, detail) = self.extract_acme_response_error()
+        AcmeError.__init__(self, message, detail, step)
+
+    def extract_acme_response_error(self):
+        message = None
+        error = None
+        try:
+            res_json = self.response.json()
+            if res_json["status"] == "invalid":
+                if res_json["challenges"]:
+                    failed_challenge: dict = [x for x in res_json["challenges"] if x["status"] == "invalid"][0]
+                    error = failed_challenge["error"]
+                    err_detail: str = error.get("detail")
+                    validation_record: dict = failed_challenge.get("validationRecord")
+                    error = {
+                        "url": failed_challenge["url"],
+                    }
+                    if validation_record is None:
+                        # Search for the pattern and extract the content
+                        if err_detail.startswith("DNS problem: NXDOMAIN"):
+                            error["dns"] = {"error": "DNS record doesn't exist"}
+                            error["hostname"] = re.findall(r"looking up [A-Z]+ for ([\w.-]+)", err_detail)[0]
+                            message = error["hostname"] + " doesn't have a valid DNS record"
+                        else:
+                            error["dns"] = {"error": err_detail}
+                            message = err_detail
+                    else:
+                        validation_record = validation_record[0]
+                        error["hostname"] = validation_record["hostname"]
+                        error["dns"] = {
+                            "resolved": validation_record["addressesResolved"],
+                            "used": validation_record["addressUsed"],
+                        }
+                        err_detail: str = error["detail"]
+                        if error["type"] == "urn:ietf:params:acme:error:connection":
+                            if "Timeout during connect" in err_detail:
+                                error["connect"] = {"error": "Timeout"}
+                                message = (
+                                    error["hostname"]
+                                    + "["
+                                    + validation_record["addressUsed"]
+                                    + ":"
+                                    + validation_record["port"]
+                                    + "] Connect Timeout (Maybe firewall reasons)"
+                                )
+                            elif err_detail.endswith("Connection refused"):
+                                error["connect"] = {"error": "connection refused"}
+                                message = (
+                                    error["hostname"]
+                                    + "["
+                                    + validation_record["addressUsed"]
+                                    + ":"
+                                    + validation_record["port"]
+                                    + "] Connection Refused (Is http server running?)"
+                                )
+                            else:
+                                message = err_detail
+                        else:
+                            pattern = r'Invalid response from .*?: "(.*)"'
+
+                            match = re.search(pattern, err_detail)
+
+                            if match:
+                                error["response"] = (match.group(1) if match is not None else err_detail,)
+                                error["status_code"] = (error["status"],)
+                                message = (
+                                    error["hostname"]
+                                    + " Status="
+                                    + error["status"]
+                                    + ": Invalid response in challenge url"
+                                )
+                            else:
+                                message = err_detail
+
+            if message is None:
+                if res_json.get('detail'):
+                    message = res_json['detail']
+                else:
+                    message = "Received status=" + str(self.response.status_code) + " from AMCE server"
+            if error is None:
+                error = res_json
+
+            return (message, error)
+
+        except requests.RequestException as e:
+            message = "Received status=" + str(self.response.status_code) + " from AMCE server"
+            error = {"url": self.response.request.url, "response": self.response.text}
+            return (message, error)
+
+
+class AcmeInvaliOrderError(AcmeHttpError):
+    def __init__(self, response: requests.Response, step: str):
+        super().__init__(response, step)
+
+
+def request(method, step: str, url: str, json=None, headers=None, throw=True) -> requests.Response:
+    res=None
+    try:
+        res = requests.request(method, url, json=json, headers=headers, timeout=15)
+        print("Request ["+str(res.status_code)+"] : " + method + " " + url + " step=" + step)
+    except requests.HTTPError as e:
+        status = res.status_code if res else None
+        status = status if status else (e.response.status_code if e.response else None)
+        if status:
+            print("Request ["+str(status)+"] : " + method + " " + url + " step=" + step)
+        else:
+            print("Request : " + method + " " + url + " step=" + step)
+
+        raise e
+    except requests.RequestException as e:
+        print("Request : " + method + " " + url + " step=" + step)
+        raise AcmeNetworkError(
+            e.request,
+            f"Error communicating with ACME server",
+            {
+                "errorType": e.__class__.__name__,
+                "message": str(e),
+                "method": method,
+                "url": e.request.url if e.request else None,
+            },
+            step,
+        )
+    if 199 <= res.status_code > 299:
+        if throw:
+            raise AcmeHttpError(res, step=step)
+    return res
+
+
+def post(step: str, url: str, json=None, headers=None, throw=True) -> requests.Response:
+    return request("POST", step, url, json=json, headers=headers, throw=throw)
+
+
+def get(step: str, url) -> requests.Response:
+    return request("GET", step, url)
+
+
+class Acme:
+
+    URL_STAGING = "https://acme-staging-v02.api.letsencrypt.org/directory"
+    URL_PROD = "https://acme-v02.api.letsencrypt.org/directory"
+
+    def __init__(self, account_key: Union[RSAPrivateKey, EllipticCurvePrivateKey], url=acme_url):
+        self.account_key = account_key
+        # json web key format for public key
+        self.jwk = jwk(self.account_key)
+        self.nonce = []
+        self.acme_url = url
+        self.key_id = None
+        self.directory = None
+        self._nonce_lock = threading.Lock()  # Mutex for safe access to nonce
+
+    def setup(self):
+        if self.directory is None:
+            self.directory = get("Fetch Acme Directory", self.acme_url).json()
+
+    def _directory(self, key):
+        if not self.directory:
+            self.directory = get("Fetch Acme Directory", self.acme_url).json()
+        return self.directory[key]
+
+    def _directory_req(self, path_name, payload, depth=0):
+        url = self._directory(path_name)
+        return self._signed_req(url, payload, depth, step="Acme request:" + path_name)
+
+    def _signed_req(
+        self, url, payload: Union[str, dict, list, bytes, None] = None, depth=0, step="Acme Request", throw=True
+    ) -> requests.Response:
+        payload64 = b64_encode(payload) if payload is not None else b""
+        nonce = None
+        with self._nonce_lock:  # Acquire lock to ensure thread-safe access to nonce
+            # Check if there are any nonces available
+            if self.nonce:
+                # Pop the first nonce from the list
+                nonce = self.nonce.pop(0)
+
+                # Fetch a new nonce if the list is empty
+        nonce = (
+            nonce
+            if nonce
+            else get(
+                step + " > Fetch new Nonce" if step else "Fetch new Nonce from Acme", self._directory("newNonce")
+            ).headers.get("Replay-Nonce")
+        )
+
+        protected = {
+            "url": url,
+            "alg": get_algorithm_name(self.account_key),
+            "nonce": nonce,
+        }
+
+        if self.key_id:
+            protected["kid"] = self.key_id
+        else:
+            protected["jwk"] = self.jwk
+        protectedb64 = b64_encode(protected)
+        payload = {
+            "protected": protectedb64.decode("utf-8"),
+            "payload": payload64.decode("utf-8"),
+            "signature": b64_string(sign(self.account_key, b".".join([protectedb64, payload64]))),
+        }
+
+        response = post(step, url, json=payload, headers={"Content-Type": "application/jose+json"}, throw=throw)
+        if response.status_code > 299 or response.status_code < 200 :
+            print("-" * 30 + " Request  " + "-" * 30)
+            print(response.status_code, " : ", url)
+            print("status:", response.status_code)
+            print(json.dumps({x[0]: x[1] for x in response.headers.items()}, indent=2))
+            print(response.text)
+            print("-" * 60)
+
+        with self._nonce_lock:
+            self.nonce.append(response.headers.get("Replay-Nonce", None))
+        return response
+
+    def register(self):
+        response = self._directory_req("newAccount", {"termsOfServiceAgreed": True})
+        if "location" in response.headers:
+            self.key_id = response.headers["location"]
+        return response
+
+    def create_authorized_order(self, domains: List[str]) -> "Order":
+        payload = {"identifiers": [{"type": "dns", "value": d} for d in domains]}
+        res = self._directory_req("newOrder", payload)
+        res_json = res.json()
+        challenges = []
+        for auth_url in res_json["authorizations"]:
+            auth_res = self._signed_req(auth_url, None, step="Authorize Created Order")
+            challenges.append(Challenge(auth_url, auth_res.json(), self))
+        return Order(res.headers["location"], res_json, challenges, self)
+
+    def authorize_order(self, auth_url):
+        return self._signed_req(auth_url, None, step="Authorize Created Order")
+
+    def verify_challenge(self, challenge_url):
+        return self._signed_req(challenge_url, {}, step="Verify Challenge")
+
+    def finalize_order(self):
+        pass
+
+
+class Order:
+    def __init__(self, url, data, challenges, acme):
+        self.url = url
+        self._data = data
+        self.all_challenges = challenges
+        self._acme = acme
+        self.status = "pending"
+
+    def remaining_challenges(self) -> List["Challenge"]:
+        return [x for x in self.all_challenges if not x.verified]
+
+    def refresh(self):
+        response = get("Fetch order Status", self.url)
+        self._data = response.json()
+        self.status = self._data["status"]
+        return response
+
+    def get_certificate(self) -> Certificate:
+        if self.status == "processing":
+            raise ValueError(
+                "Order is still in 'processing' state! Wait until the order is finalized, and  call `Order.refresh()`  to update the state"
+            )
+        elif self.status != "valid":
+            raise ValueError("Order not in 'valid' state! Complete challenge and call finalize()")
+
+        certificate_res = self._acme._signed_req(
+            self._data["certificate"], step="Get Certificate from Successful Order"
+        )
+        certificate = crypto.x509.load_pem_x509_certificate(certificate_res.content)
+        return certificate
+
+    def finalize(self, csr: CertificateSigningRequest):
+        """
+        :param csr: Private key for the
+        """
+        finalized = self._acme._signed_req(
+            self._data["finalize"], {"csr": b64_string(csr_to_der(csr))}, step="Order Finalize"
+        )
+        finalized_json = finalized.json()
+        self._data = finalized_json
+        self.status = finalized_json["status"]
+
+
+class Challenge:
+    def __init__(self, auth_url, data, acme):
+        self._auth_url = auth_url
+        self._acme = acme
+        self._data = data
+        challenge = self.get_challenge()
+        self.token = challenge["token"]
+        self.verified = challenge["status"] == "valid"
+
+        jwk_json = json.dumps(self._acme.jwk, sort_keys=True, separators=(",", ":"))
+        thumbprint = b64_encode(digest_sha256(jwk_json.encode("utf8")))
+        self.authorization_key = "{0}.{1}".format(self.token, thumbprint.decode("utf-8"))
+
+        self.url = "http://{0}/.well-known/acme-challenge/{1}".format(data["identifier"]["value"], self.token)
+
+    def verify(self) -> bool:
+        if not self.verified:
+            response = self._acme._signed_req(self.get_challenge()["url"], {}, step="Verify Challenge", throw=False)
+            if response.status_code == 200 and response.json()["status"] == "valid":
+                self.verified = True
+                return True
+            return False
+        return True
+
+    def self_verify(self) -> Union[bool, requests.Response]:
+        identifier = self._data["identifier"]
+        if identifier["type"] == "dns":
+            res = get("Self Domain verification", self.url)
+            if res.status_code == 200 and res.content == self.token.encode():
+                return True
+            else:
+                return res
+        return False
+
+    def query_progress(self) -> bool:
+        if self.verified:
+            return True
+        else:
+            res = self._acme._signed_req(self._auth_url, step="Acme Challenge Verification")
+            res_json = res.json()
+            if res_json["status"] == "valid":
+                self.verified = True
+                return True
+            elif res_json["status"] == "invalid":
+                raise AcmeInvaliOrderError(res, "Acme Challenge Verification")
+            else:
+                return False
+
+    def get_challenge(self, key="http-01"):
+        for method in self._data["challenges"]:
+            if method["type"] == key:
+                return method
+        raise AcmeError(
+            "'http-01' not found in challenges", {"response": self._data["challenges"]}, "Acme Challenge Verification"
+        )

certapi/__init__.py

@@ -0,0 +1,5 @@
+from .Acme import Acme, Order, AcmeNetworkError, AcmeHttpError, Challenge
+from .certauthority import CertAuthority
+from .crypto import gen_key_ed25519, create_csr
+from .db import KeyStore, FilesystemKeyStore, SqliteKeyStore, PostgresKeyStore
+from .challenge import InMemoryChallengeStore, FileSystemChallengeStore

certapi/certauthority.py

@@ -0,0 +1,154 @@
+from typing import List, Union, Callable, Tuple, Dict
+import json
+import time
+
+import requests
+from cryptography.x509 import Certificate
+from requests import Response
+
+from . import Acme, Challenge, Order
+from . import crypto
+from . import challenge
+from .crypto import cert_to_pem, key_to_pem
+from .crypto_classes import Key
+from .db import KeyStore
+
+
+class CertAuthority:
+    def __init__(self, challenge_store: challenge.ChallengeStore, key_store: KeyStore,acme_url=None):
+        self.acme = Acme(key_store.account_key,url=acme_url)
+        self.key_store = key_store
+        self.challengesStore: challenge.ChallengeStore = challenge_store
+
+    def setup(self):
+        self.acme.setup()
+        res: Response = self.acme.register()
+        if res.status_code == 201:
+            print("Acme Account was already registered")
+        elif res.status_code != 200:
+            raise Exception("Acme registration didn't return 200 or 201 ", res.json())
+
+    def obtainCert(
+        self, host: Union[str, List[str]]
+    ) -> Union[Tuple["CertificateResponse", None], Tuple[None, requests.Response]]:
+        if type(host) == str:
+            host = [host]
+
+        existing = {c[0]: c[1] for c in [(h, self.key_store.get_cert(h)) for h in host] if c[1] is not None}
+        missing = [h for h in host if h not in existing]
+        if len(missing) > 0:
+            private_key = crypto.gen_key_secp256r1()
+            order = self.acme.create_authorized_order(missing)
+
+            challenges = order.remaining_challenges()
+            for c in challenges:
+                print("[ Challenge ]", c.token, "=", c.authorization_key)
+                self.challengesStore[c.token] = c.authorization_key
+            for c in challenges:
+                # c.self_verify()
+                c.verify()
+
+            end = time.time() + 40  # max 12 seconds
+            source: List[Challenge] = [x for x in challenges]
+            sink = []
+            counter = 1
+            while len(source) > 0:
+                if time.time() > end and counter > 4:
+                    print("Order finalization time out")
+                    break
+                for c in source:
+                    status = c.query_progress()
+                    if status != True:  # NOTE that it must be True strictly
+                        sink.append(c)
+                if len(sink) > 0:
+                    time.sleep(3)
+                source, sink, counter = sink, [], counter + 1
+            else:
+                print("Order is already Ready.")
+            csr = crypto.create_csr(private_key, missing[0], missing[1:])
+            order.finalize(csr)
+
+            def obtain_cert(count=5):
+                time.sleep(3)
+                order.refresh()  # is this refresh necessary?
+
+                if order.status == "valid":
+                    (certificate, _) = order.get_certificate()
+                    key_id = self.key_store.save_key(private_key, missing[0])
+                    cert_id = self.key_store.save_cert(key_id, certificate, missing)
+                    issued_cert = IssuedCert(key_to_pem(private_key), certificate, missing)
+                    response = createExistingResponse(existing, [issued_cert])
+                    return (response, None)
+                elif order.status == "processing":
+                    if count == 0:
+                        return None
+                    return obtain_cert()
+                return None
+
+            return obtain_cert()
+        else:
+            return createExistingResponse(existing, []), None
+
+
+def createExistingResponse(existing: Dict[str, Tuple[int | str, Key, Certificate]], issued_certs: List["IssuedCert"]):
+    certs = []
+    certMap = {}
+    for h, (id, key, cert) in existing.items():
+        if id in certMap:
+            certMap[id][0].append(h)
+        else:
+            certMap[id] = (
+                [h],
+                key.to_pem().decode("utf-8"),
+                cert_to_pem(cert).decode("utf-8"),
+            )
+    for hosts, key, cert in certMap.values():
+        certs.append(IssuedCert(key, cert, hosts))
+
+    return CertificateResponse(certs, issued_certs)
+
+
+class CertificateResponse:
+    def __init__(self, existing, issued):
+        self.existing: List[IssuedCert] = existing
+        self.issued: List[IssuedCert] = issued
+
+    def __repr__(self):
+        return "CertificateResponse(existing={0},new={1})".format(repr(self.existing), repr(self.issued))
+
+    def __str__(self):
+        if self.issued:
+            return "(existing: {0},new: {1})".format(str(self.existing), str(self.issued))
+        else:
+            return "(existing: {0})".format(str(self.existing))
+
+    def __json__(self):
+        return {
+            "existing": [x.__json__() for x in self.existing],
+            "issued": [x.__json__() for x in self.issued],
+        }
+
+
+class IssuedCert:
+    def __init__(self, key: str | Key, cert: str | Certificate, domains: [str]):
+        if isinstance(key, Key):
+            key = key.to_pem().decode("utf-8")
+        elif isinstance(key, bytes):
+            key = key.decode("utf-8")
+        if isinstance(cert, Certificate):
+            cert = cert_to_pem(cert).decode("utf-8")
+        elif isinstance(cert, bytes):
+            cert = cert.decode("utf-8")
+        self.privateKey = key
+        self.certificate = cert
+        self.domains = domains
+
+    def __repr__(self):
+        # return "IssuedCert(hosts={0})".format(self.domains)
+        return "(hosts: {0}, certificate:{1})".format(self.domains, self.certificate)
+
+    def __str__(self):
+        return "(hosts: {0}, certificate:{1})".format(self.domains, self.certificate)
+
+    def __json__(self):
+        return {"privateKey": self.privateKey, "certificate": self.certificate, "domains": self.domains}

certapi/challenge.py

@@ -0,0 +1,121 @@
+import os
+from collections.abc import MutableMapping
+
+
+class ChallengeStore(MutableMapping):
+    """
+    Abstract base class for a challenge store.
+    Provides dictionary-like behavior by inheriting from MutableMapping.
+    """
+
+    def __setitem__(self, key, value):
+        self.save_challenge(key, value)
+
+    def __getitem__(self, key):
+        value = self.get_challenge(key)
+        if value is None:
+            raise KeyError(key)
+        return value
+
+    def __delitem__(self, key):
+        if key not in self:
+            raise KeyError(key)
+        self.delete_challenge(key)
+
+    def __contains__(self, key):
+        return self.get_challenge(key) is not None
+
+    def __iter__(self):
+        raise NotImplementedError("Must implement `__iter__` method.")
+
+    def __len__(self):
+        raise NotImplementedError("Must implement `__len__` method.")
+
+    def save_challenge(self, key: str, value: str):
+        raise NotImplementedError("Must implement `save_challenge` method.")
+
+    def get_challenge(self, key: str) -> str:
+        raise NotImplementedError("Must implement `get_challenge` method.")
+
+    def delete_challenge(self, key: str):
+        raise NotImplementedError("Must implement `delete_challenge` method.")
+
+
+class InMemoryChallengeStore(ChallengeStore):
+    """
+    In-memory implementation of the ChallengeStore.
+    """
+
+    def __init__(self):
+        self.challenges = {}
+
+    def save_challenge(self, key: str, value: str):
+        self.challenges[key] = value
+
+    def get_challenge(self, key: str) -> str:
+        return self.challenges.get(key, "")
+
+    def delete_challenge(self, key: str):
+        if key in self.challenges:
+            del self.challenges[key]
+
+    def __iter__(self):
+        return iter(self.challenges)
+
+    def __len__(self):
+        return len(self.challenges)
+
+
+class FileSystemChallengeStore(ChallengeStore):
+    """
+    Filesystem implementation of the ChallengeStore.
+    """
+
+    def __init__(self, directory: str):
+        self.directory = directory
+        os.makedirs(self.directory, exist_ok=True)
+
+    def save_challenge(self, key: str, value: str):
+        file_path = os.path.join(self.directory, key)
+        with open(file_path, "w") as file:
+            file.write(value)
+
+    def get_challenge(self, key: str) -> str:
+        file_path = os.path.join(self.directory, key)
+        if not os.path.exists(file_path):
+            return None
+        with open(file_path, "r") as file:
+            return file.read()
+
+    def delete_challenge(self, key: str):
+        file_path = os.path.join(self.directory, key)
+        if os.path.exists(file_path):
+            os.remove(file_path)
+
+    def __iter__(self):
+        return (f for f in os.listdir(self.directory) if os.path.isfile(os.path.join(self.directory, f)))
+
+    def __len__(self):
+        return len([f for f in os.listdir(self.directory) if os.path.isfile(os.path.join(self.directory, f))])
+
+
+def get_challenge_store():
+    """
+    Factory function to determine the type of store based on environment variables.
+
+    Environment Variables:
+    - `CHALLENGE_STORE_TYPE`: Can be "memory" or "filesystem".
+    - `CHALLENGE_STORE_DIR`: Directory for filesystem-based store. Defaults to "./challenges".
+    """
+    store_type = os.getenv("CHALLENGE_STORE_TYPE", "filesystem").lower()
+    directory = os.getenv("CHALLENGE_STORE_DIR", "./challenges")
+
+    if store_type == "memory":
+        return InMemoryChallengeStore()
+    elif store_type == "filesystem":
+        return FileSystemChallengeStore(directory)
+    else:
+        raise ValueError(f"Unknown CHALLENGE_STORE_TYPE: {store_type}")
+
+
+challenge_store: ChallengeStore = get_challenge_store()