certapi 0.1.0__py3-none-any.whl

certapi/crypto.py

@@ -0,0 +1,222 @@
+from typing import List, Union
+
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa, ec, padding, ed25519
+from cryptography import x509
+from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+from cryptography.x509 import Certificate, CertificateSigningRequestBuilder, CertificateSigningRequest
+
+from cryptography.x509.oid import NameOID
+from cryptography.hazmat.primitives import hashes
+import datetime
+
+from .util import b64_encode, b64_string
+
+__no_enc = serialization.NoEncryption()
+
+
+def gen_key_rsa(key_size=4096):
+    return rsa.generate_private_key(public_exponent=65537, key_size=key_size)
+
+
+def gen_key_secp256r1():
+    curve = ec.SECP256R1()
+    return ec.generate_private_key(curve, default_backend())
+
+
+def gen_key_ed25519():
+    return ed25519.Ed25519PrivateKey.generate()
+
+
+def get_algorithm_name(key):
+    if isinstance(key, RSAPrivateKey):
+        return "RS256"
+    elif isinstance(key, Ed25519PrivateKey):
+        return "EdDSA"
+    elif isinstance(key, ec.EllipticCurvePrivateKey):
+        curve_name = key.curve.name
+        if curve_name == "secp256r1":
+            return "ES256"
+        elif curve_name == "secp384r1":
+            return "ES384"
+        elif curve_name == "secp521r1":
+            return "ES512"
+    else:
+        raise ValueError("Unsupported key type")
+
+
+def jwk(key: Union[RSAPrivateKey, Ed25519PrivateKey, EllipticCurvePrivateKey]):
+    if isinstance(key, RSAPrivateKey):
+        return jwk_rsa(key)
+    elif isinstance(key, Ed25519PrivateKey):
+        return jwk_ed25519(key)
+    elif isinstance(key, EllipticCurvePrivateKey):
+        return jwk_secp256r1(key)
+
+
+def jwk_ed25519(private_key: Ed25519PrivateKey):
+    public_key_bytes = private_key.public_key().public_bytes(
+        encoding=serialization.Encoding.Raw, format=serialization.PublicFormat.Raw
+    )
+    # Create the JWK for the Ed25519 public key
+    return {"crv": "Ed25519", "kty": "OKP", "x": b64_string(public_key_bytes)}
+
+
+def jwk_secp256r1(key: ec.EllipticCurvePrivateKey):
+
+    numbers = key.public_key().public_numbers()
+
+    # Create a JSON Web Key (JWK) representation of the public key
+    return {
+        "kty": "EC",
+        "crv": "P-256",
+        "x": b64_string(numbers.x.to_bytes(32, "big")),
+        "y": b64_string(numbers.y.to_bytes(32, "big")),
+    }
+
+
+def jwk_rsa(account_key: RSAPrivateKey):
+    public = account_key.public_key().public_numbers()
+    # json web key format for public key
+    return {
+        "e": b64_string((public.e).to_bytes((public.e.bit_length() + 7) // 8, "big")),
+        "kty": "RSA",
+        "n": b64_string((public.n).to_bytes((public.n.bit_length() + 7) // 8, "big")),
+    }
+
+
+def key_from_der(bytes):
+    return serialization.load_der_private_key(bytes, None)
+
+
+def key_from_pem(data: bytes):
+    return serialization.load_pem_private_key(data, None)
+
+
+def cert_from_pem(data: bytes) -> Certificate:
+    return x509.load_pem_x509_certificate(data)
+
+
+def cert_to_pem(cert):
+    return cert.public_bytes(serialization.Encoding.PEM)
+
+
+def cert_from_der(data: bytes) -> Certificate:
+    return x509.load_der_x509_certificate(data)
+
+
+def key_to_pem(key: RSAPrivateKey):
+    return key.private_bytes(
+        serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()
+    )
+
+
+def csr_to_pem(csr) -> bytes:
+    return csr.public_bytes(serialization.Encoding.PEM)
+
+
+def csr_to_der(csr) -> bytes:
+    return csr.public_bytes(serialization.Encoding.DER)
+
+
+def sign(key: Union[RSAPrivateKey, Ed25519PrivateKey, EllipticCurvePrivateKey], message, hasher=hashes.SHA256()):
+    #    return key.sign(message,padding.PSS(mgf=padding.(hashes.SHA256()),salt_length=padding.PSS.MAX_LENGTH),hashes.SHA256())
+    if isinstance(key, RSAPrivateKey):
+        return key.sign(message, padding.PKCS1v15(), hasher)
+    elif isinstance(key, Ed25519PrivateKey):
+        return key.sign(message)
+    elif isinstance(key, EllipticCurvePrivateKey):
+        return key.sign(message, ec.ECDSA(hasher))
+
+
+def sign_jws(key: RSAPrivateKey, data: object):
+    pass
+
+
+def key_to_der(key: [RSAPrivateKey, Ed25519PrivateKey, EllipticCurvePrivateKey]) -> bytes:
+    return key.private_bytes(
+        encoding=serialization.Encoding.DER, format=serialization.PrivateFormat.PKCS8, encryption_algorithm=__no_enc
+    )
+
+
+def create_csr(
+    private_key: Union[RSAPrivateKey, Ed25519PrivateKey, EllipticCurvePrivateKey],
+    main_domain: str,
+    alternatives: List[str] = None,
+) -> CertificateSigningRequest:
+    subject = x509.Name(
+        [
+            # Provide various details about who we are.
+            x509.NameAttribute(NameOID.COUNTRY_NAME, "NP"),
+            x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "Bagmati"),
+            x509.NameAttribute(NameOID.LOCALITY_NAME, "Kathmandu"),
+            x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Sireto Technology"),
+            x509.NameAttribute(NameOID.COMMON_NAME, main_domain),
+        ]
+    )
+    builder = x509.CertificateSigningRequestBuilder().subject_name(subject)
+    if alternatives is not None:
+        builder = builder.add_extension(
+            x509.SubjectAlternativeName([x509.DNSName(alt) for alt in alternatives]), critical=True
+        )
+    return builder.sign(private_key, hashes.SHA256())
+
+
+def self_sign():
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    csr = create_csr(key, "host4.sireto.dev", []).sign(key, hashes.SHA256())
+    with open("test.csr", "wb") as f:
+        f.write(csr_to_pem(csr))
+
+    # Various details about who we are. For a self-signed certificate the
+    # subject and issuer are always the same.
+    subject = issuer = x509.Name(
+        [
+            x509.NameAttribute(NameOID.COUNTRY_NAME, "US"),
+            x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "California"),
+            x509.NameAttribute(NameOID.LOCALITY_NAME, "San Francisco"),
+            x509.NameAttribute(NameOID.ORGANIZATION_NAME, "My Company"),
+            x509.NameAttribute(NameOID.COMMON_NAME, "domain3.sireto.dev"),
+        ]
+    )
+    now = datetime.datetime.utcnow()
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(subject)
+        .issuer_name(issuer)
+        .public_key(key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now)
+        .not_valid_after(now + datetime.timedelta(days=10))
+        .add_extension(
+            x509.SubjectAlternativeName([x509.DNSName("localhost")]),
+            critical=False,
+            # Sign our certificate with our private key
+        )
+        .sign(key, hashes.SHA256())
+    )
+    # Write our certificate out to disk.
+
+    with open("certificate.pem", "wb") as f:
+        f.write(cert.public_bytes(serialization.Encoding.PEM))
+
+    # getting public key from certificate.
+    public_key = cert.public_key()
+    if isinstance(public_key, rsa.RSAPublicKey):
+        # Do something RSA specific
+        pass
+    elif isinstance(public_key, ec.EllipticCurvePublicKey):
+        # Do something EC specific
+        pass
+    else:
+        # Remember to handle this case
+        pass
+
+
+def digest_sha256(data: bytes) -> bytes:
+    h = hashes.Hash(hashes.SHA256())
+    h.update(data)
+    return h.finalize()

certapi/crypto_classes.py

@@ -0,0 +1,135 @@
+from abc import ABC, abstractmethod
+from cryptography.hazmat.primitives.asymmetric import rsa, ed25519, ec
+from cryptography.hazmat.primitives import serialization, hashes, hmac, padding
+from typing import Union
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from .crypto import key_to_der, key_to_pem
+from .util import b64_string
+
+
+class Key(ABC):
+    @abstractmethod
+    def jwk(self):
+        pass
+
+    @abstractmethod
+    def sign(self, message):
+        pass
+
+    @abstractmethod
+    def sign_csr(self, csr):
+        pass
+
+    @staticmethod
+    def from_der(der_bytes):
+        key = serialization.load_der_private_key(der_bytes, password=None)
+        if isinstance(key, rsa.RSAPrivateKey):
+            return RSAKey(key)
+        elif isinstance(key, ec.EllipticCurvePrivateKey):
+            return ECDSAKey(key)
+        elif isinstance(key, Ed25519PrivateKey):
+            return Ed25519Key(key)
+        else:
+            raise ValueError("Unsupported key type")
+
+    @staticmethod
+    def from_pem(der_bytes):
+        key = serialization.load_pem_private_key(der_bytes, password=None)
+        if isinstance(key, rsa.RSAPrivateKey):
+            return RSAKey(key)
+        elif isinstance(key, ec.EllipticCurvePrivateKey):
+            return ECDSAKey(key)
+        elif isinstance(key, Ed25519PrivateKey):
+            return Ed25519Key(key)
+        else:
+            raise ValueError("Unsupported key type")
+
+    def to_der(self) -> bytes:
+        return key_to_der(self.key)
+
+    def to_pem(self) -> bytes:
+        return key_to_pem(self.key)
+
+
+class RSAKey(Key):
+    def __init__(self, key: rsa.RSAPrivateKey, hasher=hashes.SHA256()):
+        self.key = key
+        self.hasher = hasher
+
+    def jwk(self):
+        public = self.key.public_key().public_numbers()
+        return {
+            "e": b64_string((public.e).to_bytes((public.e.bit_length() + 7) // 8, "big")),
+            "kty": "RSA",
+            "n": b64_string((public.n).to_bytes((public.n.bit_length() + 7) // 8, "big")),
+        }
+
+    def sign(self, message):
+        return self.key.sign(message, padding.PKCS1v15(), self.hasher)
+
+    def sign_csr(self, csr):
+        return csr.sign(self.key, self.hasher)
+
+    def algorithm_name(self):
+        return "RS" + str(self.hasher.digest_size * 8)
+
+
+class Ed25519Key(Key):
+
+    def __init__(self, key: ed25519.Ed25519PrivateKey):
+        self.key = key
+        self.keyid = "e"
+        public = self.key.public_key().public_bytes(
+            encoding=serialization.Encoding.Raw, format=serialization.PublicFormat.Raw
+        )
+        self.jwk = {
+            "crv": "Ed25519",
+            "kty": "OKP",
+            "x": b64_string(public),
+        }
+
+    def jwk(self):
+        return self.jwk
+
+    def sign(self, message):
+        return self.key.sign(message)
+
+    def sign_csr(self, csr):
+        return csr.sign(self.key, hashes.SHA256())
+
+
+class ECDSAKey(Key):
+
+    def __init__(self, key: ec.EllipticCurvePrivateKey):
+        self.key = key
+        public_key = self.key.public_key()
+        public_numbers = public_key.public_numbers()
+        self.jwk = {
+            "kty": "EC",
+            "crv": self.key.curve.name,
+            "x": b64_string(public_numbers.x.to_bytes((public_numbers.x.bit_length() + 7) // 8, "big")),
+            "y": b64_string(public_numbers.y.to_bytes((public_numbers.y.bit_length() + 7) // 8, "big")),
+        }
+
+    def jwk(self):
+        return self.jwk
+
+    def algorithm_name(self):
+        return self.key.curve.name
+
+    def sign(self, message):
+        key_size = self.key.curve.key_size
+        if key_size == 256:
+            algorithm = hashes.SHA256()
+        elif key_size == 384:
+            algorithm = hashes.SHA384()
+        elif key_size == 521:
+            algorithm = hashes.SHA512()
+        else:
+            raise ValueError(f"Unsupported curve with key size {key_size}")
+        return self.key.sign(message, ec.ECDSA(algorithm))
+
+    def sign_csr(self, csr):
+        return csr.sign(self.key, hashes.SHA256())

certapi/custom_certauthority.py

@@ -0,0 +1,94 @@
+import json
+import time
+from datetime import datetime, timedelta
+from typing import Union, Callable, List
+
+import requests
+from cryptography import x509
+from cryptography.hazmat._oid import NameOID
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric.dsa import DSAPrivateKey
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+from cryptography.x509 import Certificate
+from requests import Response
+
+from . import Acme
+from . import db
+from . import crypto
+from . import challenge
+from .crypto import csr_to_pem, create_csr, gen_key_secp256r1
+from cryptography.hazmat.primitives.asymmetric import rsa, ec, padding, ed25519, dsa
+
+
+# pathlib.Path.mkdir("/var/www/html/.acme/well-known")
+
+
+class CustomCertAuthority:
+    def __init__(self, key: Union[RSAPrivateKey, DSAPrivateKey, ec.EllipticCurvePrivateKey]):
+        self.root_key = key
+        self.issuer = x509.Name(
+            [
+                x509.NameAttribute(NameOID.COUNTRY_NAME, "NP"),
+                x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "Kathmandu"),
+                x509.NameAttribute(NameOID.LOCALITY_NAME, "Buddhanagar"),
+                x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Sireto Technology"),
+                x509.NameAttribute(NameOID.COMMON_NAME, "sireto.io"),
+            ]
+        )
+
+    def get_ca_cert(self):
+
+        # Assuming self.root_key is the CA private key
+        cert = (
+            x509.CertificateBuilder()
+            .subject_name(self.issuer)
+            .issuer_name(self.issuer)
+            .public_key(self.root_key.public_key())
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(datetime.utcnow())
+            .not_valid_after(datetime.utcnow() + timedelta(days=365))
+            .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+            .sign(self.root_key, hashes.SHA256())
+        )
+
+        return cert
+
+    # Assuming CustomCertAuthority is your class
+
+    def create_cert(self, domain: str, alt_names: List[str] = (), key_type: str = "rsa", expiry_days=90):
+        if key_type == "rsa":
+            key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        elif key_type == "dsa":
+            key = dsa.generate_private_key(key_size=2048)
+        elif key_type == "ecdsa":
+            key = gen_key_secp256r1()
+        else:
+            raise ValueError("Unsupported key type")
+
+        subject = x509.Name(
+            [
+                x509.NameAttribute(NameOID.COUNTRY_NAME, "NP"),
+                x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "Kathmandu"),
+                x509.NameAttribute(NameOID.LOCALITY_NAME, "Buddhanagar"),
+                x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Sireto Technology"),
+                x509.NameAttribute(NameOID.USER_ID, domain),
+            ]
+        )
+
+        now = datetime.utcnow()
+        cert_builder = (
+            x509.CertificateBuilder()
+            .subject_name(subject)
+            .issuer_name(self.issuer)
+            .public_key(key.public_key())
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(now)
+            .not_valid_after(now + timedelta(days=expiry_days))
+        )
+
+        for alt_name in alt_names:
+            cert_builder.add_extension(x509.SubjectAlternativeName([x509.DNSName(alt_name)]), critical=False)
+
+        cert = cert_builder.sign(self.root_key, hashes.SHA256())
+
+        return (key, cert)