certapi 0.1.0__py3-none-any.whl

certapi/db.py

@@ -0,0 +1,365 @@
+import os
+import sqlite3
+from typing import Union, Tuple, Optional
+
+from .crypto import *
+from flask import g
+from abc import ABC, abstractmethod
+
+from .crypto_classes import Key
+
+
+class KeyStore(ABC):
+    account_key: RSAPrivateKey
+
+    @abstractmethod
+    def save_key(self, key: RSAPrivateKey, name: str = None) -> int | str:
+        pass
+
+    @abstractmethod
+    def gen_key(self, name: str = None, size: int = 4096) -> RSAPrivateKey:
+        pass
+
+    @abstractmethod
+    def save_cert(self, private_key_id: int, cert: Certificate, domains: List[str], name: str = None) -> int:
+        pass
+
+    @abstractmethod
+    def get_cert(self, domain: str) -> None | Tuple[int | str, Key, Certificate]:
+        pass
+
+
+class SqliteKeyStore(KeyStore):
+    def __init__(self, db_path="db/database.db"):
+        self.db_path = db_path
+        self._initialize_db()
+        self.account_key = self._init_account_key()
+
+    def _initialize_db(self):
+        os.makedirs(os.path.dirname(self.db_path), exist_ok=True)
+        with sqlite3.connect(self.db_path) as conn:
+            conn.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS private_keys (
+                    id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    name VARCHAR(50) NULL,
+                    content BLOB
+                );
+                CREATE TABLE IF NOT EXISTS certificates (
+                    id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    name VARCHAR(50) NULL,
+                    priv_id INTEGER REFERENCES private_keys NOT NULL,
+                    content BLOB,
+                    sign_id INTEGER REFERENCES private_keys NULL
+                );
+                CREATE TABLE IF NOT EXISTS ssl_domains (
+                    domain VARCHAR(255),
+                    certificate_id INTEGER REFERENCES certificates
+                );
+                CREATE TABLE IF NOT EXISTS ssl_wildcards (
+                    domain VARCHAR(255),
+                    certificate_id INTEGER REFERENCES certificates
+                );
+                """
+            )
+
+    def _get_db_connection(self):
+        if "db" not in g:
+            g.db = sqlite3.connect(self.db_path)
+        return g.db
+
+    def save_key(self, key: RSAPrivateKey, name: str = None) -> int:
+        conn = self._get_db_connection()
+        cur = conn.cursor()
+        cur.execute("INSERT INTO private_keys (name, content) VALUES (?, ?)", (name, key_to_der(key)))
+        cur.close()
+        conn.commit()
+        return cur.lastrowid
+
+    def gen_key(self, name: str = None, size: int = 4096) -> RSAPrivateKey:
+        key = gen_key_rsa(size)
+        self.save_key(key, name)
+        return key
+
+    def save_cert(self, private_key_id: int, cert: Certificate, domains: List[str], name: str = None) -> int:
+        conn = self._get_db_connection()
+        cur = conn.cursor()
+        cur.execute(
+            "INSERT INTO certificates (name, priv_id, content) VALUES (?, ?, ?)",
+            (name, private_key_id, cert.public_bytes(serialization.Encoding.DER)),
+        )
+        cert_id = cur.lastrowid
+
+        for domain in domains:
+            cur.execute("INSERT INTO ssl_domains (domain, certificate_id) VALUES (?, ?)", (domain, cert_id))
+        cur.close()
+        conn.commit()
+        return cert_id
+
+    def get_cert(self, domain: str) -> None | Tuple[int | str, Key, Certificate]:
+        conn = self._get_db_connection()
+        cur = conn.cursor()
+        cur.execute(
+            """
+            SELECT c.id, p.content, c.content
+            FROM ssl_domains s
+            JOIN certificates c ON s.certificate_id = c.id
+            JOIN private_keys p ON c.priv_id = p.id
+            WHERE s.domain = ?
+            """,
+            (domain,),
+        )
+        res = cur.fetchone()
+
+        cur.close()
+
+        return res if res is None else (res[0], Key.from_der(res[1]), cert_from_der(res[2]))
+
+    def _init_account_key(self) -> RSAPrivateKey:
+        acme_key_name = "ACME Account Key"
+        conn = sqlite3.connect(self.db_path)
+        account_key_data = conn.execute("SELECT content FROM private_keys WHERE name = ?", [acme_key_name]).fetchone()
+
+        if not account_key_data:
+            account_key = self.gen_key(acme_key_name)
+        else:
+            account_key = key_from_der(account_key_data[0])
+
+        print(key_to_pem(account_key).decode("utf-8"))
+        conn.close()
+        return account_key
+
+
+class FilesystemKeyStore(KeyStore):
+    def __init__(self, base_dir="."):
+        self.keys_dir = os.path.join(base_dir, "keys")
+        self.certs_dir = os.path.join(base_dir, "certs")
+        os.makedirs(self.keys_dir, exist_ok=True)
+        os.makedirs(self.certs_dir, exist_ok=True)
+        self._init_account_key()
+
+    def _init_account_key(self) -> RSAPrivateKey:
+        acme_key_name = "acme_account"
+        self.account_key = self.find_key(acme_key_name)
+        if self.account_key is None:
+            self.account_key = self.gen_key("acme_account")
+        return self.account_key
+
+    def save_key(self, key: RSAPrivateKey, name: str = None) -> str:
+        key_path = os.path.join(self.keys_dir, f"{name}.key")
+        with open(key_path, "wb") as f:
+            f.write(key_to_pem(key))
+        return name  # Dummy ID since filesystem does not use numeric IDs
+
+    def gen_key(self, name: str = None, size: int = 4096) -> RSAPrivateKey:
+        key = gen_key_rsa(size)
+        self.save_key(key, name)
+        return key
+
+    def find_key(self, name: str) -> Union[None, RSAPrivateKey]:
+        key_path = os.path.join(self.keys_dir, f"{name}.key")
+        if os.path.exists(key_path):
+            with open(key_path, "rb") as f:
+                key_data = f.read()
+            return key_from_pem(key_data)
+        return None
+
+    def find_cert(self, name: str) -> Union[None, Certificate]:
+        cert_path = os.path.join(self.certs_dir, f"{name}.crt")
+        if os.path.exists(cert_path):
+            with open(cert_path, "rb") as f:
+                cert_data = f.read()
+            return cert_from_pem(cert_data)
+        return None
+
+    def save_cert(self, private_key_id: str, cert: Certificate, domains: list, name: str = None) -> int:
+        if name:
+            cert_path = os.path.join(self.certs_dir, f"{name}.crt")
+            with open(cert_path, "wb") as f:
+                f.write(cert_to_pem(cert))
+        key_content = None
+        key_path = os.path.join(self.keys_dir, f"{private_key_id}.key")
+        with open(key_path, "rb") as f:
+            key_content = f.read()
+        for domain in domains:
+            if domain != private_key_id:
+                with open(os.path.join(self.keys_dir, f"{domain}.key"), "wb") as f:
+                    f.write(key_content)
+            domain_cert_path = os.path.join(self.certs_dir, f"{domain}.crt")
+            with open(domain_cert_path, "wb") as f:
+                f.write(cert_to_pem(cert))
+
+        return name if name else domains[0]  # Dummy ID since filesystem does not use numeric IDs
+
+    def get_cert(self, domain: str) -> None | Tuple[str, Key, Certificate]:
+        cert_path = os.path.join(self.certs_dir, f"{domain}.crt")
+        key_path = os.path.join(self.keys_dir, f"{domain}.key")
+        key = None
+        cert = None
+        if os.path.exists(key_path):
+            try:
+                with open(key_path, "rb") as f:
+                    key = Key.from_pem(f.read())
+            except ValueError:
+                pass
+
+        if os.path.exists(cert_path):
+            try:
+                with open(cert_path, "rb") as f:
+                    cert = cert_from_pem(f.read())
+            except ValueError:
+                pass
+
+        if cert is None or key is None:
+            return None
+        return (domain, key, cert)
+
+
+class PostgresKeyStore(KeyStore):
+    def __init__(self, db_url="postgresql://user:password@localhost/dbname"):
+        self.db_url = db_url
+
+        import psycopg2
+
+        self.psycopg2 = psycopg2
+
+    def setup(self):
+        self._initialize_pool()
+        self._initialize_db()
+        self.account_key = self._init_account_key()
+
+    def _initialize_pool(self):
+        """Initialize the connection pool."""
+        from psycopg2.pool import SimpleConnectionPool
+
+        self.pool = SimpleConnectionPool(1, 1, self.db_url)
+
+    def _check_connection(self, conn):
+        """Check if the connection is alive by using the `ping` method."""
+        try:
+            conn.ping()  # This will raise an exception if the connection is not alive.
+            return True
+        except self.psycopg2.OperationalError:
+            return False
+
+    def _get_db_connection(self):
+        """Get a connection from the pool and ensure it is healthy."""
+        conn = self.pool.getconn()
+
+        # Check connection health
+        if not self._check_connection(conn):
+            print("Connection is not healthy, reconnecting...")
+            self.pool.putconn(conn, close=True)  # Close the bad connection
+            conn = self.pool.getconn()  # Get a fresh connection
+
+        return conn
+
+    def _initialize_db(self):
+        """Initializes the database with necessary tables."""
+        conn = self._get_db_connection()
+        cur = conn.cursor()
+
+        cur.execute(
+            """
+            CREATE TABLE IF NOT EXISTS private_keys (
+                id SERIAL PRIMARY KEY,
+                name VARCHAR(50) NULL,
+                content BYTEA
+            );
+            CREATE TABLE IF NOT EXISTS certificates (
+                id SERIAL PRIMARY KEY,
+                name VARCHAR(50) NULL,
+                priv_id INTEGER REFERENCES private_keys NOT NULL,
+                content BYTEA,
+                sign_id INTEGER REFERENCES private_keys NULL
+            );
+            CREATE TABLE IF NOT EXISTS ssl_domains (
+                domain VARCHAR(255),
+                certificate_id INTEGER REFERENCES certificates
+            );
+            CREATE TABLE IF NOT EXISTS ssl_wildcards (
+                domain VARCHAR(255),
+                certificate_id INTEGER REFERENCES certificates
+            );
+        """
+        )
+
+        cur.close()
+        conn.commit()
+
+    def save_key(self, key: RSAPrivateKey, name: str = None) -> int:
+        """Saves a private key in the database."""
+        conn = self._get_db_connection()
+        cur = conn.cursor()
+        cur.execute("INSERT INTO private_keys (name, content) VALUES (%s, %s) RETURNING id", (name, key_to_der(key)))
+        key_id = cur.fetchone()[0]
+        cur.close()
+        conn.commit()
+        return key_id
+
+    def gen_key(self, name: str = None, size: int = 4096) -> RSAPrivateKey:
+        """Generates a new RSA private key and saves it."""
+        key = gen_key_rsa(size)
+        self.save_key(key, name)
+        return key
+
+    def save_cert(self, private_key_id: int, cert: Certificate, domains: List[str], name: str = None) -> int:
+        """Saves a certificate along with associated domains."""
+        conn = self._get_db_connection()
+        cur = conn.cursor()
+
+        # Insert certificate
+        cur.execute(
+            "INSERT INTO certificates (name, priv_id, content) VALUES (%s, %s, %s) RETURNING id",
+            (name, private_key_id, cert.public_bytes(serialization.Encoding.DER)),
+        )
+        cert_id = cur.fetchone()[0]
+
+        # Insert associated domains
+        for domain in domains:
+            cur.execute("INSERT INTO ssl_domains (domain, certificate_id) VALUES (%s, %s)", (domain, cert_id))
+
+        cur.close()
+        conn.commit()
+        return cert_id
+
+    def get_cert(self, domain: str) -> Optional[Tuple[int, RSAPrivateKey, Certificate]]:
+        """Fetches a certificate and its associated private key for a domain."""
+        conn = self._get_db_connection()
+        cur = conn.cursor()
+
+        cur.execute(
+            """
+            SELECT c.id, p.content, c.content
+            FROM ssl_domains s
+            JOIN certificates c ON s.certificate_id = c.id
+            JOIN private_keys p ON c.priv_id = p.id
+            WHERE s.domain = %s
+        """,
+            (domain,),
+        )
+        res = cur.fetchone()
+
+        cur.close()
+        conn.commit()
+
+        if res:
+            return (res[0], Key.from_der(res[1]), cert_from_der(res[2]))
+        return None
+
+    def _init_account_key(self) -> RSAPrivateKey:
+        """Initializes or retrieves the ACME account key."""
+        acme_key_name = "ACME Account Key"
+        conn = self._get_db_connection()
+        cur = conn.cursor()
+        cur.execute("SELECT content FROM private_keys WHERE name = %s", (acme_key_name,))
+        account_key_data = cur.fetchone()
+
+        if not account_key_data:
+            account_key = self.gen_key(acme_key_name)
+        else:
+            account_key = key_from_der(account_key_data[0])
+
+        cur.close()
+
+        return account_key

certapi/util.py

@@ -0,0 +1,19 @@
+import json
+import base64
+from typing import Union
+
+
+def b64_encode(data: Union[str, bytes, bytearray, dict, list]) -> bytes:
+    if type(data) in (dict, list):
+        data = json.dumps(data).encode("utf-8")
+    elif type(data) == str:
+        data = data.encode("utf-8")
+    return base64.urlsafe_b64encode(data).rstrip(b"=")
+
+
+def b64_string(data: Union[str, bytes, bytearray, dict, list]) -> str:
+    return b64_encode(data).decode("utf-8")
+
+
+def crypto():
+    return None

certapi-0.1.0.dist-info/METADATA

@@ -0,0 +1,45 @@
+Metadata-Version: 2.1
+Name: certapi
+Version: 0.1.0
+Summary: Python Package for managing keys, request SSL certificates from ACME.
+Home-page: https://github.com/mesudip/certmanager
+Author: Sudip Bhattarai
+Author-email: sudipbhattarai100@gmail.com
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography
+Requires-Dist: requests
+
+# CertManager
+
+CertManager is a Python package for requesting SSL certificates from ACME.
+This is supposed to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
+
+## Installation
+
+You can install CertManager using pip:
+
+```bash
+pip install certapi
+```
+
+## Example Usage
+
+```python
+import json
+from certmanager import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+
+key_store = FilesystemKeyStore("data")
+challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/acme-challenges.
+
+certAuthority = CertAuthority(challenge_store, key_store)
+certAuthority.setup()
+
+(response,_) = certAuthority.obtainCert("example.com")
+
+json.dumps(response.__json__(),indent=2)
+
+```

certapi-0.1.0.dist-info/RECORD

@@ -0,0 +1,13 @@
+certapi/Acme.py,sha256=Ndcn2kDEXcSVQktisGcScnMJNMLRcv2H1aZQHHZar_E,15952
+certapi/__init__.py,sha256=AW8jV-jOuqt5xW1dW8e0Am_uasVLd6Jsp0zhvho5mPA,314
+certapi/certauthority.py,sha256=-GKMNyzgCjeVs4AM-aKqe5XTSMi-wP-nj3WGhZ23-pI,5759
+certapi/challenge.py,sha256=OT_0zx526U0uNNIxT6Iz8wEBXJXtkSEGon_yk04GT8g,3681
+certapi/crypto.py,sha256=OBdQkwqDjEt_Ths3Hlqou0D4tSZHBr_m3F7cQJ-RzZY,7481
+certapi/crypto_classes.py,sha256=VBIBAFRl4PO_e2K6xperD6kZsQh9LX0y1nPESrXVlYM,4028
+certapi/custom_certauthority.py,sha256=YAoqBIVKcSywbXUhW6d0HwxjKk7fA0VMxr9XRO3xQi0,3521
+certapi/db.py,sha256=E8tAZ4Fqt6UD4a4v0uQaVsLZR3Gf22fpcnTPVDgONvM,12821
+certapi/util.py,sha256=M1EUcaOFXqHGrq54_AXgI9hqZpneRBqY7V-fyDUPUIM,477
+certapi-0.1.0.dist-info/METADATA,sha256=vFr1gPhbwhRgWHNewOQvCA633OVw_YgKDDmZzUsBs80,1309
+certapi-0.1.0.dist-info/WHEEL,sha256=PZUExdf71Ui_so67QXpySuHtCi3-J3wvF4ORK6k_S8U,91
+certapi-0.1.0.dist-info/top_level.txt,sha256=zK_AUsm1tjAi3d6hpO6rhh5BdfpSj8__9ROReFanBxo,8
+certapi-0.1.0.dist-info/RECORD,,

certapi-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (75.6.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

certapi-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+certapi