certapi 0.1.0__tar.gz → 0.2.0__tar.gz

{certapi-0.1.0 → certapi-0.2.0}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.1.0
+Version: 0.2.0
 Summary: Python Package for managing keys, request SSL certificates from ACME.
-Home-page: https://github.com/mesudip/certmanager
+Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
 Author-email: sudipbhattarai100@gmail.com
 Classifier: Programming Language :: Python :: 3
@@ -10,17 +10,15 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.6
 Description-Content-Type: text/markdown
-Requires-Dist: cryptography
-Requires-Dist: requests
 
-# CertManager
+# CertApi
 
-CertManager is a Python package for requesting SSL certificates from ACME.
+CertApi is a Python package for requesting SSL certificates from ACME.
 This is supposed to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
 
 ## Installation
 
-You can install CertManager using pip:
+You can install CertApi using pip:
 
 ```bash
 pip install certapi
@@ -30,7 +28,7 @@ pip install certapi
 
 ```python
 import json
-from certmanager import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+from certapi import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
 
 key_store = FilesystemKeyStore("data")
 challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/acme-challenges.

{certapi-0.1.0 → certapi-0.2.0}/README.md

@@ -1,11 +1,11 @@
-# CertManager
+# CertApi
 
-CertManager is a Python package for requesting SSL certificates from ACME.
+CertApi is a Python package for requesting SSL certificates from ACME.
 This is supposed to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
 
 ## Installation
 
-You can install CertManager using pip:
+You can install CertApi using pip:
 
 ```bash
 pip install certapi
@@ -15,7 +15,7 @@ pip install certapi
 
 ```python
 import json
-from certmanager import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+from certapi import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
 
 key_store = FilesystemKeyStore("data")
 challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/acme-challenges.

{certapi-0.1.0 → certapi-0.2.0}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="0.1.0",
+    version="0.2.0",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[
@@ -15,7 +15,7 @@ setup(
     long_description_content_type="text/markdown",
     author="Sudip Bhattarai",
     author_email="sudipbhattarai100@gmail.com",
-    url="https://github.com/mesudip/certmanager",
+    url="https://github.com/mesudip/certapi",
     classifiers=[
         "Programming Language :: Python :: 3",
         "License :: OSI Approved :: MIT License",

{certapi-0.1.0 → certapi-0.2.0}/src/certapi/Acme.py

@@ -8,19 +8,20 @@ from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.x509 import CertificateSigningRequest, Certificate
 from . import crypto
 import requests
-from .crypto import sign, digest_sha256, csr_to_der, jwk, get_algorithm_name
+from .crypto import sign, digest_sha256, csr_to_der, jwk, get_algorithm_name, sign_for_jws
 from .util import b64_encode, b64_string
 
-# acme_url = os.environ.get("LETSENCRYPT_API", "https://acme-staging-v02.api.letsencrypt.org/directory")
-acme_url = os.environ.get("LETSENCRYPT_API", "https://acme-v02.api.letsencrypt.org/directory")
+acme_url = os.environ.get("LETSENCRYPT_API", "https://acme-staging-v02.api.letsencrypt.org/directory")
+# acme_url = os.environ.get("LETSENCRYPT_API", None)
 
 
 class AcmeError(Exception):
     def __init__(self, message, detail, step):
-        super().__init__(step,message)
+        super().__init__(step, message)
         self.message: str = message
         self.step: str = step
         self.detail: dict = detail
+        self.can_retry = False
 
     def json_obj(self) -> dict:
         return {"message": self.message, "step": self.step, "detail": self.detail}
@@ -36,6 +37,7 @@ class AcmeNetworkError(AcmeError, requests.RequestException):
         requests.RequestException.__init__(self, request=request)
         AcmeError.__init__(self, message, detail, step)
         requests.RequestException.__init__(self, request=request)  # Pass message to RequestException
+        self.can_retry = True
 
 
 class AcmeHttpError(AcmeError, requests.HTTPError):
@@ -45,7 +47,7 @@ class AcmeHttpError(AcmeError, requests.HTTPError):
 
     def __init__(self, response: requests.Response, step: str):
         requests.HTTPError.__init__(self, response=response)
-        self.response=response
+        self.response = response
         (message, detail) = self.extract_acme_response_error()
         AcmeError.__init__(self, message, detail, step)
 
@@ -121,8 +123,8 @@ class AcmeHttpError(AcmeError, requests.HTTPError):
                                 message = err_detail
 
             if message is None:
-                if res_json.get('detail'):
-                    message = res_json['detail']
+                if res_json.get("detail"):
+                    message = res_json["detail"]
                 else:
                     message = "Received status=" + str(self.response.status_code) + " from AMCE server"
             if error is None:
@@ -141,22 +143,28 @@ class AcmeInvaliOrderError(AcmeHttpError):
         super().__init__(response, step)
 
 
+class AcmeInvaliNonceError(AcmeHttpError):
+    def __init__(self, response: requests.Response, step: str):
+        super().__init__(response, step)
+        self.can_retry = True
+
+
 def request(method, step: str, url: str, json=None, headers=None, throw=True) -> requests.Response:
-    res=None
+    res = None
     try:
         res = requests.request(method, url, json=json, headers=headers, timeout=15)
-        print("Request ["+str(res.status_code)+"] : " + method + " " + url + " step=" + step)
+        print("Request [" + str(res.status_code) + "] : " + method + " " + url + " step=" + step)
     except requests.HTTPError as e:
         status = res.status_code if res else None
         status = status if status else (e.response.status_code if e.response else None)
         if status:
-            print("Request ["+str(status)+"] : " + method + " " + url + " step=" + step)
+            print("Request [" + str(status) + "] : " + method + " " + url + " step=" + step)
         else:
             print("Request : " + method + " " + url + " step=" + step)
 
         raise e
     except requests.RequestException as e:
-        print("Request : " + method + " " + url + " step=" + step)
+        print("Request : " + str(method) + " " + str(url) + " step=" + str(step))
         raise AcmeNetworkError(
             e.request,
             f"Error communicating with ACME server",
@@ -169,6 +177,19 @@ def request(method, step: str, url: str, json=None, headers=None, throw=True) ->
             step,
         )
     if 199 <= res.status_code > 299:
+
+        [print(x, y) for (x, y) in res.headers.items()]
+        print("Response:", res.text)
+        json_data = None
+        try:
+            json_data = res.json()
+        except requests.RequestException as e:
+            pass
+        if json_data and json_data.get("type"):
+            errorType = json_data["type"]
+            if errorType == "urn:ietf:params:acme:error:badNonce":
+                raise AcmeInvaliNonceError(res, step=step)
+
         if throw:
             raise AcmeHttpError(res, step=step)
     return res
@@ -191,8 +212,9 @@ class Acme:
         self.account_key = account_key
         # json web key format for public key
         self.jwk = jwk(self.account_key)
+        print(self.jwk)
         self.nonce = []
-        self.acme_url = url
+        self.acme_url = url if url else self.URL_STAGING
         self.key_id = None
         self.directory = None
         self._nonce_lock = threading.Lock()  # Mutex for safe access to nonce
@@ -210,19 +232,12 @@ class Acme:
         url = self._directory(path_name)
         return self._signed_req(url, payload, depth, step="Acme request:" + path_name)
 
-    def _signed_req(
-        self, url, payload: Union[str, dict, list, bytes, None] = None, depth=0, step="Acme Request", throw=True
-    ) -> requests.Response:
-        payload64 = b64_encode(payload) if payload is not None else b""
+    def get_nonce(self, step: str, counter=1):
         nonce = None
-        with self._nonce_lock:  # Acquire lock to ensure thread-safe access to nonce
-            # Check if there are any nonces available
+        with self._nonce_lock:  # Acquire nonce
             if self.nonce:
-                # Pop the first nonce from the list
                 nonce = self.nonce.pop(0)
-
-                # Fetch a new nonce if the list is empty
-        nonce = (
+        return (
             nonce
             if nonce
             else get(
@@ -230,10 +245,20 @@ class Acme:
             ).headers.get("Replay-Nonce")
         )
 
+    def record_nonce(self, response: requests.Response) -> requests.Response:
+        with self._nonce_lock:
+            self.nonce.append(response.headers.get("Replay-Nonce", None))
+        return response
+
+    def _signed_req(
+        self, url, payload: Union[str, dict, list, bytes, None] = None, depth=0, step="Acme Request", throw=True
+    ) -> requests.Response:
+        payload64 = b64_encode(payload) if payload is not None else b""
+
         protected = {
             "url": url,
             "alg": get_algorithm_name(self.account_key),
-            "nonce": nonce,
+            "nonce": self.get_nonce(step),
         }
 
         if self.key_id:
@@ -244,21 +269,18 @@ class Acme:
         payload = {
             "protected": protectedb64.decode("utf-8"),
             "payload": payload64.decode("utf-8"),
-            "signature": b64_string(sign(self.account_key, b".".join([protectedb64, payload64]))),
+            "signature": b64_string(sign_for_jws(self.account_key, b".".join([protectedb64, payload64]))),
         }
+        try:
 
-        response = post(step, url, json=payload, headers={"Content-Type": "application/jose+json"}, throw=throw)
-        if response.status_code > 299 or response.status_code < 200 :
-            print("-" * 30 + " Request  " + "-" * 30)
-            print(response.status_code, " : ", url)
-            print("status:", response.status_code)
-            print(json.dumps({x[0]: x[1] for x in response.headers.items()}, indent=2))
-            print(response.text)
-            print("-" * 60)
+            response = post(step, url, json=payload, headers={"Content-Type": "application/jose+json"}, throw=throw)
+        except AcmeError as e:
+            if e.can_retry and depth <= 0:
+                return self._signed_req(url, payload, depth + 1, step, throw)
+            else:
+                raise e
 
-        with self._nonce_lock:
-            self.nonce.append(response.headers.get("Replay-Nonce", None))
-        return response
+        return self.record_nonce(response)
 
     def register(self):
         response = self._directory_req("newAccount", {"termsOfServiceAgreed": True})
@@ -337,6 +359,7 @@ class Challenge:
         challenge = self.get_challenge()
         self.token = challenge["token"]
         self.verified = challenge["status"] == "valid"
+        self.domain = data["identifier"]["value"]  # Add domain attribute
 
         jwk_json = json.dumps(self._acme.jwk, sort_keys=True, separators=(",", ":"))
         thumbprint = b64_encode(digest_sha256(jwk_json.encode("utf8")))
@@ -344,9 +367,11 @@ class Challenge:
 
         self.url = "http://{0}/.well-known/acme-challenge/{1}".format(data["identifier"]["value"], self.token)
 
-    def verify(self) -> bool:
+    def verify(self, dns=False) -> bool:
         if not self.verified:
-            response = self._acme._signed_req(self.get_challenge()["url"], {}, step="Verify Challenge", throw=False)
+            response = self._acme._signed_req(
+                self.get_challenge(key="dns-01" if dns else "http-01")["url"], {}, step="Verify Challenge", throw=False
+            )
             if response.status_code == 200 and response.json()["status"] == "valid":
                 self.verified = True
                 return True
@@ -378,9 +403,16 @@ class Challenge:
                 return False
 
     def get_challenge(self, key="http-01"):
-        for method in self._data["challenges"]:
+        challenges = self._data["challenges"]
+        for method in challenges:
             if method["type"] == key:
                 return method
+        if len(challenges) == 1:
+            return challenges[0]
+
+        ch_types = [x["type"] for x in self._data["challenges"]]
         raise AcmeError(
-            "'http-01' not found in challenges", {"response": self._data["challenges"]}, "Acme Challenge Verification"
+            f"'{key}' not found in challenges. available:{str(ch_types)}",
+            {"response": self._data["challenges"]},
+            "Acme Challenge Verification",
         )

{certapi-0.1.0 → certapi-0.2.0}/src/certapi/__init__.py

@@ -1,5 +1,6 @@
 from .Acme import Acme, Order, AcmeNetworkError, AcmeHttpError, Challenge
 from .certauthority import CertAuthority
+from .custom_certauthority import CertificateIssuer
 from .crypto import gen_key_ed25519, create_csr
 from .db import KeyStore, FilesystemKeyStore, SqliteKeyStore, PostgresKeyStore
 from .challenge import InMemoryChallengeStore, FileSystemChallengeStore

{certapi-0.1.0 → certapi-0.2.0}/src/certapi/certauthority.py

@@ -6,19 +6,35 @@ import requests
 from cryptography.x509 import Certificate
 from requests import Response
 
+from typing import List, Union, Callable, Tuple, Dict
+import json
+import time
+
+import requests
+from cryptography.x509 import Certificate
+from requests import Response
+
 from . import Acme, Challenge, Order
 from . import crypto
 from . import challenge
-from .crypto import cert_to_pem, key_to_pem
+from .crypto import cert_to_pem, key_to_pem, digest_sha256
 from .crypto_classes import Key
 from .db import KeyStore
+from .util import b64_string
 
 
 class CertAuthority:
-    def __init__(self, challenge_store: challenge.ChallengeStore, key_store: KeyStore,acme_url=None):
-        self.acme = Acme(key_store.account_key,url=acme_url)
+    def __init__(
+        self,
+        challenge_store: challenge.ChallengeStore,
+        key_store: KeyStore,
+        acme_url=None,
+        dns_stores: List[challenge.ChallengeStore] = None,
+    ):
+        self.acme = Acme(key_store.account_key, url=acme_url)
         self.key_store = key_store
         self.challengesStore: challenge.ChallengeStore = challenge_store
+        self.dns_stores = dns_stores if dns_stores is not None else []
 
     def setup(self):
         self.acme.setup()
@@ -28,27 +44,58 @@ class CertAuthority:
         elif res.status_code != 200:
             raise Exception("Acme registration didn't return 200 or 201 ", res.json())
 
-    def obtainCert(
-        self, host: Union[str, List[str]]
-    ) -> Union[Tuple["CertificateResponse", None], Tuple[None, requests.Response]]:
+    def obtainCert(self, host: Union[str, List[str]]) -> "CertificateResponse":
         if type(host) == str:
             host = [host]
 
         existing = {c[0]: c[1] for c in [(h, self.key_store.get_cert(h)) for h in host] if c[1] is not None}
         missing = [h for h in host if h not in existing]
         if len(missing) > 0:
+            has_wildcard = False
+            # Determine which challenge store to use
+            challenge_store_to_use = self.challengesStore
+            for h in missing:
+                if h.startswith("*."):  # Wildcard domain
+                    has_wildcard = True
+                    found_dns_store = False
+
+                    for dns_store in self.dns_stores:
+                        if dns_store.has_domain(h.lstrip("*.")):  # Check if the DNS store can handle the base domain
+                            challenge_store_to_use = dns_store
+                            found_dns_store = True
+                            break
+                    if not found_dns_store:
+                        raise Exception(f"No DNS challenge store found for wildcard domain {h}")
+                    break  # Assuming all domains in a single request will use the same challenge type
+
             private_key = crypto.gen_key_secp256r1()
             order = self.acme.create_authorized_order(missing)
 
             challenges = order.remaining_challenges()
+
             for c in challenges:
                 print("[ Challenge ]", c.token, "=", c.authorization_key)
-                self.challengesStore[c.token] = c.authorization_key
+                # For DNS-01 challenges, the key should be _acme-challenge.<domain>
+                challenge_name = f"_acme-challenge.{c.domain}" if has_wildcard else c.token
+
+                # For DNS-01 challenges, the value is the SHA256 hash of the authorization_key, base64url encoded
+                challenge_value = (
+                    b64_string(digest_sha256(c.authorization_key.encode("utf8")))
+                    if has_wildcard
+                    else c.authorization_key
+                )
+
+                challenge_store_to_use.save_challenge(challenge_name, challenge_value, c.domain)
+
+            # Add an initial sleep to allow DNS propagation
+            if has_wildcard:
+                print("Waiting for DNS propagation (10 seconds)...")
+                time.sleep(10)
+
             for c in challenges:
                 # c.self_verify()
-                c.verify()
-
-            end = time.time() + 40  # max 12 seconds
+                c.verify(dns=has_wildcard)
+            end = time.time() + 60  # Increase overall timeout
             source: List[Challenge] = [x for x in challenges]
             sink = []
             counter = 1
@@ -63,8 +110,6 @@ class CertAuthority:
                 if len(sink) > 0:
                     time.sleep(3)
                 source, sink, counter = sink, [], counter + 1
-            else:
-                print("Order is already Ready.")
             csr = crypto.create_csr(private_key, missing[0], missing[1:])
             order.finalize(csr)
 
@@ -73,21 +118,28 @@ class CertAuthority:
                 order.refresh()  # is this refresh necessary?
 
                 if order.status == "valid":
-                    (certificate, _) = order.get_certificate()
+                    certificate = order.get_certificate()
                     key_id = self.key_store.save_key(private_key, missing[0])
                     cert_id = self.key_store.save_cert(key_id, certificate, missing)
                     issued_cert = IssuedCert(key_to_pem(private_key), certificate, missing)
-                    response = createExistingResponse(existing, [issued_cert])
-                    return (response, None)
+                    # Clean up challenges after successful certificate issuance
+                    for c in challenges:
+                        challenge_name = f"_acme-challenge.{c.domain}" if has_wildcard else c.token
+                        challenge_store_to_use.delete_challenge(challenge_name, c.domain)
+                    return createExistingResponse(existing, [issued_cert])
                 elif order.status == "processing":
                     if count == 0:
+                        # Clean up challenges if timeout occurs
+                        for c in challenges:
+                            challenge_name = f"_acme-challenge.{c.domain}" if has_wildcard else c.token
+                            challenge_store_to_use.delete_challenge(challenge_name, c.domain)
                         return None
                     return obtain_cert()
                 return None
 
             return obtain_cert()
         else:
-            return createExistingResponse(existing, []), None
+            return createExistingResponse(existing, [])
 
 
 def createExistingResponse(existing: Dict[str, Tuple[int | str, Key, Certificate]], issued_certs: List["IssuedCert"]):

{certapi-0.1.0 → certapi-0.2.0}/src/certapi/challenge.py

@@ -2,28 +2,19 @@ import os
 from collections.abc import MutableMapping
 
 
-class ChallengeStore(MutableMapping):
+class ChallengeStore:
     """
     Abstract base class for a challenge store.
-    Provides dictionary-like behavior by inheriting from MutableMapping.
     """
 
-    def __setitem__(self, key, value):
-        self.save_challenge(key, value)
-
-    def __getitem__(self, key):
-        value = self.get_challenge(key)
-        if value is None:
-            raise KeyError(key)
-        return value
+    def save_challenge(self, key: str, value: str, domain: str = None):
+        raise NotImplementedError("Must implement `save_challenge` method.")
 
-    def __delitem__(self, key):
-        if key not in self:
-            raise KeyError(key)
-        self.delete_challenge(key)
+    def get_challenge(self, key: str, domain: str = None) -> str:
+        raise NotImplementedError("Must implement `get_challenge` method.")
 
-    def __contains__(self, key):
-        return self.get_challenge(key) is not None
+    def delete_challenge(self, key: str, domain: str = None):
+        raise NotImplementedError("Must implement `delete_challenge` method.")
 
     def __iter__(self):
         raise NotImplementedError("Must implement `__iter__` method.")
@@ -31,15 +22,6 @@ class ChallengeStore(MutableMapping):
     def __len__(self):
         raise NotImplementedError("Must implement `__len__` method.")
 
-    def save_challenge(self, key: str, value: str):
-        raise NotImplementedError("Must implement `save_challenge` method.")
-
-    def get_challenge(self, key: str) -> str:
-        raise NotImplementedError("Must implement `get_challenge` method.")
-
-    def delete_challenge(self, key: str):
-        raise NotImplementedError("Must implement `delete_challenge` method.")
-
 
 class InMemoryChallengeStore(ChallengeStore):
     """
@@ -49,13 +31,13 @@ class InMemoryChallengeStore(ChallengeStore):
     def __init__(self):
         self.challenges = {}
 
-    def save_challenge(self, key: str, value: str):
+    def save_challenge(self, key: str, value: str, domain: str = None):
         self.challenges[key] = value
 
-    def get_challenge(self, key: str) -> str:
+    def get_challenge(self, key: str, domain: str = None) -> str:
         return self.challenges.get(key, "")
 
-    def delete_challenge(self, key: str):
+    def delete_challenge(self, key: str, domain: str = None):
         if key in self.challenges:
             del self.challenges[key]
 
@@ -75,19 +57,19 @@ class FileSystemChallengeStore(ChallengeStore):
         self.directory = directory
         os.makedirs(self.directory, exist_ok=True)
 
-    def save_challenge(self, key: str, value: str):
+    def save_challenge(self, key: str, value: str, domain: str = None):
         file_path = os.path.join(self.directory, key)
         with open(file_path, "w") as file:
             file.write(value)
 
-    def get_challenge(self, key: str) -> str:
+    def get_challenge(self, key: str, domain: str = None) -> str:
         file_path = os.path.join(self.directory, key)
         if not os.path.exists(file_path):
             return None
         with open(file_path, "r") as file:
             return file.read()
 
-    def delete_challenge(self, key: str):
+    def delete_challenge(self, key: str, domain: str = None):
         file_path = os.path.join(self.directory, key)
         if os.path.exists(file_path):
             os.remove(file_path)

certapi-0.2.0/src/certapi/cloudflare_challenge_store.py

@@ -0,0 +1,57 @@
+import os
+from collections.abc import MutableMapping
+from certapi.challenge import ChallengeStore
+from certapi.cloudflare_client import Cloudflare
+
+
+class CloudflareChallengeStore(ChallengeStore):
+    def __init__(self):
+        self.cloudflare = Cloudflare()
+        self.challenges_map = {}  # Stores key: record_id (still needed for deletion)
+
+    def has_domain(self, domain: str) -> bool:
+        """
+        Checks if the Cloudflare account has access to the given domain (or its base domain)
+        as a registered zone.
+        """
+        try:
+            self.cloudflare.determine_registered_domain(domain)
+            return True
+        except Exception:
+            return False
+
+    def save_challenge(self, key: str, value: str, domain=None):
+        # key example: _acme-challenge.sub.example.com
+        # value example: ACME_CHALLENGE_TOKEN
+        base_domain = self.cloudflare.determine_registered_domain(domain)
+
+        record_id = self.cloudflare.create_record(name=key, data=value, domain=base_domain)
+        self.challenges_map[key] = record_id
+        print(f"CloudflareChallengeStore: Saved challenge for {key} with record ID {record_id}")
+
+    def get_challenge(self, key: str, domain: str) -> str:
+        base_domain = self.cloudflare.determine_registered_domain(domain)
+        records = self.cloudflare.list_txt_records(base_domain, name_filter=key)
+        for record in records:
+            if record["name"] == key:
+                return record["content"]
+        return None  # Return None if not found, as per ChallengeStore's __getitem__ behavior
+
+    def delete_challenge(self, key: str, domain: str):
+        if key not in self.challenges_map:
+            raise KeyError(f"Challenge {key} not found in store (no record_id stored).")
+
+        record_id = self.challenges_map[key]
+        base_domain = self.cloudflare.determine_registered_domain(domain)
+        self.cloudflare.delete_record(record=record_id, domain=base_domain)
+        del self.challenges_map[key]
+        print(f"CloudflareChallengeStore: Deleted challenge for {key} with record ID {record_id}")
+
+    def __iter__(self):
+        # This is tricky as we can't easily iterate all challenges across all domains
+        # If the user wants a full API-driven iteration, they need to clarify how to get all domains.
+        return iter(self.challenges_map)
+
+    def __len__(self):
+        # Similar to __iter__, this will count challenges managed by this store instance.
+        return len(self.challenges_map)