certapi 0.1.1__tar.gz → 0.2.0__tar.gz

{certapi-0.1.1 → certapi-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.1.1
+Version: 0.2.0
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -10,8 +10,6 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.6
 Description-Content-Type: text/markdown
-Requires-Dist: cryptography
-Requires-Dist: requests
 
 # CertApi
 

{certapi-0.1.1 → certapi-0.2.0}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="0.1.1",
+    version="0.2.0",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-0.1.1 → certapi-0.2.0}/src/certapi/Acme.py

@@ -8,11 +8,11 @@ from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.x509 import CertificateSigningRequest, Certificate
 from . import crypto
 import requests
-from .crypto import sign, digest_sha256, csr_to_der, jwk, get_algorithm_name
+from .crypto import sign, digest_sha256, csr_to_der, jwk, get_algorithm_name, sign_for_jws
 from .util import b64_encode, b64_string
 
-# acme_url = os.environ.get("LETSENCRYPT_API", "https://acme-staging-v02.api.letsencrypt.org/directory")
-acme_url = os.environ.get("LETSENCRYPT_API", None)
+acme_url = os.environ.get("LETSENCRYPT_API", "https://acme-staging-v02.api.letsencrypt.org/directory")
+# acme_url = os.environ.get("LETSENCRYPT_API", None)
 
 
 class AcmeError(Exception):
@@ -177,6 +177,7 @@ def request(method, step: str, url: str, json=None, headers=None, throw=True) ->
             step,
         )
     if 199 <= res.status_code > 299:
+
         [print(x, y) for (x, y) in res.headers.items()]
         print("Response:", res.text)
         json_data = None
@@ -211,8 +212,9 @@ class Acme:
         self.account_key = account_key
         # json web key format for public key
         self.jwk = jwk(self.account_key)
+        print(self.jwk)
         self.nonce = []
-        self.acme_url = url if url else self.URL_PROD
+        self.acme_url = url if url else self.URL_STAGING
         self.key_id = None
         self.directory = None
         self._nonce_lock = threading.Lock()  # Mutex for safe access to nonce
@@ -267,7 +269,7 @@ class Acme:
         payload = {
             "protected": protectedb64.decode("utf-8"),
             "payload": payload64.decode("utf-8"),
-            "signature": b64_string(sign(self.account_key, b".".join([protectedb64, payload64]))),
+            "signature": b64_string(sign_for_jws(self.account_key, b".".join([protectedb64, payload64]))),
         }
         try:
 
@@ -357,6 +359,7 @@ class Challenge:
         challenge = self.get_challenge()
         self.token = challenge["token"]
         self.verified = challenge["status"] == "valid"
+        self.domain = data["identifier"]["value"]  # Add domain attribute
 
         jwk_json = json.dumps(self._acme.jwk, sort_keys=True, separators=(",", ":"))
         thumbprint = b64_encode(digest_sha256(jwk_json.encode("utf8")))
@@ -364,9 +367,11 @@ class Challenge:
 
         self.url = "http://{0}/.well-known/acme-challenge/{1}".format(data["identifier"]["value"], self.token)
 
-    def verify(self) -> bool:
+    def verify(self, dns=False) -> bool:
         if not self.verified:
-            response = self._acme._signed_req(self.get_challenge()["url"], {}, step="Verify Challenge", throw=False)
+            response = self._acme._signed_req(
+                self.get_challenge(key="dns-01" if dns else "http-01")["url"], {}, step="Verify Challenge", throw=False
+            )
             if response.status_code == 200 and response.json()["status"] == "valid":
                 self.verified = True
                 return True
@@ -398,9 +403,16 @@ class Challenge:
                 return False
 
     def get_challenge(self, key="http-01"):
-        for method in self._data["challenges"]:
+        challenges = self._data["challenges"]
+        for method in challenges:
             if method["type"] == key:
                 return method
+        if len(challenges) == 1:
+            return challenges[0]
+
+        ch_types = [x["type"] for x in self._data["challenges"]]
         raise AcmeError(
-            "'http-01' not found in challenges", {"response": self._data["challenges"]}, "Acme Challenge Verification"
+            f"'{key}' not found in challenges. available:{str(ch_types)}",
+            {"response": self._data["challenges"]},
+            "Acme Challenge Verification",
         )

{certapi-0.1.1 → certapi-0.2.0}/src/certapi/__init__.py

@@ -1,5 +1,6 @@
 from .Acme import Acme, Order, AcmeNetworkError, AcmeHttpError, Challenge
 from .certauthority import CertAuthority
+from .custom_certauthority import CertificateIssuer
 from .crypto import gen_key_ed25519, create_csr
 from .db import KeyStore, FilesystemKeyStore, SqliteKeyStore, PostgresKeyStore
 from .challenge import InMemoryChallengeStore, FileSystemChallengeStore

{certapi-0.1.1 → certapi-0.2.0}/src/certapi/certauthority.py

@@ -6,19 +6,35 @@ import requests
 from cryptography.x509 import Certificate
 from requests import Response
 
+from typing import List, Union, Callable, Tuple, Dict
+import json
+import time
+
+import requests
+from cryptography.x509 import Certificate
+from requests import Response
+
 from . import Acme, Challenge, Order
 from . import crypto
 from . import challenge
-from .crypto import cert_to_pem, key_to_pem
+from .crypto import cert_to_pem, key_to_pem, digest_sha256
 from .crypto_classes import Key
 from .db import KeyStore
+from .util import b64_string
 
 
 class CertAuthority:
-    def __init__(self, challenge_store: challenge.ChallengeStore, key_store: KeyStore, acme_url=None):
+    def __init__(
+        self,
+        challenge_store: challenge.ChallengeStore,
+        key_store: KeyStore,
+        acme_url=None,
+        dns_stores: List[challenge.ChallengeStore] = None,
+    ):
         self.acme = Acme(key_store.account_key, url=acme_url)
         self.key_store = key_store
         self.challengesStore: challenge.ChallengeStore = challenge_store
+        self.dns_stores = dns_stores if dns_stores is not None else []
 
     def setup(self):
         self.acme.setup()
@@ -35,18 +51,51 @@ class CertAuthority:
         existing = {c[0]: c[1] for c in [(h, self.key_store.get_cert(h)) for h in host] if c[1] is not None}
         missing = [h for h in host if h not in existing]
         if len(missing) > 0:
+            has_wildcard = False
+            # Determine which challenge store to use
+            challenge_store_to_use = self.challengesStore
+            for h in missing:
+                if h.startswith("*."):  # Wildcard domain
+                    has_wildcard = True
+                    found_dns_store = False
+
+                    for dns_store in self.dns_stores:
+                        if dns_store.has_domain(h.lstrip("*.")):  # Check if the DNS store can handle the base domain
+                            challenge_store_to_use = dns_store
+                            found_dns_store = True
+                            break
+                    if not found_dns_store:
+                        raise Exception(f"No DNS challenge store found for wildcard domain {h}")
+                    break  # Assuming all domains in a single request will use the same challenge type
+
             private_key = crypto.gen_key_secp256r1()
             order = self.acme.create_authorized_order(missing)
 
             challenges = order.remaining_challenges()
+
             for c in challenges:
                 print("[ Challenge ]", c.token, "=", c.authorization_key)
-                self.challengesStore[c.token] = c.authorization_key
+                # For DNS-01 challenges, the key should be _acme-challenge.<domain>
+                challenge_name = f"_acme-challenge.{c.domain}" if has_wildcard else c.token
+
+                # For DNS-01 challenges, the value is the SHA256 hash of the authorization_key, base64url encoded
+                challenge_value = (
+                    b64_string(digest_sha256(c.authorization_key.encode("utf8")))
+                    if has_wildcard
+                    else c.authorization_key
+                )
+
+                challenge_store_to_use.save_challenge(challenge_name, challenge_value, c.domain)
+
+            # Add an initial sleep to allow DNS propagation
+            if has_wildcard:
+                print("Waiting for DNS propagation (10 seconds)...")
+                time.sleep(10)
+
             for c in challenges:
                 # c.self_verify()
-                c.verify()
-
-            end = time.time() + 40  # max 12 seconds
+                c.verify(dns=has_wildcard)
+            end = time.time() + 60  # Increase overall timeout
             source: List[Challenge] = [x for x in challenges]
             sink = []
             counter = 1
@@ -61,8 +110,6 @@ class CertAuthority:
                 if len(sink) > 0:
                     time.sleep(3)
                 source, sink, counter = sink, [], counter + 1
-            else:
-                print("Order is already Ready.")
             csr = crypto.create_csr(private_key, missing[0], missing[1:])
             order.finalize(csr)
 
@@ -75,9 +122,17 @@ class CertAuthority:
                     key_id = self.key_store.save_key(private_key, missing[0])
                     cert_id = self.key_store.save_cert(key_id, certificate, missing)
                     issued_cert = IssuedCert(key_to_pem(private_key), certificate, missing)
+                    # Clean up challenges after successful certificate issuance
+                    for c in challenges:
+                        challenge_name = f"_acme-challenge.{c.domain}" if has_wildcard else c.token
+                        challenge_store_to_use.delete_challenge(challenge_name, c.domain)
                     return createExistingResponse(existing, [issued_cert])
                 elif order.status == "processing":
                     if count == 0:
+                        # Clean up challenges if timeout occurs
+                        for c in challenges:
+                            challenge_name = f"_acme-challenge.{c.domain}" if has_wildcard else c.token
+                            challenge_store_to_use.delete_challenge(challenge_name, c.domain)
                         return None
                     return obtain_cert()
                 return None

{certapi-0.1.1 → certapi-0.2.0}/src/certapi/challenge.py

@@ -2,28 +2,19 @@ import os
 from collections.abc import MutableMapping
 
 
-class ChallengeStore(MutableMapping):
+class ChallengeStore:
     """
     Abstract base class for a challenge store.
-    Provides dictionary-like behavior by inheriting from MutableMapping.
     """
 
-    def __setitem__(self, key, value):
-        self.save_challenge(key, value)
-
-    def __getitem__(self, key):
-        value = self.get_challenge(key)
-        if value is None:
-            raise KeyError(key)
-        return value
+    def save_challenge(self, key: str, value: str, domain: str = None):
+        raise NotImplementedError("Must implement `save_challenge` method.")
 
-    def __delitem__(self, key):
-        if key not in self:
-            raise KeyError(key)
-        self.delete_challenge(key)
+    def get_challenge(self, key: str, domain: str = None) -> str:
+        raise NotImplementedError("Must implement `get_challenge` method.")
 
-    def __contains__(self, key):
-        return self.get_challenge(key) is not None
+    def delete_challenge(self, key: str, domain: str = None):
+        raise NotImplementedError("Must implement `delete_challenge` method.")
 
     def __iter__(self):
         raise NotImplementedError("Must implement `__iter__` method.")
@@ -31,15 +22,6 @@ class ChallengeStore(MutableMapping):
     def __len__(self):
         raise NotImplementedError("Must implement `__len__` method.")
 
-    def save_challenge(self, key: str, value: str):
-        raise NotImplementedError("Must implement `save_challenge` method.")
-
-    def get_challenge(self, key: str) -> str:
-        raise NotImplementedError("Must implement `get_challenge` method.")
-
-    def delete_challenge(self, key: str):
-        raise NotImplementedError("Must implement `delete_challenge` method.")
-
 
 class InMemoryChallengeStore(ChallengeStore):
     """
@@ -49,13 +31,13 @@ class InMemoryChallengeStore(ChallengeStore):
     def __init__(self):
         self.challenges = {}
 
-    def save_challenge(self, key: str, value: str):
+    def save_challenge(self, key: str, value: str, domain: str = None):
         self.challenges[key] = value
 
-    def get_challenge(self, key: str) -> str:
+    def get_challenge(self, key: str, domain: str = None) -> str:
         return self.challenges.get(key, "")
 
-    def delete_challenge(self, key: str):
+    def delete_challenge(self, key: str, domain: str = None):
         if key in self.challenges:
             del self.challenges[key]
 
@@ -75,19 +57,19 @@ class FileSystemChallengeStore(ChallengeStore):
         self.directory = directory
         os.makedirs(self.directory, exist_ok=True)
 
-    def save_challenge(self, key: str, value: str):
+    def save_challenge(self, key: str, value: str, domain: str = None):
         file_path = os.path.join(self.directory, key)
         with open(file_path, "w") as file:
             file.write(value)
 
-    def get_challenge(self, key: str) -> str:
+    def get_challenge(self, key: str, domain: str = None) -> str:
         file_path = os.path.join(self.directory, key)
         if not os.path.exists(file_path):
             return None
         with open(file_path, "r") as file:
             return file.read()
 
-    def delete_challenge(self, key: str):
+    def delete_challenge(self, key: str, domain: str = None):
         file_path = os.path.join(self.directory, key)
         if os.path.exists(file_path):
             os.remove(file_path)

certapi-0.2.0/src/certapi/cloudflare_challenge_store.py

@@ -0,0 +1,57 @@
+import os
+from collections.abc import MutableMapping
+from certapi.challenge import ChallengeStore
+from certapi.cloudflare_client import Cloudflare
+
+
+class CloudflareChallengeStore(ChallengeStore):
+    def __init__(self):
+        self.cloudflare = Cloudflare()
+        self.challenges_map = {}  # Stores key: record_id (still needed for deletion)
+
+    def has_domain(self, domain: str) -> bool:
+        """
+        Checks if the Cloudflare account has access to the given domain (or its base domain)
+        as a registered zone.
+        """
+        try:
+            self.cloudflare.determine_registered_domain(domain)
+            return True
+        except Exception:
+            return False
+
+    def save_challenge(self, key: str, value: str, domain=None):
+        # key example: _acme-challenge.sub.example.com
+        # value example: ACME_CHALLENGE_TOKEN
+        base_domain = self.cloudflare.determine_registered_domain(domain)
+
+        record_id = self.cloudflare.create_record(name=key, data=value, domain=base_domain)
+        self.challenges_map[key] = record_id
+        print(f"CloudflareChallengeStore: Saved challenge for {key} with record ID {record_id}")
+
+    def get_challenge(self, key: str, domain: str) -> str:
+        base_domain = self.cloudflare.determine_registered_domain(domain)
+        records = self.cloudflare.list_txt_records(base_domain, name_filter=key)
+        for record in records:
+            if record["name"] == key:
+                return record["content"]
+        return None  # Return None if not found, as per ChallengeStore's __getitem__ behavior
+
+    def delete_challenge(self, key: str, domain: str):
+        if key not in self.challenges_map:
+            raise KeyError(f"Challenge {key} not found in store (no record_id stored).")
+
+        record_id = self.challenges_map[key]
+        base_domain = self.cloudflare.determine_registered_domain(domain)
+        self.cloudflare.delete_record(record=record_id, domain=base_domain)
+        del self.challenges_map[key]
+        print(f"CloudflareChallengeStore: Deleted challenge for {key} with record ID {record_id}")
+
+    def __iter__(self):
+        # This is tricky as we can't easily iterate all challenges across all domains
+        # If the user wants a full API-driven iteration, they need to clarify how to get all domains.
+        return iter(self.challenges_map)
+
+    def __len__(self):
+        # Similar to __iter__, this will count challenges managed by this store instance.
+        return len(self.challenges_map)

certapi-0.2.0/src/certapi/cloudflare_client.py

@@ -0,0 +1,137 @@
+import json
+import time
+from os import getenv
+from urllib.request import urlopen, Request
+
+
+class Cloudflare(object):
+    name = "cloudflare"
+
+    def __init__(self):
+        self.token = getenv("CLOUDFLARE_API_TOKEN")
+        self.account_id = getenv("CLOUDFLARE_ACCOUNT_ID")
+        self.api = "https://api.cloudflare.com/client/v4"
+        if not self.token:
+            raise Exception("CLOUDFLARE_API_TOKEN not found in environment")
+
+        self._zones_cache = None
+        self._zones_cache_time = 0  # Unix timestamp of last cache update
+
+    def _cloudflare_headers(self):
+        return {"Content-Type": "application/json", "Authorization": "Bearer " + self.token}
+
+    def _get_zones(self):
+        """Fetch and cache Cloudflare zones"""
+        # Cache for 1 day (86400 seconds)
+        if self._zones_cache and (time.time() - self._zones_cache_time) < 86400:
+            return self._zones_cache
+
+        request_headers = self._cloudflare_headers()
+        api_url = "{0}/zones?per_page=50".format(self.api)
+        response = urlopen(Request(api_url, headers=request_headers))
+        if response.getcode() != 200:
+            raise Exception(json.loads(response.read().decode("utf8")))
+
+        zones = json.loads(response.read().decode("utf8"))["result"]
+        self._zones_cache = zones
+        self._zones_cache_time = time.time()
+        return zones
+
+    def _get_zone_id(self, domain):
+        """Determine Cloudflare Zone ID for a given domain"""
+        zones = self._get_zones()
+        for zone in zones:
+            if zone["name"] == domain:
+                return zone["id"]
+        raise Exception("No Cloudflare zone found for domain: {0}".format(domain))
+
+    def determine_registered_domain(self, domain: str) -> str:
+        """
+        Determine the registered domain in Cloudflare for a given (sub)domain.
+        This method iterates through parts of the domain to find a matching Cloudflare zone.
+        """
+        parts = domain.split(".")
+        err = None
+        for i in range(len(parts)):
+            potential_domain = ".".join(parts[i:])
+            try:
+                self._get_zone_id(potential_domain)
+                return potential_domain
+            except Exception as e:
+                err = e
+                continue
+        if err:
+            raise err
+        else:
+            raise Exception("Could not determine Cloudflare registered domain for: {0}".format(domain))
+
+    def list_txt_records(self, domain: str, name_filter: str = None) -> list:
+        """
+        Lists TXT records for a given domain, optionally filtered by name.
+        Returns a list of dictionaries, each representing a TXT record.
+        """
+        registered_domain = self.determine_registered_domain(domain)
+        zone_id = self._get_zone_id(registered_domain)
+        api_url = f"{self.api}/zones/{zone_id}/dns_records?type=TXT"
+        if name_filter:
+            api_url += f"&name={name_filter}"
+
+        request_headers = self._cloudflare_headers()
+        response = urlopen(Request(api_url, headers=request_headers))
+
+        if response.getcode() != 200:
+            raise Exception(json.loads(response.read().decode("utf8")))
+
+        result = json.loads(response.read().decode("utf8"))
+        if not result.get("success"):
+            raise Exception(result.get("errors", "Unknown error listing TXT records"))
+
+        return result["result"]
+
+    def create_record(self, name, data, domain):
+        """
+        Create DNS record
+        Params:
+            name, string, record name (e.g., _acme-challenge.example.com)
+            data, string, record data (e.g., ACME challenge token)
+            domain, string, dns domain (e.g., example.com) - This will be used to determine the registered zone.
+        Return:
+            record_id, string, created record id
+        """
+        registered_domain = self.determine_registered_domain(domain)
+        zone_id = self._get_zone_id(registered_domain)
+        api_url = "{0}/zones/{1}/dns_records".format(self.api, zone_id)
+        request_headers = self._cloudflare_headers()
+        request_data = {
+            "type": "TXT",
+            "name": name,
+            "content": data,
+            "ttl": 120,  # Cloudflare minimum TTL for TXT is 120 seconds
+            "proxied": False,
+        }
+        response = urlopen(Request(api_url, data=json.dumps(request_data).encode("utf8"), headers=request_headers))
+
+        if response.getcode() != 200:
+            raise Exception(json.loads(response.read().decode("utf8")))
+        result = response.read().decode("utf8")
+        print("Cloudflare create record", name, result)
+        return json.loads(result)["result"]["id"]
+
+    def delete_record(self, record, domain):
+        """
+        Delete DNS record
+        Params:
+            record, string, record id number
+            domain, string, dns domain - This will be used to determine the registered zone.
+        """
+        registered_domain = self.determine_registered_domain(domain)
+        zone_id = self._get_zone_id(registered_domain)
+        api_url = "{0}/zones/{1}/dns_records/{2}".format(self.api, zone_id, record)
+        request_headers = self._cloudflare_headers()
+        request = Request(api_url, headers=request_headers)
+        request.get_method = lambda: "DELETE"
+        response = urlopen(request)
+        result = response.read().decode("utf8")
+        print(f"Delete dns record [{response.getcode()}]", result)
+        if response.getcode() != 200:
+            raise Exception(json.loads(response.read().decode("utf8")))

{certapi-0.1.1 → certapi-0.2.0}/src/certapi/crypto.py

@@ -2,6 +2,7 @@ from typing import List, Union
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import utils
 from cryptography.hazmat.primitives.asymmetric import rsa, ec, padding, ed25519
 from cryptography import x509
 from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
@@ -31,6 +32,10 @@ def gen_key_ed25519():
     return ed25519.Ed25519PrivateKey.generate()
 
 
+def gen_key_ecdsa():
+    return ec.generate_private_key(ec.SECP256R1())
+
+
 def get_algorithm_name(key):
     if isinstance(key, RSAPrivateKey):
         return "RS256"
@@ -44,6 +49,8 @@ def get_algorithm_name(key):
             return "ES384"
         elif curve_name == "secp521r1":
             return "ES512"
+        else:
+            raise ValueError(f"Unsupported EC curve: {curve_name}")
     else:
         raise ValueError("Unsupported key type")
 
@@ -132,11 +139,23 @@ def sign(key: Union[RSAPrivateKey, Ed25519PrivateKey, EllipticCurvePrivateKey],
         return key.sign(message, ec.ECDSA(hasher))
 
 
+def sign_for_jws(key, message, hasher=hashes.SHA256()):
+    if isinstance(key, EllipticCurvePrivateKey):
+        der_sig = key.sign(message, ec.ECDSA(hasher))
+        r, s = utils.decode_dss_signature(der_sig)
+        num_bytes = (key.curve.key_size + 7) // 8
+        r_bytes = r.to_bytes(num_bytes, "big")
+        s_bytes = s.to_bytes(num_bytes, "big")
+        return r_bytes + s_bytes
+    else:
+        return sign(key, message, hasher)
+
+
 def sign_jws(key: RSAPrivateKey, data: object):
     pass
 
 
-def key_to_der(key: [RSAPrivateKey, Ed25519PrivateKey, EllipticCurvePrivateKey]) -> bytes:
+def key_to_der(key: RSAPrivateKey | Ed25519PrivateKey | EllipticCurvePrivateKey) -> bytes:
     return key.private_bytes(
         encoding=serialization.Encoding.DER, format=serialization.PrivateFormat.PKCS8, encryption_algorithm=__no_enc
     )

certapi-0.2.0/src/certapi/crypto_classes.py

@@ -0,0 +1,240 @@
+from abc import ABC, abstractmethod
+from cryptography.hazmat.primitives.asymmetric import rsa, ed25519, ec
+from cryptography.hazmat.primitives import serialization, hashes, padding
+from typing import Literal, Optional, List, Union
+from cryptography import x509
+from cryptography.x509.oid import NameOID
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from .crypto import key_to_der, key_to_pem
+from .util import b64_string
+
+
+class Key(ABC):
+    key: rsa.RSAPrivateKey | ed25519.Ed25519PrivateKey | ec.EllipticCurvePrivateKey
+
+    @abstractmethod
+    def jwk(self):
+        pass
+
+    @abstractmethod
+    def sign(self, message):
+        pass
+
+    @abstractmethod
+    def sign_csr(self, csr):
+        pass
+
+    @staticmethod
+    def generate(key_type: Literal["rsa", "ecdsa", "ed25519"]) -> "Key":
+        if key_type == "rsa":
+            return RSAKey.generate()
+        elif key_type == "ecdsa":
+            return ECDSAKey.generate()
+        elif key_type == "ed25519":
+            return Ed25519Key.generate()
+        else:
+            raise ValueError("Unsupported key type. Use 'rsa' or 'ecdsa'")
+
+    @staticmethod
+    def from_der(der_bytes):
+        key = serialization.load_der_private_key(der_bytes, password=None)
+        if isinstance(key, rsa.RSAPrivateKey):
+            return RSAKey(key)
+        elif isinstance(key, ec.EllipticCurvePrivateKey):
+            return ECDSAKey(key)
+        elif isinstance(key, Ed25519PrivateKey):
+            return Ed25519Key(key)
+        else:
+            raise ValueError("Unsupported key type")
+
+    @staticmethod
+    def from_pem(der_bytes):
+        key = serialization.load_pem_private_key(der_bytes, password=None)
+        if isinstance(key, rsa.RSAPrivateKey):
+            return RSAKey(key)
+        elif isinstance(key, ec.EllipticCurvePrivateKey):
+            return ECDSAKey(key)
+        elif isinstance(key, Ed25519PrivateKey):
+            return Ed25519Key(key)
+        else:
+            raise ValueError("Unsupported key type")
+
+    def to_der(self) -> bytes:
+        return key_to_der(self.key)
+
+    def to_pem(self) -> bytes:
+        return key_to_pem(self.key)
+
+    def _build_name(self, fields: dict, include_user_id=False, domain=None) -> x509.Name:
+        name_attrs = []
+        field_map = {
+            "country": NameOID.COUNTRY_NAME,
+            "state": NameOID.STATE_OR_PROVINCE_NAME,
+            "locality": NameOID.LOCALITY_NAME,
+            "organization": NameOID.ORGANIZATION_NAME,
+            "common_name": NameOID.COMMON_NAME,
+        }
+
+        for key, oid in field_map.items():
+            value = fields.get(key)
+            if value:
+                name_attrs.append(x509.NameAttribute(oid, value))
+
+        if include_user_id:
+            user_id = fields.get("user_id") or domain
+            if user_id:
+                name_attrs.append(x509.NameAttribute(NameOID.USER_ID, user_id))
+
+        return x509.Name(name_attrs)
+
+    def create_csr(
+        self,
+        domain: str,
+        alt_names: List[str] = (),
+        country: Optional[str] = None,
+        state: Optional[str] = None,
+        locality: Optional[str] = None,
+        organization: Optional[str] = None,
+        user_id: Optional[str] = None,
+    ) -> x509.CertificateSigningRequest:
+        """
+        Create a Certificate Signing Request (CSR) with the specified parameters.
+
+        Args:
+            domain: The common name (CN) for the CSR.
+            alt_names: List of Subject Alternative Names (SAN) for the CSR.
+            country: Country name for the subject.
+            state: State or province name for the subject.
+            locality: Locality name for the subject.
+            organization: Organization name for the subject.
+            user_id: Optional user ID to include in the subject.
+
+        Returns:
+            x509.CertificateSigningRequest: The generated CSR.
+        """
+        # Build subject fields
+        subject_fields = {
+            "country": country,
+            "state": state,
+            "locality": locality,
+            "organization": organization,
+            "common_name": domain,
+            "user_id": user_id or domain,
+        }
+        subject = self._build_name(subject_fields, include_user_id=True, domain=domain)
+
+        # Build CSR with optional SAN extension
+        csr_builder = x509.CertificateSigningRequestBuilder().subject_name(subject)
+        if alt_names:
+            csr_builder = csr_builder.add_extension(
+                x509.SubjectAlternativeName([x509.DNSName(name) for name in alt_names]),
+                critical=False,
+            )
+
+        # Sign the CSR using the subclass-specific signing method
+        return self.sign_csr(csr_builder)
+
+
+class RSAKey(Key):
+    def __init__(self, key: rsa.RSAPrivateKey, hasher=hashes.SHA256()):
+        self.key = key
+        self.hasher = hasher
+
+    @staticmethod
+    def generate():
+        key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        return RSAKey(key)
+
+    def jwk(self):
+        public = self.key.public_key().public_numbers()
+        return {
+            "e": b64_string((public.e).to_bytes((public.e.bit_length() + 7) // 8, "big")),
+            "kty": "RSA",
+            "n": b64_string((public.n).to_bytes((public.n.bit_length() + 7) // 8, "big")),
+        }
+
+    def sign(self, message):
+        return self.key.sign(message, padding.PKCS1v15(), self.hasher)
+
+    def sign_csr(self, csr):
+        return csr.sign(self.key, self.hasher)
+
+    def algorithm_name(self):
+        return "RS" + str(self.hasher.digest_size * 8)
+
+
+class Ed25519Key(Key):
+    def __init__(self, key: ed25519.Ed25519PrivateKey):
+        self.key = key
+        self.keyid = "e"
+        public = self.key.public_key().public_bytes(
+            encoding=serialization.Encoding.Raw, format=serialization.PublicFormat.Raw
+        )
+        self.jwk = {
+            "crv": "Ed25519",
+            "kty": "OKP",
+            "x": b64_string(public),
+        }
+
+    @staticmethod
+    def generate():
+        key = ed25519.Ed25519PrivateKey.generate()
+        return Ed25519Key(key)
+
+    def jwk(self):
+        return self.jwk
+
+    def sign(self, message):
+        return self.key.sign(message)
+
+    def sign_csr(self, csr):
+        return csr.sign(self.key, None)
+
+
+class ECDSAKey(Key):
+    def __init__(self, key: ec.EllipticCurvePrivateKey):
+        self.key = key
+        public_key = self.key.public_key()
+        public_numbers = public_key.public_numbers()
+        self.jwk = {
+            "kty": "EC",
+            "crv": self.key.curve.name,
+            "x": b64_string(public_numbers.x.to_bytes((public_numbers.x.bit_length() + 7) // 8, "big")),
+            "y": b64_string(public_numbers.y.to_bytes((public_numbers.y.bit_length() + 7) // 8, "big")),
+        }
+
+    @staticmethod
+    def generate():
+        key = ec.generate_private_key(ec.SECP256R1())
+        return ECDSAKey(key)
+
+    def jwk(self):
+        return self.jwk
+
+    def algorithm_name(self):
+        return self.key.curve.name
+
+    def sign(self, message):
+        key_size = self.key.curve.key_size
+        if key_size == 256:
+            algorithm = hashes.SHA256()
+        elif key_size == 384:
+            algorithm = hashes.SHA384()
+        elif key_size == 521:
+            algorithm = hashes.SHA512()
+        else:
+            raise ValueError(f"Unsupported curve with key size {key_size}")
+        return self.key.sign(message, ec.ECDSA(algorithm))
+
+    def sign_csr(self, csr):
+        key_size = self.key.curve.key_size
+        if key_size == 256:
+            algorithm = hashes.SHA256()
+        elif key_size == 384:
+            algorithm = hashes.SHA384()
+        elif key_size == 521:
+            algorithm = hashes.SHA512()
+        else:
+            raise ValueError(f"Unsupported curve with key size {key_size}")
+        return csr.sign(self.key, algorithm)

certapi-0.2.0/src/certapi/custom_certauthority.py

@@ -0,0 +1,127 @@
+from typing import Optional, List, Union
+from datetime import datetime, timedelta, timezone
+from cryptography import x509
+from cryptography.x509.oid import NameOID
+from certapi.crypto_classes import Key, RSAKey, ECDSAKey, Ed25519Key  # Assuming Key classes are in crypto_keys module
+
+
+class CertificateIssuer:
+    def __init__(
+        self,
+        key: Key,
+        *,
+        country: Optional[str] = "NP",
+        state: Optional[str] = "Kathmandu",
+        locality: Optional[str] = "Buddhanagar",
+        organization: Optional[str] = "Sireto Technology",
+        common_name: Optional[str] = "sireto.io",
+    ):
+        """Initialize the CertificateIssuer with a Key object."""
+        self.root_key: Key = key
+        self.issuer_fields = {
+            "country": country,
+            "state": state,
+            "locality": locality,
+            "organization": organization,
+            "common_name": common_name,
+        }
+        self.issuer = self._build_name(self.issuer_fields)
+
+    def _build_name(self, fields: dict, include_user_id=False, domain=None) -> x509.Name:
+        """Build an X509 Name object from field dictionary."""
+        name_attrs = []
+        field_map = {
+            "country": NameOID.COUNTRY_NAME,
+            "state": NameOID.STATE_OR_PROVINCE_NAME,
+            "locality": NameOID.LOCALITY_NAME,
+            "organization": NameOID.ORGANIZATION_NAME,
+            "common_name": NameOID.COMMON_NAME,
+        }
+
+        for key, oid in field_map.items():
+            value = fields.get(key)
+            if value:
+                name_attrs.append(x509.NameAttribute(oid, value))
+
+        if include_user_id:
+            user_id = fields.get("user_id") or domain
+            if user_id:
+                name_attrs.append(x509.NameAttribute(NameOID.USER_ID, user_id))
+
+        return x509.Name(name_attrs)
+
+    def get_ca_cert(self) -> x509.Certificate:
+        """Generate a self-signed CA certificate."""
+        now = datetime.now(timezone.utc)
+        builder = (
+            x509.CertificateBuilder()
+            .subject_name(self.issuer)
+            .issuer_name(self.issuer)
+            .public_key(self.root_key.key.public_key())
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(now)
+            .not_valid_after(now + timedelta(days=365))
+            .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+        )
+        return self.root_key.sign_csr(builder)
+
+    def sign_csr(
+        self,
+        csr: x509.CertificateSigningRequest,
+        expiry_days: int = 90,
+    ) -> x509.Certificate:
+        """Sign a CSR and return a certificate signed by this CA."""
+        now = datetime.now(timezone.utc)
+        builder = (
+            x509.CertificateBuilder()
+            .subject_name(csr.subject)
+            .issuer_name(self.issuer)
+            .public_key(csr.public_key())
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(now)
+            .not_valid_after(now + timedelta(days=expiry_days))
+        )
+
+        for ext in csr.extensions:
+            builder = builder.add_extension(ext.value, ext.critical)
+
+        return self.root_key.sign_csr(builder)
+
+    def create_key_and_cert(
+        self,
+        domain: str,
+        alt_names: List[str] = (),
+        key_type: str = "rsa",
+        expiry_days: int = 90,
+        country: Optional[str] = None,
+        state: Optional[str] = None,
+        locality: Optional[str] = None,
+        organization: Optional[str] = None,
+        user_id: Optional[str] = None,
+    ) -> tuple:
+        """Create a new certificate with a generated key."""
+        # Generate new key based on key_type
+        if key_type == "rsa":
+            new_key = RSAKey.generate()
+        elif key_type == "ecdsa":
+            new_key = ECDSAKey.generate()
+        elif key_type == "ed25519":
+            new_key = Ed25519Key.generate()
+        else:
+            raise ValueError("Unsupported key type. Use 'rsa' or 'ecdsa'")
+
+        # Create CSR using the new key
+        csr = new_key.create_csr(
+            domain=domain,
+            alt_names=alt_names,
+            country=country or self.issuer_fields.get("country"),
+            state=state or self.issuer_fields.get("state"),
+            locality=locality or self.issuer_fields.get("locality"),
+            organization=organization or self.issuer_fields.get("organization"),
+            user_id=user_id or domain,
+        )
+
+        # Sign the CSR to get the certificate
+        cert = self.sign_csr(csr, expiry_days=expiry_days)
+
+        return new_key, cert

{certapi-0.1.1 → certapi-0.2.0}/src/certapi/db.py

@@ -162,7 +162,7 @@ class FilesystemKeyStore(KeyStore):
         return name  # Dummy ID since filesystem does not use numeric IDs
 
     def gen_key(self, name: str = None, size: int = 4096) -> RSAPrivateKey:
-        key = gen_key_rsa(size)
+        key = gen_key_secp256r1()
         self.save_key(key, name)
         return key
 

{certapi-0.1.1 → certapi-0.2.0}/src/certapi.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.1.1
+Version: 0.2.0
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -10,8 +10,6 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.6
 Description-Content-Type: text/markdown
-Requires-Dist: cryptography
-Requires-Dist: requests
 
 # CertApi
 

{certapi-0.1.1 → certapi-0.2.0}/src/certapi.egg-info/SOURCES.txt

@@ -6,6 +6,8 @@ src/certapi/Acme.py
 src/certapi/__init__.py
 src/certapi/certauthority.py
 src/certapi/challenge.py
+src/certapi/cloudflare_challenge_store.py
+src/certapi/cloudflare_client.py
 src/certapi/crypto.py
 src/certapi/crypto_classes.py
 src/certapi/custom_certauthority.py
@@ -15,5 +17,4 @@ src/certapi.egg-info/PKG-INFO
 src/certapi.egg-info/SOURCES.txt
 src/certapi.egg-info/dependency_links.txt
 src/certapi.egg-info/requires.txt
-src/certapi.egg-info/top_level.txt
-tests/test_custom_certauthority.py
+src/certapi.egg-info/top_level.txt

certapi-0.1.1/src/certapi/crypto_classes.py

@@ -1,135 +0,0 @@
-from abc import ABC, abstractmethod
-from cryptography.hazmat.primitives.asymmetric import rsa, ed25519, ec
-from cryptography.hazmat.primitives import serialization, hashes, hmac, padding
-from typing import Union
-
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-
-from .crypto import key_to_der, key_to_pem
-from .util import b64_string
-
-
-class Key(ABC):
-    @abstractmethod
-    def jwk(self):
-        pass
-
-    @abstractmethod
-    def sign(self, message):
-        pass
-
-    @abstractmethod
-    def sign_csr(self, csr):
-        pass
-
-    @staticmethod
-    def from_der(der_bytes):
-        key = serialization.load_der_private_key(der_bytes, password=None)
-        if isinstance(key, rsa.RSAPrivateKey):
-            return RSAKey(key)
-        elif isinstance(key, ec.EllipticCurvePrivateKey):
-            return ECDSAKey(key)
-        elif isinstance(key, Ed25519PrivateKey):
-            return Ed25519Key(key)
-        else:
-            raise ValueError("Unsupported key type")
-
-    @staticmethod
-    def from_pem(der_bytes):
-        key = serialization.load_pem_private_key(der_bytes, password=None)
-        if isinstance(key, rsa.RSAPrivateKey):
-            return RSAKey(key)
-        elif isinstance(key, ec.EllipticCurvePrivateKey):
-            return ECDSAKey(key)
-        elif isinstance(key, Ed25519PrivateKey):
-            return Ed25519Key(key)
-        else:
-            raise ValueError("Unsupported key type")
-
-    def to_der(self) -> bytes:
-        return key_to_der(self.key)
-
-    def to_pem(self) -> bytes:
-        return key_to_pem(self.key)
-
-
-class RSAKey(Key):
-    def __init__(self, key: rsa.RSAPrivateKey, hasher=hashes.SHA256()):
-        self.key = key
-        self.hasher = hasher
-
-    def jwk(self):
-        public = self.key.public_key().public_numbers()
-        return {
-            "e": b64_string((public.e).to_bytes((public.e.bit_length() + 7) // 8, "big")),
-            "kty": "RSA",
-            "n": b64_string((public.n).to_bytes((public.n.bit_length() + 7) // 8, "big")),
-        }
-
-    def sign(self, message):
-        return self.key.sign(message, padding.PKCS1v15(), self.hasher)
-
-    def sign_csr(self, csr):
-        return csr.sign(self.key, self.hasher)
-
-    def algorithm_name(self):
-        return "RS" + str(self.hasher.digest_size * 8)
-
-
-class Ed25519Key(Key):
-
-    def __init__(self, key: ed25519.Ed25519PrivateKey):
-        self.key = key
-        self.keyid = "e"
-        public = self.key.public_key().public_bytes(
-            encoding=serialization.Encoding.Raw, format=serialization.PublicFormat.Raw
-        )
-        self.jwk = {
-            "crv": "Ed25519",
-            "kty": "OKP",
-            "x": b64_string(public),
-        }
-
-    def jwk(self):
-        return self.jwk
-
-    def sign(self, message):
-        return self.key.sign(message)
-
-    def sign_csr(self, csr):
-        return csr.sign(self.key, hashes.SHA256())
-
-
-class ECDSAKey(Key):
-
-    def __init__(self, key: ec.EllipticCurvePrivateKey):
-        self.key = key
-        public_key = self.key.public_key()
-        public_numbers = public_key.public_numbers()
-        self.jwk = {
-            "kty": "EC",
-            "crv": self.key.curve.name,
-            "x": b64_string(public_numbers.x.to_bytes((public_numbers.x.bit_length() + 7) // 8, "big")),
-            "y": b64_string(public_numbers.y.to_bytes((public_numbers.y.bit_length() + 7) // 8, "big")),
-        }
-
-    def jwk(self):
-        return self.jwk
-
-    def algorithm_name(self):
-        return self.key.curve.name
-
-    def sign(self, message):
-        key_size = self.key.curve.key_size
-        if key_size == 256:
-            algorithm = hashes.SHA256()
-        elif key_size == 384:
-            algorithm = hashes.SHA384()
-        elif key_size == 521:
-            algorithm = hashes.SHA512()
-        else:
-            raise ValueError(f"Unsupported curve with key size {key_size}")
-        return self.key.sign(message, ec.ECDSA(algorithm))
-
-    def sign_csr(self, csr):
-        return csr.sign(self.key, hashes.SHA256())

certapi-0.1.1/src/certapi/custom_certauthority.py

@@ -1,94 +0,0 @@
-import json
-import time
-from datetime import datetime, timedelta
-from typing import Union, Callable, List
-
-import requests
-from cryptography import x509
-from cryptography.hazmat._oid import NameOID
-from cryptography.hazmat.primitives import hashes, serialization
-from cryptography.hazmat.primitives.asymmetric.dsa import DSAPrivateKey
-from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
-from cryptography.x509 import Certificate
-from requests import Response
-
-from . import Acme
-from . import db
-from . import crypto
-from . import challenge
-from .crypto import csr_to_pem, create_csr, gen_key_secp256r1
-from cryptography.hazmat.primitives.asymmetric import rsa, ec, padding, ed25519, dsa
-
-
-# pathlib.Path.mkdir("/var/www/html/.acme/well-known")
-
-
-class CustomCertAuthority:
-    def __init__(self, key: Union[RSAPrivateKey, DSAPrivateKey, ec.EllipticCurvePrivateKey]):
-        self.root_key = key
-        self.issuer = x509.Name(
-            [
-                x509.NameAttribute(NameOID.COUNTRY_NAME, "NP"),
-                x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "Kathmandu"),
-                x509.NameAttribute(NameOID.LOCALITY_NAME, "Buddhanagar"),
-                x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Sireto Technology"),
-                x509.NameAttribute(NameOID.COMMON_NAME, "sireto.io"),
-            ]
-        )
-
-    def get_ca_cert(self):
-
-        # Assuming self.root_key is the CA private key
-        cert = (
-            x509.CertificateBuilder()
-            .subject_name(self.issuer)
-            .issuer_name(self.issuer)
-            .public_key(self.root_key.public_key())
-            .serial_number(x509.random_serial_number())
-            .not_valid_before(datetime.utcnow())
-            .not_valid_after(datetime.utcnow() + timedelta(days=365))
-            .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
-            .sign(self.root_key, hashes.SHA256())
-        )
-
-        return cert
-
-    # Assuming CustomCertAuthority is your class
-
-    def create_cert(self, domain: str, alt_names: List[str] = (), key_type: str = "rsa", expiry_days=90):
-        if key_type == "rsa":
-            key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
-        elif key_type == "dsa":
-            key = dsa.generate_private_key(key_size=2048)
-        elif key_type == "ecdsa":
-            key = gen_key_secp256r1()
-        else:
-            raise ValueError("Unsupported key type")
-
-        subject = x509.Name(
-            [
-                x509.NameAttribute(NameOID.COUNTRY_NAME, "NP"),
-                x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "Kathmandu"),
-                x509.NameAttribute(NameOID.LOCALITY_NAME, "Buddhanagar"),
-                x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Sireto Technology"),
-                x509.NameAttribute(NameOID.USER_ID, domain),
-            ]
-        )
-
-        now = datetime.utcnow()
-        cert_builder = (
-            x509.CertificateBuilder()
-            .subject_name(subject)
-            .issuer_name(self.issuer)
-            .public_key(key.public_key())
-            .serial_number(x509.random_serial_number())
-            .not_valid_before(now)
-            .not_valid_after(now + timedelta(days=expiry_days))
-        )
-
-        for alt_name in alt_names:
-            cert_builder.add_extension(x509.SubjectAlternativeName([x509.DNSName(alt_name)]), critical=False)
-
-        cert = cert_builder.sign(self.root_key, hashes.SHA256())
-
-        return (key, cert)

certapi-0.1.1/tests/test_custom_certauthority.py

@@ -1,43 +0,0 @@
-import pytest
-from cryptography.hazmat.primitives import serialization
-from certapi.crypto import gen_key_rsa, key_to_pem
-from certapi.custom_certauthority import CustomCertAuthority
-import os
-from contextlib import contextmanager
-
-
-@pytest.fixture
-def rsa_key():
-    return gen_key_rsa()
-
-
-test_new_file_dir = "./build/tests/intemediate-files"
-os.makedirs(test_new_file_dir, exist_ok=True)
-
-
-@contextmanager
-def tmp_test_file(filename):
-    with open(os.path.join(test_new_file_dir, filename), "wb") as f:
-        yield f
-
-
-def write_tmp_file(filename, content):
-    with tmp_test_file(filename) as f:
-        f.write(content)
-
-
-def test_self_sign_certificat(rsa_key):
-    certauthority = CustomCertAuthority(rsa_key)
-    (key, cert) = certauthority.create_cert("sudip.sireto.io", key_type="rsa")
-    write_tmp_file("test_self_sign_private.key", key_to_pem(key))
-    write_tmp_file("test_self_sign_certificate.crt", cert.public_bytes(serialization.Encoding.PEM))
-
-    with tmp_test_file("test_self_sign_certificate.p12") as f:
-        f.write(cert.public_bytes(serialization.Encoding.PEM))
-        f.write(key_to_pem(key))
-
-
-def test_get_ca(rsa_key):
-    certauthority = CustomCertAuthority(rsa_key)
-    cert = certauthority.get_ca_cert()
-    write_tmp_file("test_self_sign_ca.crt", cert.public_bytes(serialization.Encoding.PEM))