certapi 0.3.0__tar.gz → 0.4.0__tar.gz

{certapi-0.3.0 → certapi-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.3.0
+Version: 0.4.0
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-0.3.0 → certapi-0.4.0}/pyproject.toml

@@ -2,7 +2,6 @@
 line-length = 120
 
 [tool.pytest.ini_options]
-
 minversion = "6.0"
 addopts = "-ra -q"
 testpaths = [
@@ -10,6 +9,7 @@ testpaths = [
 ]
 env_files =[".env", ".test.env"]
 pythonpath = "src"
+timeout = 10
 
 [build-system]
 requires = ["setuptools>=42"]

{certapi-0.3.0 → certapi-0.4.0}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="0.3.0",
+    version="0.4.0",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

certapi-0.4.0/src/certapi/__init__.py

@@ -0,0 +1,9 @@
+from .acme.Acme import Acme, Order, AcmeNetworkError, AcmeHttpError, Challenge
+from .manager.acme_cert_manager import AcmeCertManager
+from .http.types import CertificateResponse, IssuedCert
+
+from .crypto import Certificate,CertificateSigningRequest,CertificateSigningRequestBuilder \
+    ,Key,Ed25519Key,ECDSAKey,Ed25519PrivateKey,EllipticCurvePrivateKey
+from .keystore import FileSystemKeystore,SqliteKeyStore,PostgresKeyStore,KeyStore
+from .challenge_store import ChallengeStore, InMemoryChallengeStore, FileSystemChallengeStore,CloudflareChallengeStore,DigitalOceanChallengeStore
+from .issuers import SelfCertIssuer

certapi-0.4.0/src/certapi/acme/Acme.py

@@ -0,0 +1,123 @@
+import os
+import re
+import threading
+import time
+from typing import Union, List, Tuple
+import json
+from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+from cryptography.x509 import CertificateSigningRequest, Certificate
+from certapi.crypto import crypto
+import requests
+from certapi.crypto import sign, digest_sha256, csr_to_der, jwk, get_algorithm_name, sign_for_jws,Key
+from certapi.util import b64_encode, b64_string
+from .AcmeError import *
+from .http import *
+from .Challenge import Challenge
+from .Order import Order
+
+class Acme:
+
+    URL_STAGING = "https://acme-staging-v02.api.letsencrypt.org/directory"
+    URL_PROD = "https://acme-v02.api.letsencrypt.org/directory"
+
+    def __init__(self, account_key: Union[RSAPrivateKey, EllipticCurvePrivateKey | Key], url=URL_STAGING):
+        self.account_key = account_key.key if isinstance(account_key, Key) else account_key
+        
+        # json web key format for public key
+        self.jwk = jwk(self.account_key)
+        print(self.jwk)
+        self.nonce = []
+        self.acme_url = url if url else os.environ.get("ACME_API_URL", self.URL_STAGING)
+        self.key_id = None
+        self.directory = None
+        self._nonce_lock = threading.Lock()  # Mutex for safe access to nonce
+
+    def setup(self):
+        if self.directory is None:
+            self.directory = get("Fetch Acme Directory", self.acme_url).json()
+
+    def _directory(self, key):
+        if not self.directory:
+            self.directory = get("Fetch Acme Directory", self.acme_url).json()
+        return self.directory[key]
+
+    def _directory_req(self, path_name, payload, depth=0):
+        url = self._directory(path_name)
+        return self._signed_req(url, payload, depth, step="Acme request:" + path_name)
+
+    def get_nonce(self, step: str, counter=1):
+        nonce = None
+        with self._nonce_lock:  # Acquire nonce
+            if self.nonce:
+                nonce = self.nonce.pop(0)
+        return (
+            nonce
+            if nonce
+            else get(
+                step + " > Fetch new Nonce" if step else "Fetch new Nonce from Acme", self._directory("newNonce")
+            ).headers.get("Replay-Nonce")
+        )
+
+    def record_nonce(self, response: requests.Response) -> requests.Response:
+        with self._nonce_lock:
+            self.nonce.append(response.headers.get("Replay-Nonce", None))
+        return response
+
+    def _signed_req(
+        self, url, payload: Union[str, dict, list, bytes, None] = None, depth=0, step="Acme Request", throw=True
+    ) -> requests.Response:
+        payload64 = b64_encode(payload) if payload is not None else b""
+
+        protected = {
+            "url": url,
+            "alg": get_algorithm_name(self.account_key),
+            "nonce": self.get_nonce(step),
+        }
+
+        if self.key_id:
+            protected["kid"] = self.key_id
+        else:
+            protected["jwk"] = self.jwk
+        protectedb64 = b64_encode(protected)
+        payload = {
+            "protected": protectedb64.decode("utf-8"),
+            "payload": payload64.decode("utf-8"),
+            "signature": b64_string(sign_for_jws(self.account_key, b".".join([protectedb64, payload64]))),
+        }
+        try:
+
+            response = post(step, url, json=payload, headers={"Content-Type": "application/jose+json"}, throw=throw)
+        except AcmeError as e:
+            if e.can_retry and depth <= 0:
+                time.sleep(2)
+                return self._signed_req(url, payload, depth + 1, step, throw)
+            else:
+                raise e
+
+        return self.record_nonce(response)
+
+    def register(self):
+        response = self._directory_req("newAccount", {"termsOfServiceAgreed": True})
+        if "location" in response.headers:
+            self.key_id = response.headers["location"]
+        return response
+
+    def create_authorized_order(self, domains: List[str]) -> "Order":
+        payload = {"identifiers": [{"type": "dns", "value": d} for d in domains]}
+        res = self._directory_req("newOrder", payload)
+        res_json = res.json()
+        challenges = []
+        for auth_url in res_json["authorizations"]:
+            auth_res = self._signed_req(auth_url, None, step="Authorize Created Order")
+            challenges.append(Challenge(auth_url, auth_res.json(), self))
+        return Order(res.headers["location"], res_json, challenges, self)
+
+    def authorize_order(self, auth_url):
+        return self._signed_req(auth_url, None, step="Authorize Created Order")
+
+    def verify_challenge(self, challenge_url):
+        return self._signed_req(challenge_url, {}, step="Verify Challenge")
+
+    def finalize_order(self):
+        pass

certapi-0.4.0/src/certapi/acme/AcmeError.py

@@ -0,0 +1,141 @@
+import requests
+
+
+class AcmeError(Exception):
+    def __init__(self, message, detail, step):
+        super().__init__(step, message)
+        self.message: str = message
+        self.step: str = step
+        self.detail: dict = detail
+        self.can_retry = False
+
+    def json_obj(self) -> dict:
+        return {"message": self.message, "step": self.step, "detail": self.detail}
+
+
+class AcmeNetworkError(AcmeError, requests.RequestException):
+    """
+    There was an error connecting/communicating with the AcmeServer.
+    """
+
+    def __init__(self, request: requests.Request, message, detail, step):
+        # Initialize both parent classes
+        requests.RequestException.__init__(self, request=request)
+        AcmeError.__init__(self, message, detail, step)
+        requests.RequestException.__init__(self, request=request)  # Pass message to RequestException
+        self.can_retry = True
+
+
+class AcmeHttpError(AcmeError, requests.HTTPError):
+    """
+    Acme Server replied with error status.
+    """
+
+    def __init__(self, response: requests.Response, step: str):
+        requests.HTTPError.__init__(self, response=response)
+        self.response = response
+        (message, detail) = self.extract_acme_response_error()
+        AcmeError.__init__(self, message, detail, step)
+
+    def extract_acme_response_error(self):
+        message = None
+        error = None
+        try:
+            res_json = self.response.json()
+            if res_json["status"] == "invalid":
+                if res_json["challenges"]:
+                    failed_challenge: dict = [x for x in res_json["challenges"] if x["status"] == "invalid"][0]
+                    error = failed_challenge["error"]
+                    err_detail: str = error.get("detail")
+                    validation_record: dict = failed_challenge.get("validationRecord")
+                    error = {
+                        "url": failed_challenge["url"],
+                    }
+                    if validation_record is None:
+                        # Search for the pattern and extract the content
+                        if err_detail.startswith("DNS problem: NXDOMAIN"):
+                            error["dns"] = {"error": "DNS record doesn't exist"}
+                            error["hostname"] = re.findall(r"looking up [A-Z]+ for ([\w.-]+)", err_detail)[0]
+                            message = error["hostname"] + " doesn't have a valid DNS record"
+                        elif err_detail:
+                            error["dns"] = {"error": err_detail}
+                            message = err_detail
+                        else:
+                            error["dns"] = {"error": error}
+                            message = err_detail
+                    else:
+                        validation_record = validation_record[0]
+                        error["hostname"] = validation_record["hostname"]
+                        error["dns"] = {
+                            "resolved": validation_record["addressesResolved"],
+                            "used": validation_record["addressUsed"],
+                        }
+                        if error["type"] == "urn:ietf:params:acme:error:connection":
+                            if "Timeout during connect" in err_detail:
+                                error["connect"] = {"error": "Timeout"}
+                                message = (
+                                    error["hostname"]
+                                    + "["
+                                    + validation_record["addressUsed"]
+                                    + ":"
+                                    + validation_record["port"]
+                                    + "] Connect Timeout (Maybe firewall reasons)"
+                                )
+                            elif err_detail.endswith("Connection refused"):
+                                error["connect"] = {"error": "connection refused"}
+                                message = (
+                                    error["hostname"]
+                                    + "["
+                                    + validation_record["addressUsed"]
+                                    + ":"
+                                    + validation_record["port"]
+                                    + "] Connection Refused (Is http server running?)"
+                                )
+                            elif err_detail:
+                                message = err_detail
+                            else:
+                                message = error
+                        elif err_detail:
+                            pattern = r'Invalid response from .*?: "(.*)"'
+
+                            match = re.search(pattern, err_detail)
+
+                            if match:
+                                error["response"] = (match.group(1) if match is not None else err_detail,)
+                                error["status_code"] = (error["status"],)
+                                message = (
+                                    error["hostname"]
+                                    + " Status="
+                                    + error["status"]
+                                    + ": Invalid response in challenge url"
+                                )
+                            else:
+                                message = err_detail
+                        else:
+                            message = error
+
+            if message is None:
+                if res_json.get("detail"):
+                    message = res_json["detail"]
+                else:
+                    message = "Received status=" + str(self.response.status_code) + " from AMCE server"
+            if error is None:
+                error = res_json
+
+            return (message, error)
+
+        except requests.RequestException as e:
+            message = "Received status=" + str(self.response.status_code) + " from AMCE server"
+            error = {"url": self.response.request.url, "response": self.response.text}
+            return (message, error)
+
+
+class AcmeInvaliOrderError(AcmeHttpError):
+    def __init__(self, response: requests.Response, step: str):
+        super().__init__(response, step)
+
+
+class AcmeInvaliNonceError(AcmeHttpError):
+    def __init__(self, response: requests.Response, step: str):
+        super().__init__(response, step)
+        self.can_retry = True

certapi-0.4.0/src/certapi/acme/Challenge.py

@@ -0,0 +1,90 @@
+
+import json
+from typing import Literal, Union
+
+import requests
+
+from certapi.util import b64_encode, b64_string
+from certapi.crypto import digest_sha256
+from .AcmeError import *
+from .http import post,get
+
+class Challenge:
+    def __init__(self, auth_url, data, acme):
+        self._auth_url = auth_url
+        self._acme = acme
+        self._data = data
+        challenge = self.get_challenge()
+        self.token:str = challenge["token"]
+        self.verified = challenge["status"] == "valid"
+        self.domain = data["identifier"]["value"]  # Add domain attribute
+
+        jwk_json = json.dumps(self._acme.jwk, sort_keys=True, separators=(",", ":"))
+        thumbprint = b64_encode(digest_sha256(jwk_json.encode("utf8")))
+        self.authorization_key = "{0}.{1}".format(self.token, thumbprint.decode("utf-8"))
+
+        self.url = "http://{0}/.well-known/acme-challenge/{1}".format(data["identifier"]["value"], self.token)
+
+    def as_key_value(self,type:Literal["http-01", "dns-01", "tls-alpn-01"]=None):
+        challenge=self.get_challenge(type)
+
+        if challenge["type"] == "dns-01":
+            key = f"_acme-challenge.{self.domain}"
+            value = b64_string(digest_sha256(self.authorization_key.encode("utf8")))
+        else:
+            key =  self.token
+            value =  self.authorization_key
+        
+        return (key,value)
+
+
+    def verify(self, type:Literal["http-01", "dns-01", "tls-alpn-01"]=None) -> bool:
+        if not self.verified:
+            response = self._acme._signed_req(
+                self.get_challenge(type)["url"], {}, step="Verify Challenge", throw=False
+            )
+            if response.status_code == 200 and response.json()["status"] == "valid":
+                self.verified = True
+                return True
+            return False
+        return True
+
+    def self_verify(self) -> Union[bool, requests.Response]:
+        identifier = self._data["identifier"]
+        if identifier["type"] == "dns":
+            res = get("Self Domain verification", self.url)
+            if res.status_code == 200 and res.content == self.token.encode():
+                return True
+            else:
+                return res
+        return False
+
+    def query_progress(self) -> bool:
+        if self.verified:
+            return True
+        else:
+            res = self._acme._signed_req(self._auth_url, step="Acme Challenge Verification")
+            res_json = res.json()
+            if res_json["status"] == "valid":
+                self.verified = True
+                return True
+            elif res_json["status"] == "invalid":
+                raise AcmeInvaliOrderError(res, "Acme Challenge Verification")
+            else:
+                return False
+
+    def get_challenge(self, type:Literal["http-01", "dns-01", "tls-alpn-01"]=None):
+        challenges = self._data["challenges"]
+        def_key= type if type is not None else "http-01"
+        for method in challenges:
+            if method["type"] == def_key:
+                return method
+        if type is None:
+            return challenges[0]
+
+        ch_types = [x["type"] for x in self._data["challenges"]]
+        raise AcmeError(
+            f"'{type}' not found in challenges. available:{str(ch_types)}",
+            {"response": self._data["challenges"]},
+            "Acme Challenge Verification",
+        )

certapi-0.4.0/src/certapi/acme/Order.py

@@ -0,0 +1,49 @@
+from typing import List, Tuple
+from certapi.crypto import crypto,csr_to_der
+from certapi.util import b64_string
+from cryptography.x509 import CertificateSigningRequest,Certificate
+from .Challenge import *
+from .http import get
+
+class Order:
+    def __init__(self, url, data, challenges, acme):
+        self.url = url
+        self._data = data
+        self.all_challenges = challenges
+        self._acme = acme
+        self.status = "pending"
+
+    def remaining_challenges(self) -> List["Challenge"]:
+        return [x for x in self.all_challenges if not x.verified]
+
+    def refresh(self):
+        response = get("Fetch order Status", self.url)
+        self._data = response.json()
+        self.status = self._data["status"]
+        return response
+
+    def get_certificate(self) -> str:
+        if self.status == "processing":
+            raise ValueError(
+                "Order is still in 'processing' state! Wait until the order is finalized, and  call `Order.refresh()`  to update the state"
+            )
+        elif self.status != "valid":
+            raise ValueError("Order not in 'valid' state! Complete challenge and call finalize()")
+
+        certificate_res = self._acme._signed_req(
+            self._data["certificate"], step="Get Certificate from Successful Order"
+        )
+        return certificate_res.text
+
+    def finalize(self, csr: CertificateSigningRequest):
+        """
+        Finalizes the order with the provided CSR.
+
+        :param csr: The Certificate Signing Request (CSR) to be used for finalizing the order.
+        """
+        finalized = self._acme._signed_req(
+            self._data["finalize"], {"csr": b64_string(csr_to_der(csr))}, step="Order Finalize"
+        )
+        finalized_json = finalized.json()
+        self._data = finalized_json
+        self.status = finalized_json["status"]

certapi-0.4.0/src/certapi/acme/__init__.py

@@ -0,0 +1,4 @@
+from .Challenge import Challenge
+from .AcmeError import *
+from .Acme import Acme
+from .Order import Order

certapi-0.4.0/src/certapi/acme/http.py

@@ -0,0 +1,56 @@
+
+import requests
+from .AcmeError import *
+
+def request(method, step: str, url: str, json=None, headers=None, throw=True) -> requests.Response:
+    res = None
+    try:
+        res = requests.request(method, url, json=json, headers=headers, timeout=15)
+        print("Request [" + str(res.status_code) + "] : " + method + " " + url + " step=" + step)
+    except requests.HTTPError as e:
+        status = res.status_code if res else None
+        status = status if status else (e.response.status_code if e.response else None)
+        if status:
+            print("Request [" + str(status) + "] : " + method + " " + url + " step=" + step)
+        else:
+            print("Request : " + method + " " + url + " step=" + step)
+
+        raise e
+    except requests.RequestException as e:
+        print("Request : " + str(method) + " " + str(url) + " step=" + str(step))
+        raise AcmeNetworkError(
+            e.request,
+            f"Error communicating with ACME server",
+            {
+                "errorType": e.__class__.__name__,
+                "message": str(e),
+                "method": method,
+                "url": e.request.url if e.request else None,
+            },
+            step,
+        )
+    if 199 <= res.status_code > 299:
+        [print(x, y) for (x, y) in res.headers.items()]
+        print("Response:", res.text)
+        json_data = None
+        try:
+            json_data = res.json()
+        except requests.RequestException as e:
+            pass
+        if json_data and json_data.get("type"):
+            errorType = json_data["type"]
+            if errorType == "urn:ietf:params:acme:error:badNonce":
+                raise AcmeInvaliNonceError(res, step=step)
+
+        if throw:
+            raise AcmeHttpError(res, step=step)
+    return res
+
+
+def post(step: str, url: str, json=None, headers=None, throw=True) -> requests.Response:
+    return request("POST", step, url, json=json, headers=headers, throw=throw)
+
+
+def get(step: str, url) -> requests.Response:
+    return request("GET", step, url)
+

certapi-0.4.0/src/certapi/challenge_store/ChallengeStore.py

@@ -0,0 +1,34 @@
+from abc import ABC, abstractmethod
+import os
+from collections.abc import MutableMapping
+
+
+class ChallengeStore(ABC):
+    """
+    Abstract base class for a challenge store.
+    """
+    @abstractmethod
+    def supports_domain(self, domain: str) -> bool:
+        pass
+
+    @abstractmethod
+    def save_challenge(self, key: str, value: str, domain: str = None):
+        pass
+
+    @abstractmethod
+    def get_challenge(self, key: str, domain: str = None) -> str:
+        pass
+
+    @abstractmethod
+    def delete_challenge(self, key: str, domain: str = None):
+        pass
+    def store_details():
+        return {
+            "name": "Abstract Challenge Store",
+        }
+
+    def __iter__(self):
+        raise NotImplementedError("Must implement `__iter__` method.")
+
+    def __len__(self):
+        raise NotImplementedError("Must implement `__len__` method.")

certapi-0.4.0/src/certapi/challenge_store/FileSystemChallengeStore.py

@@ -0,0 +1,38 @@
+
+from .ChallengeStore import ChallengeStore
+import os
+
+class FileSystemChallengeStore(ChallengeStore):
+    """
+    Filesystem implementation of the ChallengeStore.
+    """
+
+    def __init__(self, directory: str):
+        self.directory = directory
+        os.makedirs(self.directory, exist_ok=True)
+
+    def supports_domain(self, domain: str) -> bool:
+        return True
+
+    def save_challenge(self, key: str, value: str, domain: str = None):
+        file_path = os.path.join(self.directory, key)
+        with open(file_path, "w") as file:
+            file.write(value)
+
+    def get_challenge(self, key: str, domain: str = None) -> str:
+        file_path = os.path.join(self.directory, key)
+        if not os.path.exists(file_path):
+            return None
+        with open(file_path, "r") as file:
+            return file.read()
+
+    def delete_challenge(self, key: str, domain: str = None):
+        file_path = os.path.join(self.directory, key)
+        if os.path.exists(file_path):
+            os.remove(file_path)
+
+    def __iter__(self):
+        return (f for f in os.listdir(self.directory) if os.path.isfile(os.path.join(self.directory, f)))
+
+    def __len__(self):
+        return len([f for f in os.listdir(self.directory) if os.path.isfile(os.path.join(self.directory, f))])

certapi-0.4.0/src/certapi/challenge_store/FilesystemChallengeStore.py

@@ -0,0 +1,38 @@
+
+from .ChallengeStore import ChallengeStore
+import os
+
+class FileSystemChallengeStore(ChallengeStore):
+    """
+    Filesystem implementation of the ChallengeStore.
+    """
+
+    def __init__(self, directory: str):
+        self.directory = directory
+        os.makedirs(self.directory, exist_ok=True)
+
+    def supports_domain(self, domain: str) -> bool:
+        return True
+
+    def save_challenge(self, key: str, value: str, domain: str = None):
+        file_path = os.path.join(self.directory, key)
+        with open(file_path, "w") as file:
+            file.write(value)
+
+    def get_challenge(self, key: str, domain: str = None) -> str:
+        file_path = os.path.join(self.directory, key)
+        if not os.path.exists(file_path):
+            return None
+        with open(file_path, "r") as file:
+            return file.read()
+
+    def delete_challenge(self, key: str, domain: str = None):
+        file_path = os.path.join(self.directory, key)
+        if os.path.exists(file_path):
+            os.remove(file_path)
+
+    def __iter__(self):
+        return (f for f in os.listdir(self.directory) if os.path.isfile(os.path.join(self.directory, f)))
+
+    def __len__(self):
+        return len([f for f in os.listdir(self.directory) if os.path.isfile(os.path.join(self.directory, f))])

certapi-0.4.0/src/certapi/challenge_store/InmemoryChallengeStore.py

@@ -0,0 +1,26 @@
+from .ChallengeStore import ChallengeStore
+
+
+class InMemoryChallengeStore(ChallengeStore):
+    """
+    In-memory implementation of the ChallengeStore.
+    """
+
+    def __init__(self):
+        self.challenges = {}
+
+    def save_challenge(self, key: str, value: str, domain: str = None):
+        self.challenges[key] = value
+
+    def get_challenge(self, key: str, domain: str = None) -> str:
+        return self.challenges.get(key, "")
+
+    def delete_challenge(self, key: str, domain: str = None):
+        if key in self.challenges:
+            del self.challenges[key]
+
+    def __iter__(self):
+        return iter(self.challenges)
+
+    def __len__(self):
+        return len(self.challenges)

certapi-0.4.0/src/certapi/challenge_store/__init__.py

@@ -0,0 +1,25 @@
+from .ChallengeStore import ChallengeStore
+from .InmemoryChallengeStore import InMemoryChallengeStore
+import os
+from .FileSystemChallengeStore import FileSystemChallengeStore
+from .dns import CloudflareChallengeStore,DigitalOceanChallengeStore
+
+def get_challenge_store():
+    """
+    Factory function to determine the type of store based on environment variables.
+
+    Environment Variables:
+    - `CHALLENGE_STORE_TYPE`: Can be "memory" or "filesystem".
+    - `CHALLENGE_STORE_DIR`: Directory for filesystem-based store. Defaults to "./challenges".
+    """
+    store_type = os.getenv("CHALLENGE_STORE_TYPE", "filesystem").lower()
+    directory = os.getenv("CHALLENGE_STORE_DIR", "./challenges")
+
+    if store_type == "memory":
+        return InMemoryChallengeStore()
+    elif store_type == "filesystem":
+        return FileSystemChallengeStore(directory)
+    else:
+        raise ValueError(f"Unknown CHALLENGE_STORE_TYPE: {store_type}")
+
+