certapi 0.4.2__tar.gz → 0.4.3__tar.gz

{certapi-0.4.2 → certapi-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.4.2
+Version: 0.4.3
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -30,12 +30,12 @@ pip install certapi
 
 ```python
 import json
-from certapi import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+from certapi import FileSystemChallengeSolver, FilesystemKeyStore, CertAuthority
 
 key_store = FilesystemKeyStore("data")
-challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/
+challenge_solver = FileSystemChallengeSolver("./acme-challenges")  # this should be where your web server hosts the .well-known/
 
-certAuthority = CertAuthority(challenge_store, key_store)
+certAuthority = CertAuthority(challenge_solver, key_store)
 certAuthority.setup()
 
 (response,_) = certAuthority.obtainCert("example.com")

{certapi-0.4.2 → certapi-0.4.3}/README.md

@@ -17,12 +17,12 @@ pip install certapi
 
 ```python
 import json
-from certapi import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+from certapi import FileSystemChallengeSolver, FilesystemKeyStore, CertAuthority
 
 key_store = FilesystemKeyStore("data")
-challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/
+challenge_solver = FileSystemChallengeSolver("./acme-challenges")  # this should be where your web server hosts the .well-known/
 
-certAuthority = CertAuthority(challenge_store, key_store)
+certAuthority = CertAuthority(challenge_solver, key_store)
 certAuthority.setup()
 
 (response,_) = certAuthority.obtainCert("example.com")

{certapi-0.4.2 → certapi-0.4.3}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="0.4.2",
+    version="0.4.3",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-0.4.2 → certapi-0.4.3}/src/certapi/__init__.py

@@ -13,11 +13,11 @@ from .crypto import (
     EllipticCurvePrivateKey,
 )
 from .keystore import FileSystemKeystore, SqliteKeyStore, PostgresKeyStore, KeyStore
-from .challenge_store import (
-    ChallengeStore,
-    InMemoryChallengeStore,
-    FileSystemChallengeStore,
-    CloudflareChallengeStore,
-    DigitalOceanChallengeStore,
+from .challenge_solver import (
+    ChallengeSolver,
+    InMemoryChallengeSolver,
+    FilesystemChallengeSolver,
+    CloudflareChallengeSolver,
+    DigitalOceanChallengeSolver,
 )
 from .issuers import SelfCertIssuer

{certapi-0.4.2 → certapi-0.4.3}/src/certapi/acme/Acme.py

@@ -9,7 +9,8 @@ from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.x509 import CertificateSigningRequest, Certificate
 from certapi.crypto import crypto
 import requests
-from certapi.crypto import sign, digest_sha256, csr_to_der, jwk, get_algorithm_name, sign_for_jws, Key
+from certapi.crypto import Key
+from certapi.crypto.crypto_classes import ECDSAKey, RSAKey
 from certapi.util import b64_encode, b64_string
 from .AcmeError import *
 from .http import *
@@ -22,11 +23,12 @@ class Acme:
     URL_STAGING = "https://acme-staging-v02.api.letsencrypt.org/directory"
     URL_PROD = "https://acme-v02.api.letsencrypt.org/directory"
 
-    def __init__(self, account_key: Union[RSAPrivateKey, EllipticCurvePrivateKey | Key], url=URL_STAGING):
-        self.account_key = account_key.key if isinstance(account_key, Key) else account_key
+    def __init__(self, account_key: Key, url=URL_STAGING):
+        self.account_key: Key = account_key
 
         # json web key format for public key
-        self.jwk = jwk(self.account_key)
+        self.jwk = account_key.jwk()
+        self.alg_name = account_key.algorithm_name()
         print(self.jwk)
         self.nonce = []
         self.acme_url = url if url else os.environ.get("ACME_API_URL", self.URL_STAGING)
@@ -72,7 +74,7 @@ class Acme:
 
         protected = {
             "url": url,
-            "alg": get_algorithm_name(self.account_key),
+            "alg": self.alg_name,
             "nonce": self.get_nonce(step),
         }
 
@@ -80,11 +82,12 @@ class Acme:
             protected["kid"] = self.key_id
         else:
             protected["jwk"] = self.jwk
+
         protectedb64 = b64_encode(protected)
         payload = {
             "protected": protectedb64.decode("utf-8"),
             "payload": payload64.decode("utf-8"),
-            "signature": b64_string(sign_for_jws(self.account_key, b".".join([protectedb64, payload64]))),
+            "signature": b64_string(self.account_key.jws_sign(b".".join([protectedb64, payload64]))),
         }
         try:
 

{certapi-0.4.2 → certapi-0.4.3}/src/certapi/acme/AcmeError.py

@@ -1,3 +1,4 @@
+import re
 import requests
 
 
@@ -47,6 +48,7 @@ class AcmeHttpError(AcmeError, requests.HTTPError):
                     failed_challenge: dict = [x for x in res_json["challenges"] if x["status"] == "invalid"][0]
                     error = failed_challenge["error"]
                     err_detail: str = error.get("detail")
+                    err_type: str = error.get("type")
                     validation_record: dict = failed_challenge.get("validationRecord")
                     error = {
                         "url": failed_challenge["url"],
@@ -70,7 +72,7 @@ class AcmeHttpError(AcmeError, requests.HTTPError):
                             "resolved": validation_record["addressesResolved"],
                             "used": validation_record["addressUsed"],
                         }
-                        if error["type"] == "urn:ietf:params:acme:error:connection":
+                        if err_type == "urn:ietf:params:acme:error:connection":
                             if "Timeout during connect" in err_detail:
                                 error["connect"] = {"error": "Timeout"}
                                 message = (

{certapi-0.4.2 → certapi-0.4.3}/src/certapi/acme/Challenge.py

@@ -39,7 +39,9 @@ class Challenge:
 
     def verify(self, type: Literal["http-01", "dns-01", "tls-alpn-01"] = None) -> bool:
         if not self.verified:
-            response = self._acme._signed_req(self.get_challenge(type)["url"], {}, step="Verify Challenge", throw=False)
+            response = self._acme._signed_req(
+                self.get_challenge(type)["url"], {}, step=f"Verify Challenge [{self.domain}]", throw=False
+            )
             if response.status_code == 200 and response.json()["status"] == "valid":
                 self.verified = True
                 return True
@@ -49,7 +51,7 @@ class Challenge:
     def self_verify(self) -> Union[bool, requests.Response]:
         identifier = self._data["identifier"]
         if identifier["type"] == "dns":
-            res = get("Self Domain verification", self.url)
+            res = get(f"Self Domain verification [{self.domain}]", self.url)
             if res.status_code == 200 and res.content == self.token.encode():
                 return True
             else:
@@ -60,13 +62,13 @@ class Challenge:
         if self.verified:
             return True
         else:
-            res = self._acme._signed_req(self._auth_url, step="Acme Challenge Verification")
+            res = self._acme._signed_req(self._auth_url, step=f"Query Challenge Status [{self.domain}]")
             res_json = res.json()
             if res_json["status"] == "valid":
                 self.verified = True
                 return True
             elif res_json["status"] == "invalid":
-                raise AcmeInvaliOrderError(res, "Acme Challenge Verification")
+                raise AcmeInvaliOrderError(res, "Query Challenge Status")
             else:
                 return False
 
@@ -81,7 +83,7 @@ class Challenge:
 
         ch_types = [x["type"] for x in self._data["challenges"]]
         raise AcmeError(
-            f"'{type}' not found in challenges. available:{str(ch_types)}",
+            f"'{type}' not found in challenges for {self.domain}, available: {','.join(ch_types)}",
             {"response": self._data["challenges"]},
-            "Acme Challenge Verification",
+            "Query Challenge Status",
         )

certapi-0.4.2/src/certapi/challenge_store/ChallengeStore.py → certapi-0.4.3/src/certapi/challenge_solver/ChallengeSolver.py

@@ -1,9 +1,10 @@
 from abc import ABC, abstractmethod
 import os
 from collections.abc import MutableMapping
+from typing import Literal
 
 
-class ChallengeStore(ABC):
+class ChallengeSolver(ABC):
     """
     Abstract base class for a challenge store.
     """
@@ -24,10 +25,9 @@ class ChallengeStore(ABC):
     def delete_challenge(self, key: str, domain: str = None):
         pass
 
-    def store_details():
-        return {
-            "name": "Abstract Challenge Store",
-        }
+    @abstractmethod
+    def supported_challenge_type(self) -> Literal["http-01", "dns-01", "tls-alpn-01"]:
+        pass
 
     def __iter__(self):
         raise NotImplementedError("Must implement `__iter__` method.")

certapi-0.4.2/src/certapi/challenge_store/FileSystemChallengeStore.py → certapi-0.4.3/src/certapi/challenge_solver/FileSystemChallengeSolver.py

@@ -1,10 +1,12 @@
-from .ChallengeStore import ChallengeStore
+from typing import Literal
+from .ChallengeSolver import ChallengeSolver
 import os
 
 
-class FileSystemChallengeStore(ChallengeStore):
+class FilesystemChallengeSolver(ChallengeSolver):
     """
     Filesystem implementation of the ChallengeStore.
+    This should never be used, but extended for your webserver e.g. nginx, apache etc.
     """
 
     def __init__(self, directory: str):
@@ -12,7 +14,7 @@ class FileSystemChallengeStore(ChallengeStore):
         os.makedirs(self.directory, exist_ok=True)
 
     def supports_domain(self, domain: str) -> bool:
-        return True
+        return "*" not in domain
 
     def save_challenge(self, key: str, value: str, domain: str = None):
         file_path = os.path.join(self.directory, key)
@@ -31,6 +33,9 @@ class FileSystemChallengeStore(ChallengeStore):
         if os.path.exists(file_path):
             os.remove(file_path)
 
+    def supported_challenge_type(self) -> Literal["http-01"]:
+        return "http-01"
+
     def __iter__(self):
         return (f for f in os.listdir(self.directory) if os.path.isfile(os.path.join(self.directory, f)))
 

certapi-0.4.2/src/certapi/challenge_store/InmemoryChallengeStore.py → certapi-0.4.3/src/certapi/challenge_solver/InmemoryChallengeSolver.py

@@ -1,7 +1,8 @@
-from .ChallengeStore import ChallengeStore
+from typing import Literal
+from .ChallengeSolver import ChallengeSolver
 
 
-class InMemoryChallengeStore(ChallengeStore):
+class InMemoryChallengeSolver(ChallengeSolver):
     """
     In-memory implementation of the ChallengeStore.
     """
@@ -9,6 +10,9 @@ class InMemoryChallengeStore(ChallengeStore):
     def __init__(self):
         self.challenges = {}
 
+    def supported_challenge_type(self) -> Literal["http-01"]:
+        return "http-01"
+
     def save_challenge(self, key: str, value: str, domain: str = None):
         self.challenges[key] = value
 

certapi-0.4.3/src/certapi/challenge_solver/__init__.py

@@ -0,0 +1,24 @@
+from .ChallengeSolver import ChallengeSolver
+from .InmemoryChallengeSolver import InMemoryChallengeSolver
+import os
+from .FileSystemChallengeSolver import FilesystemChallengeSolver
+from .dns import CloudflareChallengeSolver, DigitalOceanChallengeSolver
+
+
+def get_challenge_solver():
+    """
+    Factory function to determine the type of store based on environment variables.
+
+    Environment Variables:
+    - `challenge_solver_TYPE`: Can be "memory" or "filesystem".
+    - `challenge_solver_DIR`: Directory for filesystem-based store. Defaults to "./challenges".
+    """
+    store_type = os.getenv("challenge_solver_TYPE", "filesystem").lower()
+    directory = os.getenv("challenge_solver_DIR", "./challenges")
+
+    if store_type == "memory":
+        return InMemoryChallengeSolver()
+    elif store_type == "filesystem":
+        return FilesystemChallengeSolver(directory)
+    else:
+        raise ValueError(f"Unknown challenge_solver_TYPE: {store_type}")

certapi-0.4.3/src/certapi/challenge_solver/dns/__init__.py

@@ -0,0 +1,2 @@
+from .digitalocean.digitalocean_challenge_solver import DigitalOceanChallengeSolver
+from .cloudflare.cloudflare_challenge_solver import CloudflareChallengeSolver

certapi-0.4.2/src/certapi/challenge_store/dns/cloudflare/cloudflare_challenge_store.py → certapi-0.4.3/src/certapi/challenge_solver/dns/cloudflare/cloudflare_challenge_solver.py

@@ -1,15 +1,19 @@
 import os
 import time
 from collections.abc import MutableMapping
-from ...ChallengeStore import ChallengeStore
+from typing import Literal
+from ...ChallengeSolver import ChallengeSolver
 from .cloudflare_client import Cloudflare
 
 
-class CloudflareChallengeStore(ChallengeStore):
+class CloudflareChallengeSolver(ChallengeSolver):
     def __init__(self, api_key: str = None):
         self.cloudflare = Cloudflare(api_key)
         self.challenges_map = {}
 
+    def supported_challenge_type(self) -> Literal["dns-01"]:
+        return "dns-01"
+
     def supports_domain(self, domain: str) -> bool:
         """
         Checks if the Cloudflare account has access to the given domain (or its base domain)
@@ -28,8 +32,7 @@ class CloudflareChallengeStore(ChallengeStore):
 
         record_id = self.cloudflare.create_record(name=key, data=value, domain=base_domain)
         self.challenges_map[key] = record_id
-        print(f"CloudflareChallengeStore: Saved challenge for {key} with record ID {record_id}")
-        time.sleep(10)  # wait for dns propagation. it may not be immediate
+        print(f"CloudflareChallengeStore[{domain}]: Added Record {key}")
 
     def get_challenge(self, key: str, domain: str) -> str:
         base_domain = self.cloudflare.determine_registered_domain(domain)

{certapi-0.4.2/src/certapi/challenge_store → certapi-0.4.3/src/certapi/challenge_solver}/dns/cloudflare/cloudflare_client.py

@@ -85,6 +85,7 @@ class Cloudflare(object):
 
         result = json.loads(response.read().decode("utf8"))
         if not result.get("success"):
+            print(f"List TXT record [{response.getcode()}]", result)
             raise Exception(result.get("errors", "Unknown error listing TXT records"))
 
         return result["result"]
@@ -111,11 +112,11 @@ class Cloudflare(object):
             "proxied": False,
         }
         response = urlopen(Request(api_url, data=json.dumps(request_data).encode("utf8"), headers=request_headers))
-
+        result = response.read().decode("utf8")
         if response.getcode() != 200:
+            print(f"Create TXT record [{response.getcode()}]", result)
             raise Exception(json.loads(response.read().decode("utf8")))
-        result = response.read().decode("utf8")
-        print("Cloudflare create record", name, result)
+
         return json.loads(result)["result"]["id"]
 
     def delete_record(self, record, domain):
@@ -133,6 +134,6 @@ class Cloudflare(object):
         request.get_method = lambda: "DELETE"
         response = urlopen(request)
         result = response.read().decode("utf8")
-        print(f"Delete dns record [{response.getcode()}]", result)
         if response.getcode() != 200:
+            print(f"Delete dns record [{response.getcode()}]", result)
             raise Exception(json.loads(response.read().decode("utf8")))

certapi-0.4.2/src/certapi/challenge_store/dns/digitalocean/digitalocean_challenge_store.py → certapi-0.4.3/src/certapi/challenge_solver/dns/digitalocean/digitalocean_challenge_solver.py

@@ -1,14 +1,18 @@
 import os
 from collections.abc import MutableMapping
-from ...ChallengeStore import ChallengeStore
+from typing import Literal
+from ...ChallengeSolver import ChallengeSolver
 from .digitalocean_client import DigitalOcean
 
 
-class DigitalOceanChallengeStore(ChallengeStore):
+class DigitalOceanChallengeSolver(ChallengeSolver):
     def __init__(self, api_key: str = None):
         self.digitalocean = DigitalOcean(api_key)
         self.challenges_map = {}  # Stores key: record_id (needed for deletion)
 
+    def supported_challenge_type(self) -> Literal["dns-01"]:
+        return "dns-01"
+
     def supports_domain(self, domain: str) -> bool:
         """
         Checks if the DigitalOcean account has access to the given domain (or its base domain)

{certapi-0.4.2 → certapi-0.4.3}/src/certapi/crypto/crypto_classes.py

@@ -1,10 +1,11 @@
 from abc import ABC, abstractmethod
-from cryptography.hazmat.primitives.asymmetric import rsa, ed25519, ec
-from cryptography.hazmat.primitives import serialization, hashes, padding
+from cryptography.hazmat.primitives.asymmetric import rsa, ed25519, ec, padding
+from cryptography.hazmat.primitives import serialization, hashes
 from typing import Literal, Optional, List, Union
 from cryptography import x509
 from cryptography.x509.oid import NameOID
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.asymmetric import utils
 
 from .crypto import key_to_der, key_to_pem
 from certapi.util import b64_string
@@ -18,9 +19,16 @@ class Key(ABC):
         pass
 
     @abstractmethod
-    def sign(self, message: bytes):
+    def algorithm_name(self) -> str:
         pass
 
+    @abstractmethod
+    def sign(self, message: bytes) -> bytes:
+        pass
+
+    def jws_sign(self, message: bytes) -> bytes:
+        return self.sign(message)
+
     @abstractmethod
     def sign_csr(self, csr: x509.CertificateSigningRequestBuilder | x509.CertificateBuilder):
         pass
@@ -183,7 +191,7 @@ class Ed25519Key(Key):
         public = self.key.public_key().public_bytes(
             encoding=serialization.Encoding.Raw, format=serialization.PublicFormat.Raw
         )
-        self.jwk = {
+        self._jwk = {
             "crv": "Ed25519",
             "kty": "OKP",
             "x": b64_string(public),
@@ -195,11 +203,14 @@ class Ed25519Key(Key):
         return Ed25519Key(key)
 
     def jwk(self):
-        return self.jwk
+        return self._jwk
 
     def sign(self, message):
         return self.key.sign(message)
 
+    def algorithm_name(self):
+        return "EdDSA"
+
     def sign_csr(self, csr):
         return csr.sign(self.key, None)
 
@@ -209,7 +220,7 @@ class ECDSAKey(Key):
         self.key = key
         public_key = self.key.public_key()
         public_numbers = public_key.public_numbers()
-        self.jwk = {
+        self._jwk = {
             "kty": "EC",
             "crv": self.key.curve.name,
             "x": b64_string(public_numbers.x.to_bytes((public_numbers.x.bit_length() + 7) // 8, "big")),
@@ -222,10 +233,18 @@ class ECDSAKey(Key):
         return ECDSAKey(key)
 
     def jwk(self):
-        return self.jwk
+        return self._jwk
 
     def algorithm_name(self):
-        return self.key.curve.name
+        curve_name = self.key.curve.name
+        if curve_name == "secp256r1":
+            return "ES256"
+        elif curve_name == "secp384r1":
+            return "ES384"
+        elif curve_name == "secp521r1":
+            return "ES512"
+        else:
+            raise ValueError(f"Unsupported EC curve: {curve_name}")
 
     def sign(self, message):
         key_size = self.key.curve.key_size
@@ -239,6 +258,15 @@ class ECDSAKey(Key):
             raise ValueError(f"Unsupported curve with key size {key_size}")
         return self.key.sign(message, ec.ECDSA(algorithm))
 
+    def jws_sign(self, message: bytes) -> bytes:
+        print("Jws sign")
+        der_sig = self.sign(message)
+        r, s = utils.decode_dss_signature(der_sig)
+        num_bytes = (self.key.curve.key_size + 7) // 8
+        r_bytes = r.to_bytes(num_bytes, "big")
+        s_bytes = s.to_bytes(num_bytes, "big")
+        return r_bytes + s_bytes
+
     def sign_csr(self, csr):
         key_size = self.key.curve.key_size
         if key_size == 256:

{certapi-0.4.2 → certapi-0.4.3}/src/certapi/issuers/AcmeCertIssuer.py

@@ -1,4 +1,4 @@
-from certapi.crypto import ECDSAKey, Ed25519Key, RSAKey, Key
+from certapi.crypto import Key
 from .abstract_certissuer import CertIssuer
 from cryptography import x509
 from cryptography.x509 import Certificate
@@ -6,48 +6,55 @@ from typing import List, Literal, Union, Callable, Tuple, Dict, Optional
 import time
 from requests import Response
 from certapi.acme import Acme, Challenge, Order
-from certapi.challenge_store import ChallengeStore
+from certapi.challenge_solver import ChallengeSolver
 
 
 class AcmeCertIssuer(CertIssuer):
     def __init__(
         self,
         account_key: Key,
-        challenge_store: ChallengeStore,
+        challenge_solver: ChallengeSolver,
         acme_url=None,
         self_verify_challenge=False,  # This never needs to be set to True
     ):
         self.acme = Acme(account_key, url=acme_url)
-        self.challenge_store = challenge_store
+        self.challenge_solver = challenge_solver
         self.self_verify_challenge = self_verify_challenge
 
     def setup(self):
         self.acme.setup()
         res: Response = self.acme.register()
         if res.status_code == 201:
-            print("Acme Account was already registered")
+            print("New Acme Account registered")
         elif res.status_code != 200:
             raise Exception("Acme registration didn't return 200 or 201 ", res.json())
 
     def sign_csr(
-        self, csr: x509.CertificateSigningRequest, challenge_store: ChallengeStore = None, expiry_days: int = 90
+        self, csr: x509.CertificateSigningRequest, challenge_solver: ChallengeSolver = None, expiry_days: int = 90
     ) -> str:
-        challenge_store = challenge_store if challenge_store is not None else self.challenge_store
+        challenge_solver = challenge_solver if challenge_solver is not None else self.challenge_solver
         hosts = self.get_csr_hostnames(csr)
         order: Order = self.acme.create_authorized_order(hosts)
         challenges = order.remaining_challenges()
 
         for c in challenges:
-            key, value = c.as_key_value()
-            challenge_store.save_challenge(key, value, c.domain)
+            key, value = c.as_key_value(type=challenge_solver.supported_challenge_type())
+            challenge_solver.save_challenge(key, value, c.domain)
         for c in challenges:
             if self.self_verify_challenge:
                 c.self_verify()
+
         end = time.time() + max(len(challenges) * 10, 300)
         remaining_now: List[Challenge] = [x for x in challenges]
         next_remaining = []
         counter = 1
 
+        if challenge_solver.supported_challenge_type() == "dns-01":
+            print("Waiting 10 seconds for DNS propagation .. ")
+            time.sleep(10)  # sleep 7 seconds for dns propagation
+
+        for c in challenges:
+            c.verify(challenge_solver.supported_challenge_type())
         while len(remaining_now) > 0:
             if time.time() > end and counter > 4:
                 print("Order finalization time out")
@@ -67,13 +74,13 @@ class AcmeCertIssuer(CertIssuer):
 
             if order.status == "valid":
                 for c in challenges:
-                    challenge_store.delete_challenge(key, c.domain)
+                    challenge_solver.delete_challenge(key, c.domain)
                 return order.get_certificate()
             elif order.status == "processing":
                 if count == 0:
                     # Clean up challenges if timeout occurs
                     for c in challenges:
-                        challenge_store.delete_challenge(key, c.domain)
+                        challenge_solver.delete_challenge(key, c.domain)
                     return None
                 return obtain_cert()
             return None
@@ -90,12 +97,21 @@ class AcmeCertIssuer(CertIssuer):
         locality: Optional[str] = None,
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
-        challenge_store: Optional[ChallengeStore] = None,
-    ):
+        challenge_solver: Optional[ChallengeSolver] = None,
+    ) -> Tuple[Key, str]:
         if len(hosts) == 0:
             raise ValueError("CertIssuer.generate_key_and_cert_for_domains: empty hosts array provided")
         return self.generate_key_and_cert(
-            hosts[0], hosts[0:], key_type, expiry_days, country, state, locality, organization, user_id, challenge_store
+            hosts[0],
+            hosts[0:],
+            key_type,
+            expiry_days,
+            country,
+            state,
+            locality,
+            organization,
+            user_id,
+            challenge_solver,
         )
 
     def generate_key_and_cert_for_domain(
@@ -108,11 +124,11 @@ class AcmeCertIssuer(CertIssuer):
         locality: Optional[str] = None,
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
-        challenge_store: Optional[ChallengeStore] = None,
-    ):
+        challenge_solver: Optional[ChallengeSolver] = None,
+    ) -> Tuple[Key, str]:
 
         return self.generate_key_and_cert(
-            host, [], key_type, expiry_days, country, state, locality, organization, user_id, challenge_store
+            host, [], key_type, expiry_days, country, state, locality, organization, user_id, challenge_solver
         )
 
     def generate_key_and_cert(
@@ -126,19 +142,10 @@ class AcmeCertIssuer(CertIssuer):
         locality: Optional[str] = None,
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
-        challenge_store: Optional[ChallengeStore] = None,
-    ) -> tuple:
+        challenge_solver: Optional[ChallengeSolver] = None,
+    ) -> Tuple[Key, str]:
         """Create a new certificate with a generated key."""
-        # Generate new key based on key_type
-        if key_type == "rsa":
-            new_key = RSAKey.generate()
-        elif key_type == "ecdsa":
-            new_key = ECDSAKey.generate()
-        elif key_type == "ed25519":
-            new_key = Ed25519Key.generate()
-        else:
-            raise ValueError("Unsupported key type. Use 'rsa' or 'ecdsa'")
-
+        new_key = Key.generate(key_type)
         # Create CSR using the new key
         csr = new_key.create_csr(
             domain=domain,
@@ -151,6 +158,6 @@ class AcmeCertIssuer(CertIssuer):
         )
 
         # Sign the CSR to get the certificate
-        cert = self.sign_csr(csr, expiry_days=expiry_days, challenge_store=challenge_store)
+        cert = self.sign_csr(csr, expiry_days=expiry_days, challenge_solver=challenge_solver)
 
         return new_key, cert

{certapi-0.4.2 → certapi-0.4.3}/src/certapi/issuers/abstract_certissuer.py

@@ -3,8 +3,8 @@ from typing import List, Literal, Optional, Union
 from cryptography import x509
 from cryptography.x509.oid import NameOID, ExtensionOID
 from certapi.crypto.crypto import get_csr_hostnames
-from certapi.crypto.crypto_classes import ECDSAKey, Ed25519Key, RSAKey
-from ..challenge_store import ChallengeStore
+from certapi.crypto.crypto_classes import ECDSAKey, Ed25519Key, Key, RSAKey
+from ..challenge_solver import ChallengeSolver
 
 
 class CertIssuer(ABC):
@@ -37,12 +37,21 @@ class CertIssuer(ABC):
         locality: Optional[str] = None,
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
-        challenge_store: Optional[ChallengeStore] = None,
+        challenge_solver: Optional[ChallengeSolver] = None,
     ):
         if len(hosts) == 0:
             raise ValueError("CertIssuer.generate_key_and_cert_for_domains: empty hosts array provided")
         return self.generate_key_and_cert(
-            hosts[0], hosts[0:], key_type, expiry_days, country, state, locality, organization, user_id, challenge_store
+            hosts[0],
+            hosts[0:],
+            key_type,
+            expiry_days,
+            country,
+            state,
+            locality,
+            organization,
+            user_id,
+            challenge_solver,
         )
 
     def generate_key_and_cert_for_domain(
@@ -55,11 +64,11 @@ class CertIssuer(ABC):
         locality: Optional[str] = None,
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
-        challenge_store: Optional[ChallengeStore] = None,
+        challenge_solver: Optional[ChallengeSolver] = None,
     ):
 
         return self.generate_key_and_cert(
-            host, [], key_type, expiry_days, country, state, locality, organization, user_id, challenge_store
+            host, [], key_type, expiry_days, country, state, locality, organization, user_id, challenge_solver
         )
 
     def generate_key_and_cert(
@@ -73,18 +82,10 @@ class CertIssuer(ABC):
         locality: Optional[str] = None,
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
-        challenge_store: Optional[ChallengeStore] = None,
+        challenge_solver: Optional[ChallengeSolver] = None,
     ) -> tuple:
         """Create a new certificate with a generated key."""
-        # Generate new key based on key_type
-        if key_type == "rsa":
-            new_key = RSAKey.generate()
-        elif key_type == "ecdsa":
-            new_key = ECDSAKey.generate()
-        elif key_type == "ed25519":
-            new_key = Ed25519Key.generate()
-        else:
-            raise ValueError("Unsupported key type. Use 'rsa' or 'ecdsa'")
+        new_key = Key.generate(key_type)
 
         # Create CSR using the new key
         csr = new_key.create_csr(

{certapi-0.4.2 → certapi-0.4.3}/src/certapi/keystore/FileSystemKeystore.py

@@ -30,7 +30,10 @@ class FileSystemKeystore(KeyStore):
         if os.path.exists(key_path):
             with open(key_path, "rb") as f:
                 key_data = f.read()
-            return Key.from_pem(key_data)
+            try:
+                return Key.from_pem(key_data)
+            except:
+                pass
         return None
 
     def find_key_by_name(self, name: str) -> Optional[Key]:

{certapi-0.4.2 → certapi-0.4.3}/src/certapi/keystore/KeyStore.py

@@ -1,6 +1,6 @@
 import os
 import sqlite3
-from typing import Tuple, Optional, Union, List
+from typing import Literal, Tuple, Optional, Union, List
 from contextlib import contextmanager
 
 from abc import ABC, abstractmethod
@@ -9,10 +9,10 @@ from certapi.crypto import Key, Certificate, certs_to_pem, cert_to_pem, certs_fr
 
 
 class KeyStore(ABC):
-    def _get_or_generate_key(self, id: str | int) -> Key:
+    def _get_or_generate_key(self, id: str | int, key_type: Literal["rsa", "ecdsa", "ed25519"] = "ecdsa") -> Key:
         account_key = self.find_key_by_id(id)
         if account_key is None:
-            account_key = Key.generate("ecdsa")
+            account_key = Key.generate(key_type)
             id = self.save_key(account_key, id)
         return (account_key, id)
 

{certapi-0.4.2 → certapi-0.4.3}/src/certapi/manager/acme_cert_manager.py

@@ -3,7 +3,7 @@ from typing import List, Literal, Optional, Tuple, Union, Dict
 
 from certapi import crypto
 from ..acme import Challenge
-from ..challenge_store import ChallengeStore
+from ..challenge_solver import ChallengeSolver
 
 from ..issuers import AcmeCertIssuer, CertIssuer
 from ..http.types import CertificateResponse, IssuedCert
@@ -17,12 +17,12 @@ class AcmeCertManager:
         self,
         key_store: KeyStore,
         cert_issuer: AcmeCertIssuer,
-        challenge_stores: List[ChallengeStore] = [],
+        challenge_solvers: List[ChallengeSolver] = [],
     ):
         self.key_store: KeyStore = key_store
         self.cert_issuer: AcmeCertIssuer = cert_issuer
-        self.challenge_stores: List[ChallengeStore] = challenge_stores
-        print(f"AcmeCertManager initialized with challenge_stores: {self.challenge_stores}")
+        self.challenge_solvers: List[ChallengeSolver] = challenge_solvers
+        print(f"AcmeCertManager initialized with challenge_solvers: {self.challenge_solvers}")
 
     def setup(self):
         self.cert_issuer.setup()
@@ -36,16 +36,16 @@ class AcmeCertManager:
             raise ValueError("CSR does not contain any hostnames.")
 
         # Find a challenge store that supports all hostnames in the CSR
-        selected_challenge_store = None
-        for store in self.challenge_stores:
+        selected_challenge_solver = None
+        for store in self.challenge_solvers:
             if all(store.supports_domain(h) for h in hostnames):
-                selected_challenge_store = store
+                selected_challenge_solver = store
                 break
 
-        if selected_challenge_store is None:
+        if selected_challenge_solver is None:
             raise ValueError(f"No challenge store found that supports all domains: {hostnames}")
 
-        fullchain_cert = self.cert_issuer.sign_csr(csr, challenge_store=selected_challenge_store)
+        fullchain_cert = self.cert_issuer.sign_csr(csr, challenge_solver=selected_challenge_solver)
         if fullchain_cert:
             # Assuming the private key associated with the CSR is not managed by CertManager directly
             # and is handled by the caller or the cert_issuer's internal process.
@@ -81,17 +81,11 @@ class AcmeCertManager:
         if len(missing) > 0:
             issued_certs_list = []
             # Group missing hosts by the challenge store that supports them
-            domains_by_store: Dict[ChallengeStore, List[str]] = {}
+            domains_by_store: Dict[ChallengeSolver, List[str]] = {}
             for host in missing:
                 found_store = None
-                for store in self.challenge_stores:
-                    print(
-                        f"Debug: Checking store {store} for domain {host}. supports_domain: {store.supports_domain(host)}"
-                    )
+                for store in self.challenge_solvers:
                     if store.supports_domain(host):
-                        print(
-                            f"Supports domain: '{host}'",
-                        )
                         found_store = store
                         break
                 if found_store is not None:
@@ -99,10 +93,7 @@ class AcmeCertManager:
                         domains_by_store[found_store] = []
                     domains_by_store[found_store].append(host)
                 else:
-                    print(f"Debug: Current challenge_stores: {self.challenge_stores}")
-                    print(f"Warning: No challenge store found that supports domain: {host}. Skipping.")
-
-            # original_challenge_store = self.cert_issuer.challenge_store # Store original
+                    print(f"Warning: No challenge solver found that supports domain: {host}. Skipping.")
 
             for store, domains_to_issue in domains_by_store.items():
 
@@ -115,7 +106,7 @@ class AcmeCertManager:
                     locality=locality,
                     organization=organization,
                     user_id=user_id,
-                    challenge_store=store,
+                    challenge_solver=store,
                 )
 
                 if fullchain_cert:
@@ -125,7 +116,7 @@ class AcmeCertManager:
                 else:
                     print(f"Failed to issue certificate for domains: {domains_to_issue}")
 
-            # self.cert_issuer.challenge_store = original_challenge_store # Restore original
+            # self.cert_issuer.challenge_solver = original_challenge_solver # Restore original
             return createExistingResponse(existing, issued_certs_list)
 
         else:

{certapi-0.4.2 → certapi-0.4.3}/src/certapi.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.4.2
+Version: 0.4.3
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -30,12 +30,12 @@ pip install certapi
 
 ```python
 import json
-from certapi import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+from certapi import FileSystemChallengeSolver, FilesystemKeyStore, CertAuthority
 
 key_store = FilesystemKeyStore("data")
-challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/
+challenge_solver = FileSystemChallengeSolver("./acme-challenges")  # this should be where your web server hosts the .well-known/
 
-certAuthority = CertAuthority(challenge_store, key_store)
+certAuthority = CertAuthority(challenge_solver, key_store)
 certAuthority.setup()
 
 (response,_) = certAuthority.obtainCert("example.com")

{certapi-0.4.2 → certapi-0.4.3}/src/certapi.egg-info/SOURCES.txt

@@ -16,17 +16,17 @@ src/certapi/acme/Challenge.py
 src/certapi/acme/Order.py
 src/certapi/acme/__init__.py
 src/certapi/acme/http.py
-src/certapi/challenge_store/ChallengeStore.py
-src/certapi/challenge_store/FileSystemChallengeStore.py
-src/certapi/challenge_store/InmemoryChallengeStore.py
-src/certapi/challenge_store/__init__.py
-src/certapi/challenge_store/dns/__init__.py
-src/certapi/challenge_store/dns/cloudflare/__init__.py
-src/certapi/challenge_store/dns/cloudflare/cloudflare_challenge_store.py
-src/certapi/challenge_store/dns/cloudflare/cloudflare_client.py
-src/certapi/challenge_store/dns/digitalocean/__init__.py
-src/certapi/challenge_store/dns/digitalocean/digitalocean_challenge_store.py
-src/certapi/challenge_store/dns/digitalocean/digitalocean_client.py
+src/certapi/challenge_solver/ChallengeSolver.py
+src/certapi/challenge_solver/FileSystemChallengeSolver.py
+src/certapi/challenge_solver/InmemoryChallengeSolver.py
+src/certapi/challenge_solver/__init__.py
+src/certapi/challenge_solver/dns/__init__.py
+src/certapi/challenge_solver/dns/cloudflare/__init__.py
+src/certapi/challenge_solver/dns/cloudflare/cloudflare_challenge_solver.py
+src/certapi/challenge_solver/dns/cloudflare/cloudflare_client.py
+src/certapi/challenge_solver/dns/digitalocean/__init__.py
+src/certapi/challenge_solver/dns/digitalocean/digitalocean_challenge_solver.py
+src/certapi/challenge_solver/dns/digitalocean/digitalocean_client.py
 src/certapi/client/__init__.py
 src/certapi/client/cert_manager_client.py
 src/certapi/crypto/__init__.py

certapi-0.4.2/src/certapi/challenge_store/__init__.py

@@ -1,24 +0,0 @@
-from .ChallengeStore import ChallengeStore
-from .InmemoryChallengeStore import InMemoryChallengeStore
-import os
-from .FileSystemChallengeStore import FileSystemChallengeStore
-from .dns import CloudflareChallengeStore, DigitalOceanChallengeStore
-
-
-def get_challenge_store():
-    """
-    Factory function to determine the type of store based on environment variables.
-
-    Environment Variables:
-    - `CHALLENGE_STORE_TYPE`: Can be "memory" or "filesystem".
-    - `CHALLENGE_STORE_DIR`: Directory for filesystem-based store. Defaults to "./challenges".
-    """
-    store_type = os.getenv("CHALLENGE_STORE_TYPE", "filesystem").lower()
-    directory = os.getenv("CHALLENGE_STORE_DIR", "./challenges")
-
-    if store_type == "memory":
-        return InMemoryChallengeStore()
-    elif store_type == "filesystem":
-        return FileSystemChallengeStore(directory)
-    else:
-        raise ValueError(f"Unknown CHALLENGE_STORE_TYPE: {store_type}")

certapi-0.4.2/src/certapi/challenge_store/dns/__init__.py

@@ -1,2 +0,0 @@
-from .digitalocean.digitalocean_challenge_store import DigitalOceanChallengeStore
-from .cloudflare.cloudflare_challenge_store import CloudflareChallengeStore