certapi 0.4.8__tar.gz → 0.5.1__tar.gz

{certapi-0.4.8/src/certapi.egg-info → certapi-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: certapi
-Version: 0.4.8
+Version: 0.5.1
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -10,6 +10,17 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.6
 Description-Content-Type: text/markdown
+Requires-Dist: cryptography
+Requires-Dist: requests
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 # CertApi
 
@@ -18,6 +29,8 @@ This is to be used as a base library for building other tools, or to integrate C
 
 > ⚠️ Warning: This project is in beta. Please stay tuned for the LTS `v1.0.0` release.
 
+For a detailed list of changes, please refer to the [CHANGELOG.md](CHANGELOG.md).
+
 ## Installation
 
 You can install CertApi using pip

{certapi-0.4.8 → certapi-0.5.1}/README.md

@@ -5,6 +5,8 @@ This is to be used as a base library for building other tools, or to integrate C
 
 > ⚠️ Warning: This project is in beta. Please stay tuned for the LTS `v1.0.0` release.
 
+For a detailed list of changes, please refer to the [CHANGELOG.md](CHANGELOG.md).
+
 ## Installation
 
 You can install CertApi using pip
@@ -47,4 +49,4 @@ except CertApiException as e:
 ## Example: Use High Leve API
 
 ```
-```
+```

{certapi-0.4.8 → certapi-0.5.1}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="0.4.8",
+    version="0.5.1",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-0.4.8 → certapi-0.5.1}/src/certapi/__init__.py

@@ -1,4 +1,4 @@
-from .acme.Acme import Acme, Order, AcmeNetworkError, AcmeHttpError,AcmeError, Challenge
+from .acme.Acme import Acme, Order, AcmeNetworkError, AcmeHttpError, AcmeError, Challenge
 from .manager.acme_cert_manager import AcmeCertManager
 from .http.types import CertificateResponse, IssuedCert
 from .errors import CertApiException

{certapi-0.4.8 → certapi-0.5.1}/src/certapi/acme/Acme.py

@@ -93,9 +93,9 @@ class Acme:
         return response
 
     def _signed_req(
-        self, url, payload: Union[str, dict, list, bytes, None] = None, depth=0, step="Acme Request", throw=True
+        self, url, req_payload: Union[str, dict, list, bytes, None] = None, depth=0, step="Acme Request", throw=True
     ) -> requests.Response:
-        payload64 = b64_encode(payload) if payload is not None else b""
+        payload64 = b64_encode(req_payload) if req_payload is not None else b""
 
         protected = {
             "url": url,
@@ -118,9 +118,9 @@ class Acme:
 
             response = post(step, url, json=payload, headers={"Content-Type": "application/jose+json"}, throw=throw)
         except AcmeError as e:
-            if e.can_retry and depth <= 0:
+            if e.can_retry and depth <= 1:
                 time.sleep(2)
-                return self._signed_req(url, payload, depth + 1, step, throw)
+                return self._signed_req(url, req_payload, depth + 1, step, throw)
             else:
                 raise e
 

{certapi-0.4.8 → certapi-0.5.1}/src/certapi/acme/http.py

@@ -22,8 +22,8 @@ def request(method, step: str, url: str, json=None, headers=None, throw=True) ->
             step,
         )
     if 199 <= res.status_code > 299:
-        if(json):
-            print("Request:",j.dumps(json))
+        if json:
+            print("Request:", j.dumps(json))
         [print(x, y) for (x, y) in res.headers.items()]
         print("Response:", res.text)
         json_data = None

{certapi-0.4.8 → certapi-0.5.1}/src/certapi/challenge_solver/ChallengeSolver.py

@@ -6,7 +6,7 @@ from typing import Literal
 
 class ChallengeSolver(ABC):
     """
-    Abstract base class for a challenge store.
+    Abstract base class for a challenge solver.
     """
 
     @abstractmethod

{certapi-0.4.8 → certapi-0.5.1}/src/certapi/client/cert_manager_client.py

@@ -27,7 +27,7 @@ class CertManagerClient:
     def obtain_certificate(
         self,
         hostnames: Union[str, List[str]],
-        key_type: str = "rsa",
+        key_type: str = "ecdsa",
         expiry_days: int = 90,
         country: Optional[str] = None,
         state: Optional[str] = None,

{certapi-0.4.8 → certapi-0.5.1}/src/certapi/crypto/crypto.py

@@ -181,7 +181,6 @@ def digest_sha256(data: bytes) -> bytes:
 def get_csr_hostnames(csr: x509.CertificateSigningRequest):
 
     domains = []
-
     common_names = [attr.value for attr in csr.subject.get_attributes_for_oid(NameOID.COMMON_NAME)]
     if common_names:
         cn = common_names[0]

{certapi-0.4.8 → certapi-0.5.1}/src/certapi/manager/acme_cert_manager.py

@@ -1,5 +1,6 @@
 import time
 from typing import List, Literal, Optional, Tuple, Union, Dict
+from datetime import datetime, timezone, timedelta
 
 from certapi import crypto
 from ..acme import Challenge
@@ -36,7 +37,7 @@ class AcmeCertManager:
         if not hostnames:
             raise ValueError("CSR does not contain any hostnames.")
 
-        # Find a challenge store that supports all hostnames in the CSR
+        # Find a challenge solver that supports all hostnames in the CSR
         selected_challenge_solver = None
         for store in self.challenge_solvers:
             if all(store.supports_domain(h) for h in hostnames):
@@ -44,7 +45,7 @@ class AcmeCertManager:
                 break
 
         if selected_challenge_solver is None:
-            raise ValueError(f"No challenge store found that supports all domains: {hostnames}")
+            raise ValueError(f"No challenge solver found that supports all domains: {hostnames}")
 
         fullchain_cert = self.cert_issuer.sign_csr(csr, challenge_solver=selected_challenge_solver)
         if fullchain_cert:
@@ -76,12 +77,15 @@ class AcmeCertManager:
             result = self.key_store.find_key_and_cert_by_domain(h)
             if result is not None:
                 # result is (domain_id, key, cert_list)
-                existing[h] = result  # Store the certificate list
-
+                cert=result[2][0]
+                invalid_date = cert.not_valid_after_utc
+                # Check if the certificate is still valid for at least 30 days
+                if invalid_date > datetime.now(timezone.utc) + timedelta(days=6):
+                    existing[h] = result
         missing = [h for h in hosts if h not in existing]
         if len(missing) > 0:
             issued_certs_list = []
-            # Group missing hosts by the challenge store that supports them
+            # Group missing hosts by the challenge solver that supports them
             domains_by_store: Dict[ChallengeSolver, List[str]] = {}
             for host in missing:
                 found_store = None

{certapi-0.4.8 → certapi-0.5.1}/src/certapi/server/api.py

@@ -38,7 +38,7 @@ def create_api_resources(api_ns, cert_manager: AcmeCertManager):
     obtain_parser.add_argument(
         "hostname", type=str, action="append", required=True, help="List of hostnames for the certificate"
     )
-    obtain_parser.add_argument("key_type", type=str, default="rsa", help="Type of key (rsa or ecdsa)")
+    obtain_parser.add_argument("key_type", type=str, default="ecdsa", help="Type of key (rsa or ecdsa)")
     obtain_parser.add_argument("expiry_days", type=int, default=90, help="Number of days until certificate expiry")
     obtain_parser.add_argument("country", type=str, help="Country name")
     obtain_parser.add_argument("state", type=str, help="State or province name")

{certapi-0.4.8 → certapi-0.5.1/src/certapi.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: certapi
-Version: 0.4.8
+Version: 0.5.1
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -10,6 +10,17 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.6
 Description-Content-Type: text/markdown
+Requires-Dist: cryptography
+Requires-Dist: requests
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 # CertApi
 
@@ -18,6 +29,8 @@ This is to be used as a base library for building other tools, or to integrate C
 
 > ⚠️ Warning: This project is in beta. Please stay tuned for the LTS `v1.0.0` release.
 
+For a detailed list of changes, please refer to the [CHANGELOG.md](CHANGELOG.md).
+
 ## Installation
 
 You can install CertApi using pip

{certapi-0.4.8 → certapi-0.5.1}/src/certapi.egg-info/SOURCES.txt

@@ -51,4 +51,7 @@ src/certapi/manager/acme_cert_manager.py
 src/certapi/server/__init__.py
 src/certapi/server/api.py
 src/certapi/server/cert_api.py
-src/certapi/server/key_api.py
+src/certapi/server/key_api.py
+tests/test_cert_issuer_generic.py
+tests/test_certs_with_key_types.py
+tests/test_keystores.py

certapi-0.5.1/tests/test_cert_issuer_generic.py

@@ -0,0 +1,202 @@
+import pytest
+from datetime import datetime, timedelta, timezone
+from cryptography import x509
+from cryptography.x509.oid import NameOID, ExtensionOID
+from certapi import Key, SelfCertIssuer, Certificate, CertificateSigningRequest, CertificateSigningRequestBuilder
+from certapi.issuers.abstract_certissuer import CertIssuer
+
+
+@pytest.fixture(scope="module")
+def self_cert_issuer_instance():
+    """Fixture to provide a SelfCertIssuer instance for testing."""
+    ca_key = Key.generate("rsa")
+    issuer = SelfCertIssuer(
+        ca_key,
+        country="US",
+        state="California",
+        locality="Los Angeles",
+        organization="TestOrg",
+        common_name="testca.local",
+    )
+    return issuer
+
+
+@pytest.mark.parametrize("key_type", ["rsa", "ecdsa", "ed25519"])
+def test_generate_key_and_cert(self_cert_issuer_instance: SelfCertIssuer, key_type: str):
+    """
+    Test the generate_key_and_cert method of CertIssuer using SelfCertIssuer.
+    """
+    domain = "example.com"
+    alt_names = ["www.example.com", "mail.example.com"]
+    expiry_days = 30
+
+    new_key, cert = self_cert_issuer_instance.generate_key_and_cert(
+        domain=domain,
+        alt_names=alt_names,
+        key_type=key_type,
+        expiry_days=expiry_days,
+    )
+
+    assert isinstance(new_key, Key)
+    assert isinstance(cert, x509.Certificate)
+
+    # Verify subject and issuer
+    assert cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value == domain
+    assert cert.issuer == self_cert_issuer_instance.issuer
+
+    # Verify SAN extension
+    san_extension = cert.extensions.get_extension_for_oid(ExtensionOID.SUBJECT_ALTERNATIVE_NAME)
+    san_values = san_extension.value.get_values_for_type(x509.DNSName)
+    expected_sans = [domain] + alt_names
+    # The domain is now always included in SAN by create_csr, so ensure it's unique and first
+    unique_expected_sans = []
+    seen = set()
+    for name in expected_sans:
+        if name not in seen:
+            seen.add(name)
+            unique_expected_sans.append(name)
+    assert set(san_values) == set(unique_expected_sans)
+
+    # Verify expiry
+    now_utc = datetime.now(timezone.utc)
+    # Ensure certificate validity dates are timezone-aware UTC for comparison
+    cert_not_valid_before_utc = cert.not_valid_before.astimezone(timezone.utc)
+    cert_not_valid_after_utc = cert.not_valid_after.astimezone(timezone.utc)
+
+    assert cert_not_valid_before_utc <= now_utc
+    assert cert_not_valid_after_utc >= now_utc + timedelta(days=expiry_days - 1)  # Allow for slight time difference
+
+
+@pytest.mark.parametrize("key_type", ["rsa", "ecdsa", "ed25519"])
+def test_generate_key_and_cert_no_alt_names(self_cert_issuer_instance: SelfCertIssuer, key_type: str):
+    """
+    Test generate_key_and_cert with no alt_names provided.
+    """
+    domain = "no-alt-names.example.com"
+    new_key, cert = self_cert_issuer_instance.generate_key_and_cert(
+        domain=domain,
+        alt_names=[],
+        key_type=key_type,
+    )
+    assert isinstance(new_key, Key)
+    assert isinstance(cert, x509.Certificate)
+    assert cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value == domain
+    san_extension = cert.extensions.get_extension_for_oid(ExtensionOID.SUBJECT_ALTERNATIVE_NAME)
+    san_values = san_extension.value.get_values_for_type(x509.DNSName)
+    assert set(san_values) == {domain}
+
+
+@pytest.mark.parametrize("key_type", ["rsa", "ecdsa", "ed25519"])
+def test_generate_key_and_cert_with_custom_fields(self_cert_issuer_instance: SelfCertIssuer, key_type: str):
+    """
+    Test generate_key_and_cert with custom country, state, locality, organization, and user_id.
+    """
+    domain = "custom.example.com"
+    country = "CA"
+    state = "Ontario"
+    locality = "Toronto"
+    organization = "CustomOrg"
+    user_id = "custom_user_id"
+
+    new_key, cert = self_cert_issuer_instance.generate_key_and_cert(
+        domain=domain,
+        key_type=key_type,
+        country=country,
+        state=state,
+        locality=locality,
+        organization=organization,
+        user_id=user_id,
+    )
+
+    assert isinstance(new_key, Key)
+    assert isinstance(cert, x509.Certificate)
+    assert cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value == domain
+    assert cert.subject.get_attributes_for_oid(NameOID.COUNTRY_NAME)[0].value == country
+    assert cert.subject.get_attributes_for_oid(NameOID.STATE_OR_PROVINCE_NAME)[0].value == state
+    assert cert.subject.get_attributes_for_oid(NameOID.LOCALITY_NAME)[0].value == locality
+    assert cert.subject.get_attributes_for_oid(NameOID.ORGANIZATION_NAME)[0].value == organization
+    assert cert.subject.get_attributes_for_oid(NameOID.USER_ID)[0].value == user_id
+
+
+@pytest.mark.parametrize("key_type", ["rsa", "ecdsa", "ed25519"])
+def test_generate_key_and_cert_for_domain(self_cert_issuer_instance: SelfCertIssuer, key_type: str):
+    """
+    Test the generate_key_and_cert_for_domain method.
+    """
+    domain = "single.example.com"
+    new_key, cert = self_cert_issuer_instance.generate_key_and_cert_for_domain(
+        host=domain,
+        key_type=key_type,
+    )
+
+    assert isinstance(new_key, Key)
+    assert isinstance(cert, x509.Certificate)
+    assert cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value == domain
+    san_extension = cert.extensions.get_extension_for_oid(ExtensionOID.SUBJECT_ALTERNATIVE_NAME)
+    san_values = san_extension.value.get_values_for_type(x509.DNSName)
+    assert set(san_values) == {domain}  # Now domain should always be in SAN
+
+
+@pytest.mark.parametrize("key_type", ["rsa", "ecdsa", "ed25519"])
+def test_generate_key_and_cert_for_domains(self_cert_issuer_instance: SelfCertIssuer, key_type: str):
+    """
+    Test the generate_key_and_cert_for_domains method.
+    """
+    hosts = ["multi.example.com", "sub.multi.example.com"]
+    new_key, cert = self_cert_issuer_instance.generate_key_and_cert_for_domains(
+        hosts=hosts,
+        key_type=key_type,
+    )
+
+    assert isinstance(new_key, Key)
+    assert isinstance(cert, x509.Certificate)
+    assert cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value == hosts[0]
+    san_extension = cert.extensions.get_extension_for_oid(ExtensionOID.SUBJECT_ALTERNATIVE_NAME)
+    san_values = san_extension.value.get_values_for_type(x509.DNSName)
+    assert set(san_values) == set(hosts)
+
+
+def test_generate_key_and_cert_for_domains_empty_hosts(self_cert_issuer_instance: SelfCertIssuer):
+    """
+    Test generate_key_and_cert_for_domains with an empty hosts list.
+    """
+    with pytest.raises(ValueError, match="empty hosts array provided"):
+        self_cert_issuer_instance.generate_key_and_cert_for_domains(hosts=[])
+
+
+def test_generate_key_and_cert_unsupported_key_type(self_cert_issuer_instance: SelfCertIssuer):
+    """
+    Test generate_key_and_cert with an unsupported key type.
+    """
+    with pytest.raises(ValueError, match="Unsupported key type. Use 'rsa' or 'ecdsa'"):
+        self_cert_issuer_instance.generate_key_and_cert(
+            domain="invalid.example.com",
+            key_type="unsupported",  # type: ignore
+        )
+
+
+def test_get_csr_hostnames():
+    """
+    Test the static method get_csr_hostnames.
+    """
+    # Case 1: CSR with CN and SAN
+    key = Key.generate("rsa")
+    csr = key.create_csr(domain="cn.test.com", alt_names=["san1.test.com", "san2.test.com"])
+    hostnames = CertIssuer.get_csr_hostnames(csr)
+    assert set(hostnames) == {"cn.test.com", "san1.test.com", "san2.test.com"}
+    assert hostnames[0] == "cn.test.com"  # CN should be first if not already in SAN
+
+    # Case 2: CSR with only CN (and it will be added to SAN by create_csr)
+    key_cn_only = Key.generate("ecdsa")
+    csr_cn_only = key_cn_only.create_csr(domain="onlycn.test.com")
+    hostnames_cn_only = CertIssuer.get_csr_hostnames(csr_cn_only)
+    assert hostnames_cn_only == ["onlycn.test.com"]
+
+    # Case 3: CN is also in SAN (handled by unique_alt_names logic in create_csr)
+    key_cn_in_san = Key.generate("ecdsa")
+    csr_cn_in_san = key_cn_in_san.create_csr(
+        domain="duplicate.test.com", alt_names=["duplicate.test.com", "another.test.com"]
+    )
+    hostnames_cn_in_san = CertIssuer.get_csr_hostnames(csr_cn_in_san)
+    assert set(hostnames_cn_in_san) == {"duplicate.test.com", "another.test.com"}
+    assert hostnames_cn_in_san[0] == "duplicate.test.com"  # CN should still be first and unique

certapi-0.5.1/tests/test_certs_with_key_types.py

@@ -0,0 +1,41 @@
+import pytest
+from datetime import datetime
+from cryptography import x509
+from certapi import Key, SelfCertIssuer
+
+
+@pytest.mark.parametrize("ca_key_type", ["rsa", "ecdsa", "ed25519"])
+@pytest.mark.parametrize("csr_key_type", ["rsa", "ecdsa", "ed25519"])
+def test_ca_and_leaf_cert_all_key_pairs(ca_key_type, csr_key_type):
+    # Generate CA key and CA instance
+    ca_key = Key.generate(ca_key_type)
+    ca: SelfCertIssuer = SelfCertIssuer(
+        ca_key,
+        country="US",
+        state="California",
+        locality="Los Angeles",
+        organization="TestOrg",
+        common_name="testca.local",
+    )
+    ca_cert = ca.get_ca_cert()
+
+    # Generate leaf/CSR key
+    leaf_key = Key.generate(csr_key_type)
+    csr = leaf_key.create_csr("example.com")
+
+    # Sign CSR with CA key
+    leaf_cert = ca.sign_csr(csr, expiry_days=30)
+
+    # Assertions
+    assert isinstance(ca_cert, x509.Certificate)
+    assert ca_cert.subject == ca_cert.issuer  # Self-signed
+    assert isinstance(ca_cert.not_valid_before_utc, datetime)
+    assert isinstance(ca_cert.not_valid_after_utc, datetime)
+    assert ca_cert.issuer.get_attributes_for_oid(x509.oid.NameOID.COMMON_NAME)[0].value == "testca.local"
+
+    assert isinstance(leaf_cert, x509.Certificate)
+    assert leaf_cert.not_valid_after_utc > leaf_cert.not_valid_before_utc
+    assert leaf_cert.subject.get_attributes_for_oid(x509.oid.NameOID.COMMON_NAME)[0].value == "example.com"
+
+    # Check issuer consistency
+    assert leaf_cert.issuer == ca_cert.subject

certapi-0.5.1/tests/test_keystores.py

@@ -0,0 +1,179 @@
+import pytest
+import os
+import psycopg2  # Added for PostgreSQL database creation
+from psycopg2.extensions import ISOLATION_LEVEL_AUTOCOMMIT  # Added for PostgreSQL database creation
+
+from certapi import Key, Certificate
+from certapi.crypto.crypto import cert_to_pem, certs_to_pem
+from certapi.keystore import SqliteKeyStore, FileSystemKeyStore, PostgresKeyStore
+from typing import List, Tuple, Union
+from datetime import datetime, timedelta
+from certapi import KeyStore, Certificate, Key
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes
+from datetime import datetime, timedelta
+
+
+@pytest.fixture(scope="session")
+def ca_key():
+    return Key.generate("ecdsa")
+
+
+@pytest.fixture(params=["sqlite", "filesystem", "postgresql"])
+def keystore(request, tmp_path):
+    if request.param == "sqlite":
+        db_path = tmp_path / "test.db"
+        store = SqliteKeyStore(db_path=str(db_path))
+        yield store
+        # Clean up after test
+        if os.path.exists(db_path):
+            os.remove(db_path)
+    elif request.param == "filesystem":
+        base_dir = tmp_path / "keystore_fs"
+        store = FileSystemKeyStore(base_dir=str(base_dir))
+        yield store
+        # Clean up after test
+        import shutil
+
+        if os.path.exists(base_dir):
+            shutil.rmtree(base_dir)
+    elif request.param == "postgresql":
+        db_url = "postgresql://localhost/test_db"
+        try:
+            conn_no_db = psycopg2.connect("postgresql://localhost/postgres")
+            conn_no_db.set_isolation_level(ISOLATION_LEVEL_AUTOCOMMIT)
+            cur_no_db = conn_no_db.cursor()
+            cur_no_db.execute("SELECT 1 FROM pg_database WHERE datname = 'test_db'")
+            exists = cur_no_db.fetchone()
+            if not exists:
+                cur_no_db.execute("CREATE DATABASE test_db")
+            cur_no_db.close()
+            conn_no_db.close()
+        except psycopg2.OperationalError as e:
+            pytest.skip(f"Could not connect to PostgreSQL to create test_db: {e}")
+
+        store = PostgresKeyStore(db_url=db_url)
+        yield store
+        # Clean up after test: drop tables
+        with store.get_connection() as conn:
+            cur = conn.cursor()
+            cur.execute("DROP TABLE IF EXISTS ssl_wildcards;")
+            cur.execute("DROP TABLE IF EXISTS ssl_domains;")
+            cur.execute("DROP TABLE IF EXISTS certificates;")
+            cur.execute("DROP TABLE IF EXISTS private_keys;")
+            conn.commit()
+            cur.close()
+
+
+def test_save_and_find_key(keystore: KeyStore):
+    key = Key.generate("rsa")
+    key_id = keystore.save_key(key, "test_key")
+    assert key_id is not None
+
+    found_key = keystore.find_key_by_name("test_key")
+    assert found_key is not None
+    assert found_key.to_pem() == key.to_pem()
+
+
+def test_save_and_find_cert(keystore: KeyStore, ca_key: Key):
+    key = Key.generate("rsa")
+    key_id = keystore.save_key(key, "cert_key")
+
+    csr = key.create_csr(domain="example.com", alt_names=["example.com"])
+
+    cert = sign_csr(csr, ca_key, 7)
+
+    cert_id = keystore.save_cert(key_id, cert, ["example.com"], "test_cert")
+    assert cert_id is not None
+
+    found_cert_tuple = keystore.find_key_and_cert_by_domain("example.com")
+    assert found_cert_tuple is not None
+    found_id, found_key, found_certs = found_cert_tuple
+    if not isinstance(keystore, FileSystemKeyStore):
+        assert found_id == cert_id
+    assert found_key.to_pem() == key.to_pem()
+    assert len(found_certs) == 1
+    assert cert_to_pem(found_certs[0]) == cert_to_pem(cert)
+
+
+def test_get_non_existent_key(keystore: KeyStore):
+    found_key = keystore.find_key_by_name("non_existent_key")
+    assert found_key is None
+
+
+def test_get_non_existent_cert(keystore: KeyStore):
+    found_cert = keystore.find_key_and_cert_by_domain("nonexistent.com")
+    assert found_cert is None
+
+
+def test_save_key_with_int_id(keystore: KeyStore):
+    key = Key.generate("ecdsa")
+    key_id = keystore.save_key(key, 123)
+    assert key_id == 123 or key_id == "123"
+
+    found_key = keystore.find_key_by_id(123)
+    assert found_key is not None
+    assert found_key.to_pem() == key.to_pem()
+
+
+def test_save_cert_with_list_of_certs(keystore, ca_key: Key):
+    key = Key.generate("rsa")
+    key_id = keystore.save_key(key, "cert_list_key")
+
+    csr1 = key.create_csr(domain="cert1.example.com", alt_names=["cert1.example.com"])
+    cert1 = sign_csr(csr1, ca_key, 1)
+
+    csr2 = key.create_csr(domain="cert2.example.com", alt_names=["cert2.example.com"])
+    cert2 = sign_csr(csr2, ca_key, 1)
+
+    certs_list = [cert1, cert2]
+    cert_id = keystore.save_cert(key_id, certs_list, ["cert1.example.com", "cert2.example.com"], "test_certs_list")
+    assert cert_id is not None
+
+    found_cert_tuple = keystore.find_key_and_cert_by_domain("cert1.example.com")
+    assert found_cert_tuple is not None
+    found_id, found_key, found_certs = found_cert_tuple
+    if not isinstance(keystore, FileSystemKeyStore):
+        assert found_id == cert_id
+    assert found_key.to_pem() == key.to_pem()
+    assert len(found_certs) == 2
+    assert cert_to_pem(found_certs[0]) == cert_to_pem(cert1)
+    assert cert_to_pem(found_certs[1]) == cert_to_pem(cert2)
+
+
+def test_get_cert_by_id(keystore: KeyStore, ca_key: Key):
+    key = Key.generate("rsa")
+    domain = "example.com"
+
+    key_id = keystore.save_key(key, domain)
+
+    csr = key.create_csr(domain=domain, alt_names=[domain])
+    cert = sign_csr(csr, ca_key, 1)
+
+    cert_id = keystore.save_cert(key_id, cert, [domain], domain)
+    assert cert_id is not None
+
+    found_cert_tuple = keystore.find_key_and_cert_by_cert_id(cert_id)
+    assert found_cert_tuple is not None
+    found_key, found_certs = found_cert_tuple
+    assert found_key.to_pem() == key.to_pem()
+    assert len(found_certs) == 1
+    assert cert_to_pem(found_certs[0]) == cert_to_pem(cert)
+
+
+def sign_csr(csr: x509.CertificateSigningRequest, issuer_key: Key, days_valid=365) -> Certificate:
+    builder = (
+        x509.CertificateBuilder()
+        .subject_name(csr.subject)
+        .issuer_name(x509.Name([x509.NameAttribute(x509.NameOID.COMMON_NAME, "certapi.pytest.com")]))
+        .public_key(csr.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(datetime.utcnow())
+        .not_valid_after(datetime.utcnow() + timedelta(days=days_valid))
+    )
+
+    # Optionally copy extensions from CSR
+    for ext in csr.extensions:
+        builder = builder.add_extension(ext.value, ext.critical)
+    return issuer_key.sign_csr(builder)