certapi 1.0.4__tar.gz → 1.1.0__tar.gz

certapi-1.1.0/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.4
+Name: certapi
+Version: 1.1.0
+Summary: Python Package for managing keys, request SSL certificates from ACME.
+Home-page: https://github.com/mesudip/certapi
+Author: Sudip Bhattarai
+Author-email: sudipbhattarai100@gmail.com
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography
+Requires-Dist: requests
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
+
+CertApi
+=============================
+
+Certapi talks with DNS provider and ACME to issue SSL certificates and save it to a keystore.
+
+CertApi is a base library for building other tools, or to integrate Certificate creation feature in your app. CertAPI also provides HTTP api server and can be deployed using Docker
+
+[![Build Status](https://github.com/mesudip/certapi/actions/workflows/tests.yml/badge.svg?branch=master)](https://github.com/mesudip/certapi/actions/workflows/tests.yml)
+[![codecov](https://codecov.io/github/mesudip/certapi/graph/badge.svg?token=NYTNCH29IT)](https://codecov.io/github/mesudip/certapi)
+[![PyPI version](https://img.shields.io/pypi/v/certapi.svg)](https://pypi.org/project/certapi/)
+
+## Why another library?
+
+I designed this library so that it can be imported and plugged in to other python projects. Goal is not to provide CLIs or quick working demo, but to be versatile for any use case.
+
+- Pluggable keystores for keys and certificates
+- Pluggable Challenge solvers for DNS and Http challenge solving
+- High-level manager with renewal checks and multi-solver support
+- Same interface for working locally, or requesting certificate from certapi server.
+
+See the developer guide in [Developer.md](Developer.md) for library usage and workflows.
+
+
+## Installation
+
+You can install CertApi using pip
+
+```bash
+pip install certapi
+```
+
+## CLI
+
+CertApi also ships with a CLI for quick verification and certificate issuance.
+
+```bash
+## Certapi's dependencies are already included in the python installation. This doesn't affect the system.
+sudo python3 -m pip install certapi --break-system-packages
+```
+
+### 1. With HTTP Challenge
+
+HTTP challenge requires you to have seup the DNS correctly. The ACME server will verify your domain by making an HTTP request.
+
+```bash
+# Verify environment and HTTP routing
+sudo certapi verify example.com www.example.com
+
+# Obtain a certificate (requires root for HTTP-01)
+sudo certapi obtain example.com www.example.com
+```
+
+### 2. With DNS Provider Key
+
+Using DNS-01 challenge with Cloudflare doesn't require the DNS to be setup. Set your Cloudflare API key as an environment variable.
+
+```bash
+# Set Cloudflare API key or token
+export CLOUDFLARE_API_KEY=...   # or CLOUDFLARE_API_TOKEN
+
+# Verify DNS configuration
+sudo certapi verify example.com
+
+# Obtain a certificate using DNS-01
+sudo certapi obtain example.com www.example.com
+```

certapi-1.1.0/README.md

@@ -0,0 +1,66 @@
+CertApi
+=============================
+
+Certapi talks with DNS provider and ACME to issue SSL certificates and save it to a keystore.
+
+CertApi is a base library for building other tools, or to integrate Certificate creation feature in your app. CertAPI also provides HTTP api server and can be deployed using Docker
+
+[![Build Status](https://github.com/mesudip/certapi/actions/workflows/tests.yml/badge.svg?branch=master)](https://github.com/mesudip/certapi/actions/workflows/tests.yml)
+[![codecov](https://codecov.io/github/mesudip/certapi/graph/badge.svg?token=NYTNCH29IT)](https://codecov.io/github/mesudip/certapi)
+[![PyPI version](https://img.shields.io/pypi/v/certapi.svg)](https://pypi.org/project/certapi/)
+
+## Why another library?
+
+I designed this library so that it can be imported and plugged in to other python projects. Goal is not to provide CLIs or quick working demo, but to be versatile for any use case.
+
+- Pluggable keystores for keys and certificates
+- Pluggable Challenge solvers for DNS and Http challenge solving
+- High-level manager with renewal checks and multi-solver support
+- Same interface for working locally, or requesting certificate from certapi server.
+
+See the developer guide in [Developer.md](Developer.md) for library usage and workflows.
+
+
+## Installation
+
+You can install CertApi using pip
+
+```bash
+pip install certapi
+```
+
+## CLI
+
+CertApi also ships with a CLI for quick verification and certificate issuance.
+
+```bash
+## Certapi's dependencies are already included in the python installation. This doesn't affect the system.
+sudo python3 -m pip install certapi --break-system-packages
+```
+
+### 1. With HTTP Challenge
+
+HTTP challenge requires you to have seup the DNS correctly. The ACME server will verify your domain by making an HTTP request.
+
+```bash
+# Verify environment and HTTP routing
+sudo certapi verify example.com www.example.com
+
+# Obtain a certificate (requires root for HTTP-01)
+sudo certapi obtain example.com www.example.com
+```
+
+### 2. With DNS Provider Key
+
+Using DNS-01 challenge with Cloudflare doesn't require the DNS to be setup. Set your Cloudflare API key as an environment variable.
+
+```bash
+# Set Cloudflare API key or token
+export CLOUDFLARE_API_KEY=...   # or CLOUDFLARE_API_TOKEN
+
+# Verify DNS configuration
+sudo certapi verify example.com
+
+# Obtain a certificate using DNS-01
+sudo certapi obtain example.com www.example.com
+```

{certapi-1.0.4 → certapi-1.1.0}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="1.0.4",
+    version="1.1.0",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[
@@ -22,4 +22,9 @@ setup(
         "Operating System :: OS Independent",
     ],
     python_requires=">=3.6",
+    entry_points={
+        "console_scripts": [
+            "certapi=certapi.cli:main",
+        ],
+    },
 )

{certapi-1.0.4 → certapi-1.1.0}/src/certapi/challenge_solver/InmemoryChallengeSolver.py

@@ -13,6 +13,9 @@ class InMemoryChallengeSolver(ChallengeSolver):
     def supported_challenge_type(self) -> Literal["http-01"]:
         return "http-01"
 
+    def supports_domain(self, domain: str) -> bool:
+        return "*" not in domain
+
     def save_challenge(self, key: str, value: str, domain: str = None):
         self.challenges[key] = value
 
@@ -23,6 +26,9 @@ class InMemoryChallengeSolver(ChallengeSolver):
         if key in self.challenges:
             del self.challenges[key]
 
+    def cleanup_old_challenges(self):
+        self.challenges.clear()
+
     def __iter__(self):
         return iter(self.challenges)
 

certapi-1.1.0/src/certapi/cli.py

@@ -0,0 +1,242 @@
+import argparse
+import os
+import secrets
+import subprocess
+import sys
+import threading
+from http.server import BaseHTTPRequestHandler
+from socketserver import TCPServer
+from typing import List, Optional, Tuple
+from urllib.parse import unquote
+
+import requests
+
+from certapi import (
+    AcmeCertIssuer,
+    CertApiException,
+    CloudflareChallengeSolver,
+    FileSystemKeyStore,
+    InMemoryChallengeSolver,
+)
+from certapi.crypto import certs_from_pem
+
+
+def is_root() -> bool:
+    """Check if running with elevated privileges (cross-platform)."""
+    try:
+        if os.name == "nt":  # Windows
+            import ctypes
+
+            return ctypes.windll.shell32.IsUserAnAdmin() != 0
+        else:  # Unix-like (Linux, macOS)
+            return os.geteuid() == 0
+    except (AttributeError, ImportError, OSError):
+        return False
+
+
+def find_process_on_port(port: int) -> List[str]:
+    """Find processes using a specific port (cross-platform)."""
+    try:
+        if os.name == "nt":  # Windows
+            result = subprocess.check_output(["netstat", "-ano"], stderr=subprocess.DEVNULL).decode().strip()
+            pids = []
+            for line in result.split("\n"):
+                if f":{port}" in line and "LISTENING" in line:
+                    parts = line.split()
+                    if parts:
+                        pids.append(parts[-1])
+            return pids
+        else:  # Unix-like (Linux, macOS)
+            result = (
+                subprocess.check_output(["lsof", "-i", f":{port}", "-t"], stderr=subprocess.DEVNULL).decode().strip()
+            )
+            return result.split("\n") if result else []
+    except (subprocess.CalledProcessError, FileNotFoundError):
+        return []
+
+
+def _start_http_challenge_server(
+    challenge_solver: InMemoryChallengeSolver, port: int = 80
+) -> Tuple[TCPServer, threading.Thread]:
+    class AcmeChallengeHandler(BaseHTTPRequestHandler):
+        def do_GET(self):
+            prefix = "/.well-known/acme-challenge/"
+            if not self.path.startswith(prefix):
+                self.send_error(404)
+                return
+            token = unquote(self.path[len(prefix) :])
+            if not token or "/" in token or "\\" in token:
+                self.send_error(400)
+                return
+            content = challenge_solver.get_challenge(token)
+            if not content:
+                self.send_error(404)
+                return
+            if isinstance(content, str):
+                content = content.encode("utf-8")
+            self.send_response(200)
+            self.send_header("Content-Type", "text/plain")
+            self.send_header("Content-Length", str(len(content)))
+            self.end_headers()
+            self.wfile.write(content)
+
+        def log_message(self, format, *args):
+            return
+
+    class ReusableTCPServer(TCPServer):
+        allow_reuse_address = True
+
+    server = ReusableTCPServer(("", port), AcmeChallengeHandler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    return server, thread
+
+
+def _resolve_cloudflare_api_key() -> Optional[str]:
+    return os.environ.get("CLOUDFLARE_API_KEY") or os.environ.get("CLOUDFLARE_API_TOKEN")
+
+
+def _ensure_port_80_available() -> None:
+    if not is_root():
+        print("Must be run as root to bind to port 80 for HTTP challenge.")
+        sys.exit(1)
+
+    while True:
+        pids = find_process_on_port(80)
+        if not pids:
+            return
+        print(f"Process(es) running on port 80: {', '.join(pids)}")
+        response = input("Stop the process(es) above, then press Enter to retry (or type 'q' to quit): ")
+        if response.strip().lower() == "q":
+            sys.exit(1)
+
+
+def obtain_certificate(domains: List[str], api_key: Optional[str] = None):
+    challenge_solver = None
+    server = None
+
+    if api_key:
+        challenge_solver = CloudflareChallengeSolver(api_key=api_key)
+        print("Using Cloudflare DNS challenge.")
+    else:
+        _ensure_port_80_available()
+        challenge_solver = InMemoryChallengeSolver()
+        print("Starting HTTP challenge server on port 80...")
+        server, _ = _start_http_challenge_server(challenge_solver, port=80)
+
+    keystore_path = "/etc/ssl"
+    key_store = FileSystemKeyStore(keystore_path)
+    cert_issuer = AcmeCertIssuer.with_keystore(
+        key_store,
+        challenge_solver,
+        account_key_name="acme_account",
+    )
+    cert_issuer.setup()
+    try:
+        key, cert = cert_issuer.generate_key_and_cert_for_domains(domains, key_type="rsa")
+        key_name = domains[0]
+        key_id = key_store.save_key(key, key_name)
+        key_store.save_cert(key_id, cert, domains, name=key_name)
+
+        cert_chain = certs_from_pem(cert.encode("utf-8"))
+        leaf_cert = cert_chain[0] if cert_chain else None
+        expiry = leaf_cert.not_valid_after.isoformat() if leaf_cert else "unknown"
+
+        key_path = os.path.join(key_store.keys_dir, f"{key_name}.key")
+        cert_path = os.path.join(key_store.certs_dir, f"{key_name}.crt")
+        print(f"\n   Certificate expires at: {expiry}")
+        print(f"   Key path: {key_path}")
+        print(f"   Cert path: {cert_path}")
+    except CertApiException as e:
+        print("An error occurred:")
+        print(e.json_obj())
+    finally:
+        if server is not None:
+            server.shutdown()
+            server.server_close()
+
+
+def verify_environment(domains: List[str], api_key: Optional[str] = None) -> None:
+    if api_key:
+        print("[verify] Cloudflare API key detected; DNS-01 challenge available")
+        if domains:
+            solver = CloudflareChallengeSolver(api_key=api_key)
+            unsupported = [domain for domain in domains if not solver.supports_domain(domain)]
+            if unsupported:
+                print("[verify] Warning: Cloudflare account does not appear to manage:")
+                for domain in unsupported:
+                    print(f"[verify] - {domain}")
+            else:
+                print("[verify] Cloudflare account appears to manage the provided domain(s)")
+    else:
+        print("[verify]  HTTP-01 challenge will be used")
+        if not domains:
+            print("[verify] No domains provided; skipping HTTP routing check")
+            return
+        if is_root():
+            pids = find_process_on_port(80)
+            if pids:
+                print(f"[verify] Warning: port 80 is in use by process(es): {', '.join(pids)}")
+            else:
+                print("[verify] Port 80 is available")
+        else:
+            print("[verify] Warning: not running as root; port 80 binding will fail")
+            return
+
+        _ensure_port_80_available()
+        challenge_solver = InMemoryChallengeSolver()
+        print("[verify] Starting HTTP challenge server on port 80...")
+        server, _ = _start_http_challenge_server(challenge_solver, port=80)
+        ok = 0
+        failed = 0
+        try:
+            for domain in domains:
+                token = secrets.token_urlsafe(24)
+                value = secrets.token_urlsafe(32)
+                challenge_solver.save_challenge(token, value, domain)
+                url = f"http://{domain}/.well-known/acme-challenge/{token}"
+                print(f"[verify] Checking HTTP routing for {domain}...")
+                try:
+                    response = requests.get(url, allow_redirects=False, timeout=5)
+                    if response.status_code == 200 and response.text.strip() == value:
+                        ok += 1
+                        print(f"[verify] OK: {domain} routes to this server")
+                    else:
+                        failed += 1
+                        print(
+                            f"[verify] FAILED: {domain} returned status {response.status_code} "
+                            f"with body '{response.text.strip()}'"
+                        )
+                except requests.RequestException as exc:
+                    failed += 1
+                    print(f"[verify] FAILED: {domain} request error: {exc}")
+                finally:
+                    challenge_solver.delete_challenge(token, domain)
+        finally:
+            server.shutdown()
+            server.server_close()
+            print(f"\n         Summary: {ok} OK, {failed} FAILED")
+
+
+def main():
+    parser = argparse.ArgumentParser(prog="certapi")
+    subparsers = parser.add_subparsers(dest="command")
+
+    verify_parser = subparsers.add_parser("verify", help="Verify certapi installation and environment.")
+    verify_parser.add_argument("domains", nargs="*", help="Optional domain(s) to verify.")
+
+    obtain_parser = subparsers.add_parser("obtain", help="Obtain certificate for domains.")
+    obtain_parser.add_argument("domains", nargs="+", help="Domain(s) to obtain certificate for.")
+
+    args = parser.parse_args()
+
+    if args.command == "verify":
+        api_key = _resolve_cloudflare_api_key()
+        verify_environment(args.domains, api_key=api_key)
+        sys.exit(0)
+    elif args.command == "obtain":
+        api_key = _resolve_cloudflare_api_key()
+        obtain_certificate(args.domains, api_key=api_key)
+    else:
+        parser.print_help()
+        sys.exit(1)

{certapi-1.0.4 → certapi-1.1.0}/src/certapi/client/cert_manager_client.py

@@ -69,7 +69,7 @@ class CertManagerClient:
             params["renew_threshold_days"] = renew_threshold_days
         params["skip_failing"] = skip_failing
 
-        data = self._get("/obtain", params=params)
+        data = self._get("/api/obtain", params=params)
         res = CertificateResponse.from_json(data)
 
         if self.key_store:
@@ -93,7 +93,7 @@ class CertManagerClient:
             csr_pem = csr
 
         response = requests.post(
-            f"{self.base_url}/sign_csr", data=csr_pem, headers={"Content-Type": "application/x-pem-file"}
+            f"{self.base_url}/api/sign_csr", data=csr_pem, headers={"Content-Type": "application/x-pem-file"}
         )
         response.raise_for_status()
         return response.text

{certapi-1.0.4 → certapi-1.1.0}/src/certapi/issuers/AcmeCertIssuer.py

@@ -25,7 +25,7 @@ class AcmeCertIssuer(CertIssuer):
     def with_keystore(
         key_store: "KeyStore",
         challenge_solver: ChallengeSolver,
-        account_key_name: str = "acme_account.key",
+        account_key_name: str = "acme_account",
         acme_url: str = None,
     ) -> "AcmeCertIssuer":
         account_key, _ = key_store._get_or_generate_key(account_key_name, "rsa")

{certapi-1.0.4 → certapi-1.1.0}/src/certapi/server/cert_api.py

@@ -34,7 +34,7 @@ def create_cert_resources(cert_ns, key_store):
     cert_list_parser = reqparse.RequestParser()
     cert_list_parser.add_argument("domain", type=str, help="Filter certificates by domain")
 
-    @cert_ns.route("/certs")
+    @cert_ns.route("/")
     class CertList(Resource):
         @cert_ns.doc("list_certs")
         @cert_ns.expect(cert_list_parser)
@@ -94,7 +94,7 @@ def create_cert_resources(cert_ns, key_store):
             except Exception as e:
                 cert_ns.abort(500, f"Error saving certificate: {e}")
 
-    @cert_ns.route("/certs/<string:cert_id>")
+    @cert_ns.route("/<string:cert_id>")
     @cert_ns.param("cert_id", "The certificate identifier")
     class CertById(Resource):
         @cert_ns.doc("get_cert_by_id")

{certapi-1.0.4 → certapi-1.1.0}/src/certapi/server/key_api.py

@@ -23,7 +23,7 @@ def create_key_resources(key_ns, key_store):
         },
     )
 
-    @key_ns.route("/keys")
+    @key_ns.route("/")
     class KeyList(Resource):
         @key_ns.doc("list_keys")
         @key_ns.marshal_list_with(key_model)
@@ -49,7 +49,7 @@ def create_key_resources(key_ns, key_store):
             except Exception as e:
                 key_ns.abort(500, f"Error saving key: {e}")
 
-    @key_ns.route("/keys/<string:key_id>")
+    @key_ns.route("/<string:key_id>")
     @key_ns.param("key_id", "The key identifier")
     class KeyById(Resource):
         @key_ns.doc("get_key_by_id")
@@ -62,7 +62,7 @@ def create_key_resources(key_ns, key_store):
             else:
                 key_ns.abort(404, message="Key not found")
 
-    @key_ns.route("/keys/name/<string:name>")
+    @key_ns.route("/name/<string:name>")
     @key_ns.param("name", "The key name")
     class KeyByName(Resource):
         @key_ns.doc("get_key_by_name")

certapi-1.1.0/src/certapi.egg-info/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.4
+Name: certapi
+Version: 1.1.0
+Summary: Python Package for managing keys, request SSL certificates from ACME.
+Home-page: https://github.com/mesudip/certapi
+Author: Sudip Bhattarai
+Author-email: sudipbhattarai100@gmail.com
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography
+Requires-Dist: requests
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
+
+CertApi
+=============================
+
+Certapi talks with DNS provider and ACME to issue SSL certificates and save it to a keystore.
+
+CertApi is a base library for building other tools, or to integrate Certificate creation feature in your app. CertAPI also provides HTTP api server and can be deployed using Docker
+
+[![Build Status](https://github.com/mesudip/certapi/actions/workflows/tests.yml/badge.svg?branch=master)](https://github.com/mesudip/certapi/actions/workflows/tests.yml)
+[![codecov](https://codecov.io/github/mesudip/certapi/graph/badge.svg?token=NYTNCH29IT)](https://codecov.io/github/mesudip/certapi)
+[![PyPI version](https://img.shields.io/pypi/v/certapi.svg)](https://pypi.org/project/certapi/)
+
+## Why another library?
+
+I designed this library so that it can be imported and plugged in to other python projects. Goal is not to provide CLIs or quick working demo, but to be versatile for any use case.
+
+- Pluggable keystores for keys and certificates
+- Pluggable Challenge solvers for DNS and Http challenge solving
+- High-level manager with renewal checks and multi-solver support
+- Same interface for working locally, or requesting certificate from certapi server.
+
+See the developer guide in [Developer.md](Developer.md) for library usage and workflows.
+
+
+## Installation
+
+You can install CertApi using pip
+
+```bash
+pip install certapi
+```
+
+## CLI
+
+CertApi also ships with a CLI for quick verification and certificate issuance.
+
+```bash
+## Certapi's dependencies are already included in the python installation. This doesn't affect the system.
+sudo python3 -m pip install certapi --break-system-packages
+```
+
+### 1. With HTTP Challenge
+
+HTTP challenge requires you to have seup the DNS correctly. The ACME server will verify your domain by making an HTTP request.
+
+```bash
+# Verify environment and HTTP routing
+sudo certapi verify example.com www.example.com
+
+# Obtain a certificate (requires root for HTTP-01)
+sudo certapi obtain example.com www.example.com
+```
+
+### 2. With DNS Provider Key
+
+Using DNS-01 challenge with Cloudflare doesn't require the DNS to be setup. Set your Cloudflare API key as an environment variable.
+
+```bash
+# Set Cloudflare API key or token
+export CLOUDFLARE_API_KEY=...   # or CLOUDFLARE_API_TOKEN
+
+# Verify DNS configuration
+sudo certapi verify example.com
+
+# Obtain a certificate using DNS-01
+sudo certapi obtain example.com www.example.com
+```

{certapi-1.0.4 → certapi-1.1.0}/src/certapi.egg-info/SOURCES.txt

@@ -3,12 +3,14 @@ README.md
 pyproject.toml
 setup.py
 src/certapi/__init__.py
+src/certapi/cli.py
 src/certapi/errors.py
 src/certapi/util.py
 src/certapi/utils.py
 src/certapi.egg-info/PKG-INFO
 src/certapi.egg-info/SOURCES.txt
 src/certapi.egg-info/dependency_links.txt
+src/certapi.egg-info/entry_points.txt
 src/certapi.egg-info/requires.txt
 src/certapi.egg-info/top_level.txt
 src/certapi/acme/Acme.py
@@ -55,5 +57,6 @@ src/certapi/server/key_api.py
 tests/test_acme_error_handling.py
 tests/test_cert_issuer_generic.py
 tests/test_certs_with_key_types.py
+tests/test_cli.py
 tests/test_http_error_handling.py
 tests/test_keystores.py

certapi-1.1.0/src/certapi.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+certapi = certapi.cli:main