certapi 1.1.0__tar.gz → 1.1.2__tar.gz

{certapi-1.1.0/src/certapi.egg-info → certapi-1.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.0
+Version: 1.1.2
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.0 → certapi-1.1.2}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="1.1.0",
+    version="1.1.2",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-1.1.0 → certapi-1.1.2}/src/certapi/__init__.py

@@ -21,4 +21,5 @@ from .challenge_solver import (
     DigitalOceanChallengeSolver,
 )
 from .issuers import CertIssuer, SelfCertIssuer, AcmeCertIssuer
-from .client import CertManagerClient
+from .client import CertManagerClient, RenewalManager
+from .domain_batching import create_safe_domain_batches

{certapi-1.1.0 → certapi-1.1.2}/src/certapi/acme/Acme.py

@@ -22,6 +22,7 @@ class Acme:
 
     URL_STAGING = "https://acme-staging-v02.api.letsencrypt.org/directory"
     URL_PROD = "https://acme-v02.api.letsencrypt.org/directory"
+    MAX_RETRY_ATTEMPTS = 2
 
     def __init__(self, account_key: Key, url=URL_STAGING):
         self.account_key: Key = account_key
@@ -118,7 +119,7 @@ class Acme:
 
             response = post(step, url, json=payload, headers={"Content-Type": "application/jose+json"}, throw=throw)
         except AcmeError as e:
-            if e.can_retry and depth <= 1:
+            if e.can_retry and depth <= self.MAX_RETRY_ATTEMPTS - 1:
                 time.sleep(2)
                 return self._signed_req(url, req_payload, depth + 1, step, throw)
             else:

certapi-1.1.2/src/certapi/acme/http.py

@@ -0,0 +1,69 @@
+import requests
+from .AcmeError import *
+import json as j
+import time
+
+## I don't like the fact that the http request layer
+## is doing retries internally. This has to be later refactored to be more explicit.
+NETWORK_RETRY_ATTEMPTS = 2
+NETWORK_RETRY_DELAY_SECONDS = 2
+HTTP_RETRY_ATTEMPTS = 2
+HTTP_RETRY_DELAY_SECONDS = 2
+
+
+def request(method, step: str, url: str, json=None, headers=None, throw=True) -> requests.Response:
+    res = None
+    max_attempts = max(NETWORK_RETRY_ATTEMPTS, HTTP_RETRY_ATTEMPTS)
+    for attempt in range(max_attempts + 1):
+        try:
+            res = requests.request(method, url, json=json, headers=headers, timeout=15)
+            print("Request [" + str(res.status_code) + "] : " + method + " " + url + " step=" + step)
+            if throw and 500 <= res.status_code <= 599 and attempt < HTTP_RETRY_ATTEMPTS:
+                time.sleep(HTTP_RETRY_DELAY_SECONDS)
+                continue
+            break
+        except requests.RequestException as e:
+            if attempt < NETWORK_RETRY_ATTEMPTS:
+                time.sleep(NETWORK_RETRY_DELAY_SECONDS)
+                continue
+            print("Request : " + str(method) + " " + str(url) + " step=" + str(step))
+            acme_error = AcmeNetworkError(
+                e.request,
+                f"Error communicating with ACME server",
+                {
+                    "errorType": e.__class__.__name__,
+                    "message": str(e),
+                    "method": method,
+                    "url": e.request.url if e.request else None,
+                },
+                step,
+            )
+            # Network retries are already exhausted in this layer.
+            acme_error.can_retry = False
+            raise acme_error
+    if 199 <= res.status_code > 299:
+        if json:
+            print("Request:", j.dumps(json))
+        [print(x, y) for (x, y) in res.headers.items()]
+        print("Response:", res.text)
+        json_data = None
+        try:
+            json_data = res.json()
+        except requests.RequestException as e:
+            pass
+        if json_data and json_data.get("type"):
+            errorType = json_data["type"]
+            if errorType == "urn:ietf:params:acme:error:badNonce":
+                raise AcmeInvalidNonceError(res, step=step)
+
+        if throw:
+            raise AcmeHttpError(res, step=step)
+    return res
+
+
+def post(step: str, url: str, json=None, headers=None, throw=True) -> requests.Response:
+    return request("POST", step, url, json=json, headers=headers, throw=throw)
+
+
+def get(step: str, url, headers=None, throw=True) -> requests.Response:
+    return request("GET", step, url, headers=headers, throw=throw)

{certapi-1.1.0 → certapi-1.1.2}/src/certapi/cli.py

@@ -111,7 +111,7 @@ def _ensure_port_80_available() -> None:
             sys.exit(1)
 
 
-def obtain_certificate(domains: List[str], api_key: Optional[str] = None):
+def obtain_certificate(domains: List[str], api_key: Optional[str] = None, keystore_path: str = "/etc/ssl"):
     challenge_solver = None
     server = None
 
@@ -124,7 +124,6 @@ def obtain_certificate(domains: List[str], api_key: Optional[str] = None):
         print("Starting HTTP challenge server on port 80...")
         server, _ = _start_http_challenge_server(challenge_solver, port=80)
 
-    keystore_path = "/etc/ssl"
     key_store = FileSystemKeyStore(keystore_path)
     cert_issuer = AcmeCertIssuer.with_keystore(
         key_store,
@@ -140,7 +139,8 @@ def obtain_certificate(domains: List[str], api_key: Optional[str] = None):
 
         cert_chain = certs_from_pem(cert.encode("utf-8"))
         leaf_cert = cert_chain[0] if cert_chain else None
-        expiry = leaf_cert.not_valid_after.isoformat() if leaf_cert else "unknown"
+        expiry_dt = leaf_cert.not_valid_after_utc if leaf_cert else None
+        expiry = expiry_dt.isoformat() if expiry_dt else "unknown"
 
         key_path = os.path.join(key_store.keys_dir, f"{key_name}.key")
         cert_path = os.path.join(key_store.certs_dir, f"{key_name}.crt")
@@ -219,14 +219,60 @@ def verify_environment(domains: List[str], api_key: Optional[str] = None) -> Non
 
 
 def main():
-    parser = argparse.ArgumentParser(prog="certapi")
-    subparsers = parser.add_subparsers(dest="command")
-
-    verify_parser = subparsers.add_parser("verify", help="Verify certapi installation and environment.")
-    verify_parser.add_argument("domains", nargs="*", help="Optional domain(s) to verify.")
+    class HelpFormatter(argparse.ArgumentDefaultsHelpFormatter, argparse.RawDescriptionHelpFormatter):
+        pass
+
+    parser = argparse.ArgumentParser(
+        prog="certapi",
+        formatter_class=HelpFormatter,
+        description=(
+            "Issue and verify ACME certificates.\n\n"
+            "Challenge mode selection:\n"
+            "- If CLOUDFLARE_API_KEY or CLOUDFLARE_API_TOKEN is set, DNS-01 is used.\n"
+            "- Otherwise HTTP-01 is used (requires binding to port 80)."
+        ),
+        epilog=(
+            "Cloudflare credentials are read from environment variables: "
+            "CLOUDFLARE_API_KEY or CLOUDFLARE_API_TOKEN.\n\n"
+            "Examples:\n"
+            "  certapi verify example.com\n"
+            "  certapi obtain --path ./certs example.com www.example.com\n"
+            "  CLOUDFLARE_API_TOKEN=<token> certapi obtain --path . example.com"
+        ),
+    )
+    subparsers = parser.add_subparsers(
+        dest="command",
+        title="commands",
+        metavar="{verify,obtain}",
+    )
 
-    obtain_parser = subparsers.add_parser("obtain", help="Obtain certificate for domains.")
-    obtain_parser.add_argument("domains", nargs="+", help="Domain(s) to obtain certificate for.")
+    verify_parser = subparsers.add_parser(
+        "verify",
+        help="Verify certapi installation and challenge readiness.",
+        description=(
+            "Verify environment readiness.\n"
+            "- With Cloudflare credentials: checks DNS zone ownership for provided domains.\n"
+            "- Without credentials: checks local HTTP challenge serving/routing for domains."
+        ),
+        formatter_class=HelpFormatter,
+    )
+    verify_parser.add_argument("domains", nargs="*", help="Optional domain(s) to validate.")
+
+    obtain_parser = subparsers.add_parser(
+        "obtain",
+        help="Issue a certificate for one or more domains.",
+        description=(
+            "Obtain a certificate and write key/cert files to the selected path.\n"
+            "When Cloudflare credentials are set, DNS-01 challenge is used."
+        ),
+        formatter_class=HelpFormatter,
+    )
+    obtain_parser.add_argument("domains", nargs="+", help="Domain(s) to include in the certificate.")
+    obtain_parser.add_argument(
+        "--path",
+        default="/etc/ssl",
+        help="Directory where key/cert files will be written.",
+    )
 
     args = parser.parse_args()
 
@@ -236,7 +282,7 @@ def main():
         sys.exit(0)
     elif args.command == "obtain":
         api_key = _resolve_cloudflare_api_key()
-        obtain_certificate(args.domains, api_key=api_key)
+        obtain_certificate(args.domains, api_key=api_key, keystore_path=args.path)
     else:
         parser.print_help()
         sys.exit(1)

{certapi-1.1.0 → certapi-1.1.2}/src/certapi/client/__init__.py

@@ -1 +1,2 @@
 from .cert_manager_client import CertManagerClient
+from .renewal_manager import RenewalManager

{certapi-1.1.0 → certapi-1.1.2}/src/certapi/client/cert_manager_client.py

@@ -49,6 +49,35 @@ class CertManagerClient:
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
         skip_failing: bool = True,
+        batch_domains: bool = False,
+    ) -> CertificateResponse:
+        return self.obtain(
+            hosts=hosts,
+            key_type=key_type,
+            expiry_days=expiry_days,
+            country=country,
+            state=state,
+            locality=locality,
+            organization=organization,
+            user_id=user_id,
+            renew_threshold_days=renew_threshold_days,
+            skip_failing=skip_failing,
+            batch_domains=batch_domains,
+        )
+
+    def obtain(
+        self,
+        hosts: Union[str, List[str]],
+        key_type: Literal["rsa", "ecdsa", "ed25519"] = "ecdsa",
+        expiry_days: int = 90,
+        country: Optional[str] = None,
+        state: Optional[str] = None,
+        locality: Optional[str] = None,
+        organization: Optional[str] = None,
+        user_id: Optional[str] = None,
+        renew_threshold_days: Optional[int] = None,
+        skip_failing: bool = True,
+        batch_domains: bool = False,
     ) -> CertificateResponse:
         params = {
             "hostname": hosts if isinstance(hosts, str) else hosts,
@@ -68,6 +97,7 @@ class CertManagerClient:
         if renew_threshold_days is not None:
             params["renew_threshold_days"] = renew_threshold_days
         params["skip_failing"] = skip_failing
+        params["batch_domains"] = batch_domains
 
         data = self._get("/api/obtain", params=params)
         res = CertificateResponse.from_json(data)