certapi 1.1.2__tar.gz → 1.1.4__tar.gz

{certapi-1.1.2/src/certapi.egg-info → certapi-1.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.2
+Version: 1.1.4
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.2 → certapi-1.1.4}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="1.1.2",
+    version="1.1.4",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-1.1.2 → certapi-1.1.4}/src/certapi/client/cert_manager_client.py

@@ -50,6 +50,7 @@ class CertManagerClient:
         renew_threshold_days: Optional[int] = None,
         skip_failing: bool = True,
         batch_domains: bool = False,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         return self.obtain(
             hosts=hosts,
@@ -63,6 +64,7 @@ class CertManagerClient:
             renew_threshold_days=renew_threshold_days,
             skip_failing=skip_failing,
             batch_domains=batch_domains,
+            self_verify=self_verify,
         )
 
     def obtain(
@@ -78,6 +80,7 @@ class CertManagerClient:
         renew_threshold_days: Optional[int] = None,
         skip_failing: bool = True,
         batch_domains: bool = False,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         params = {
             "hostname": hosts if isinstance(hosts, str) else hosts,
@@ -98,6 +101,7 @@ class CertManagerClient:
             params["renew_threshold_days"] = renew_threshold_days
         params["skip_failing"] = skip_failing
         params["batch_domains"] = batch_domains
+        params["self_verify"] = self_verify
 
         data = self._get("/api/obtain", params=params)
         res = CertificateResponse.from_json(data)

{certapi-1.1.2 → certapi-1.1.4}/src/certapi/client/renewal_manager.py

@@ -2,7 +2,7 @@ import os
 import threading
 import time
 from datetime import datetime, timezone, timedelta
-from typing import Callable, Dict, Optional, Set, Any, List
+from typing import Callable, Dict, Optional, Set, Any, List, Literal
 
 from certapi.crypto import Key, certs_from_pem
 from certapi.client.cert_manager_client import CertManagerClient
@@ -42,9 +42,27 @@ class RenewalManager:
         remote_poll_interval_seconds: int = 30,
         clock_fn: Optional[Callable[[], datetime]] = None,
         sleep_fn: Optional[Callable[[float], None]] = None,
+        key_type: Literal["rsa", "ecdsa", "ed25519"] = "ecdsa",
+        expiry_days: int = 90,
+        batch_domains: bool = False,
+        self_verify: bool = True,
+        country: Optional[str] = None,
+        state: Optional[str] = None,
+        locality: Optional[str] = None,
+        organization: Optional[str] = None,
+        user_id: Optional[str] = None,
     ):
         self.cert_manager_client = cert_manager_client
         self.sync_watch_domains = sync_watch_domains
+        self.key_type = key_type
+        self.expiry_days = expiry_days
+        self.batch_domains = batch_domains
+        self.self_verify = self_verify
+        self.country = country
+        self.state = state
+        self.locality = locality
+        self.organization = organization
+        self.user_id = user_id
         self.sleep_slack_seconds = sleep_slack_seconds
         self.max_sleep_seconds = max_sleep_seconds
         self.renew_retry_interval_seconds = renew_retry_interval_seconds
@@ -293,20 +311,24 @@ class RenewalManager:
 
         try:
             renew_threshold_days = self.cert_min_renew_threshold_secs // (24 * 3600)
-            obtain_fn = getattr(self.cert_manager_client, "obtain", None)
-            if callable(obtain_fn):
-                res = self._call_certificate_backend(
-                    obtain_fn,
-                    [domain],
-                    {"renew_threshold_days": renew_threshold_days, "skip_failing": False},
-                )
-            else:
-                # Backward compatibility for clients that only implement issue_certificate.
-                res = self._call_certificate_backend(
-                    self.cert_manager_client.issue_certificate,
-                    [domain],
-                    {"renew_threshold_days": renew_threshold_days},
-                )
+            obtain_options = {
+                "key_type": self.key_type,
+                "expiry_days": self.expiry_days,
+                "renew_threshold_days": renew_threshold_days,
+                "skip_failing": False,
+                "batch_domains": self.batch_domains,
+                "self_verify": self.self_verify,
+                "country": self.country,
+                "state": self.state,
+                "locality": self.locality,
+                "organization": self.organization,
+                "user_id": self.user_id,
+            }
+            res = self._call_certificate_backend(
+                self.cert_manager_client.obtain,
+                [domain],
+                obtain_options,
+            )
             if res is None:
                 return
             self._update_expiry_cache(res.issued + res.existing)

{certapi-1.1.2 → certapi-1.1.4}/src/certapi/manager/acme_cert_manager.py

@@ -75,6 +75,9 @@ class AcmeCertManager:
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
+        skip_failing: bool = True,
+        batch_domains: bool = False,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         return self.obtain(
             hosts=hosts,
@@ -86,6 +89,9 @@ class AcmeCertManager:
             organization=organization,
             user_id=user_id,
             renew_threshold_days=renew_threshold_days,
+            skip_failing=skip_failing,
+            batch_domains=batch_domains,
+            self_verify=self_verify,
         )
 
     def obtain(
@@ -99,6 +105,9 @@ class AcmeCertManager:
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
+        skip_failing: bool = True,
+        batch_domains: bool = False,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         return self._issue_certificate_internal(
             hosts=hosts,
@@ -110,7 +119,9 @@ class AcmeCertManager:
             organization=organization,
             user_id=user_id,
             renew_threshold_days=renew_threshold_days,
-            batch_generator=None,
+            batch_generator=create_safe_domain_batches if batch_domains else None,
+            skip_failing=skip_failing,
+            self_verify=self_verify,
         )
 
     def issue_certificate_in_batches(
@@ -125,6 +136,8 @@ class AcmeCertManager:
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
         batch_generator: Callable[[List[str]], List[List[str]]] = create_safe_domain_batches,
+        skip_failing: bool = True,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         return self._issue_certificate_internal(
             hosts=hosts,
@@ -137,6 +150,8 @@ class AcmeCertManager:
             user_id=user_id,
             renew_threshold_days=renew_threshold_days,
             batch_generator=batch_generator,
+            skip_failing=skip_failing,
+            self_verify=self_verify,
         )
 
     def _issue_certificate_internal(
@@ -151,6 +166,8 @@ class AcmeCertManager:
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
         batch_generator: Optional[Callable[[List[str]], List[List[str]]]] = None,
+        skip_failing: bool = True,
+        self_verify: bool = True,
     ) -> CertificateResponse:
         if isinstance(hosts, str):
             hosts = [hosts]
@@ -174,7 +191,12 @@ class AcmeCertManager:
             for host in missing:
                 found_store = None
                 for store in self.challenge_solvers:
-                    if store.supports_domain(host):
+                    supports_domain = (
+                        store.supports_domain_strict(host)
+                        if self_verify and hasattr(store, "supports_domain_strict")
+                        else store.supports_domain(host)
+                    )
+                    if supports_domain:
                         found_store = store
                         break
                 if found_store is not None:
@@ -184,6 +206,9 @@ class AcmeCertManager:
                 else:
                     print(f"Warning: No challenge solver found that supports domain: {host}. Skipping.")
 
+            if len(domains_by_store) == 0 and not skip_failing:
+                raise ValueError("None of the domains are owned by this machine or could be verified")
+
             for store, domains_to_issue in domains_by_store.items():
                 issuance_batches = (
                     batch_generator(domains_to_issue) if batch_generator is not None else [domains_to_issue]

{certapi-1.1.2 → certapi-1.1.4}/src/certapi/server/api.py

@@ -103,6 +103,12 @@ def create_api_resources(api_ns, cert_manager: AcmeCertManager, renew_queue_size
         default=False,
         help="Issue certificates in separate safe batches instead of one combined order",
     )
+    obtain_parser.add_argument(
+        "self_verify",
+        type=inputs.boolean,
+        default=True,
+        help="Verify local challenge reachability/ownership before attempting issuance",
+    )
 
     @api_ns.route("/obtain")
     class ObtainCert(Resource):
@@ -116,40 +122,25 @@ def create_api_resources(api_ns, cert_manager: AcmeCertManager, renew_queue_size
         def get(self):
             args = obtain_parser.parse_args()
             hostnames = args["hostname"]
-            skip_failing = args.get("skip_failing", False)
 
             with lock_manager:
-                verified_hostnames = []
-                for h in hostnames:
-                    # Find the first solver that supports this domain
-                    for solver in reversed(cert_manager.challenge_solvers):
-                        if solver.supports_domain_strict(h):
-                            verified_hostnames.append(h)
-
-                hostnames = verified_hostnames
-
-                if not hostnames and not skip_failing:
-                    api_ns.abort(400, message="None of the domains are owned by this machine or could be verified")
-
-                if not hostnames:
-                    return CertificateResponse().to_json()
-
-                issue_fn = (
-                    cert_manager.issue_certificate_in_batches
-                    if args.get("batch_domains")
-                    else cert_manager.issue_certificate
-                )
-                data = issue_fn(
-                    hostnames,
-                    key_type=args["key_type"],
-                    expiry_days=args["expiry_days"],
-                    country=args["country"],
-                    state=args["state"],
-                    locality=args["locality"],
-                    organization=args["organization"],
-                    user_id=args["user_id"],
-                    renew_threshold_days=args.get("renew_threshold_days"),
-                )
+                try:
+                    data = cert_manager.obtain(
+                        hostnames,
+                        key_type=args["key_type"],
+                        expiry_days=args["expiry_days"],
+                        country=args["country"],
+                        state=args["state"],
+                        locality=args["locality"],
+                        organization=args["organization"],
+                        user_id=args["user_id"],
+                        renew_threshold_days=args.get("renew_threshold_days"),
+                        skip_failing=args.get("skip_failing", False),
+                        batch_domains=args.get("batch_domains", False),
+                        self_verify=args.get("self_verify", True),
+                    )
+                except ValueError as e:
+                    api_ns.abort(400, message=str(e))
 
                 print(data)
                 if data:

{certapi-1.1.2 → certapi-1.1.4/src/certapi.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.2
+Version: 1.1.4
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.2 → certapi-1.1.4}/tests/test_acme_cert_manager_batching.py

@@ -22,6 +22,9 @@ class DummySolver:
     def supports_domain(self, _domain):
         return True
 
+    def supports_domain_strict(self, _domain):
+        return True
+
 
 class DummyIssuer:
     def __init__(self):
@@ -93,3 +96,74 @@ def test_issue_certificate_in_batches_uses_custom_batch_generator():
     ]
     assert len(response.issued) == 3
     assert [issued.domains for issued in response.issued] == issuer.calls
+
+
+def test_obtain_batch_domains_uses_safe_batches():
+    key_store = DummyKeyStore()
+    issuer = DummyIssuer()
+    solver = DummySolver()
+    manager = AcmeCertManager(key_store=key_store, cert_issuer=issuer, challenge_solvers=[solver])
+
+    domains = [
+        "x.abc.def.ghi.example.com",
+        "root.example.com",
+    ]
+    response = manager.obtain(hosts=domains, batch_domains=True)
+
+    assert issuer.calls == [
+        ["root.example.com"],
+        ["x.abc.def"],
+        ["ghi.example.com"],
+    ]
+    assert len(response.issued) == 3
+
+
+def test_issue_certificate_self_verify_false_skips_strict_solver_check():
+    class StrictFailingSolver(DummySolver):
+        def supports_domain_strict(self, _domain):
+            return False
+
+    key_store = DummyKeyStore()
+    issuer = DummyIssuer()
+    solver = StrictFailingSolver()
+    manager = AcmeCertManager(key_store=key_store, cert_issuer=issuer, challenge_solvers=[solver])
+
+    manager.issue_certificate(hosts=["force.example.com"], self_verify=False)
+
+    assert issuer.calls == [["force.example.com"]]
+
+
+def test_issue_certificate_self_verify_true_uses_strict_solver_check():
+    class StrictFailingSolver(DummySolver):
+        def supports_domain_strict(self, _domain):
+            return False
+
+    key_store = DummyKeyStore()
+    issuer = DummyIssuer()
+    solver = StrictFailingSolver()
+    manager = AcmeCertManager(key_store=key_store, cert_issuer=issuer, challenge_solvers=[solver])
+
+    response = manager.issue_certificate(hosts=["force.example.com"])
+
+    assert issuer.calls == []
+    assert response.issued == []
+
+
+def test_obtain_self_verify_true_raises_when_all_domains_fail_and_skip_failing_false():
+    class StrictFailingSolver(DummySolver):
+        def supports_domain_strict(self, _domain):
+            return False
+
+    key_store = DummyKeyStore()
+    issuer = DummyIssuer()
+    solver = StrictFailingSolver()
+    manager = AcmeCertManager(key_store=key_store, cert_issuer=issuer, challenge_solvers=[solver])
+
+    try:
+        manager.obtain(hosts=["force.example.com"], skip_failing=False)
+    except ValueError as e:
+        assert "None of the domains are owned" in str(e)
+    else:
+        raise AssertionError("expected strict obtain failure")
+
+    assert issuer.calls == []

{certapi-1.1.2 → certapi-1.1.4}/tests/test_obtain_interface.py

@@ -1,8 +1,13 @@
 from unittest.mock import Mock
 
+from flask import Flask
+from flask_restx import Api, Namespace
+
 from certapi.client.cert_manager_client import CertManagerClient
+from certapi.domain_batching import create_safe_domain_batches
 from certapi.http.types import CertificateResponse
 from certapi.manager.acme_cert_manager import AcmeCertManager
+from certapi.server.api import create_api_resources
 
 
 def test_acme_cert_manager_issue_certificate_delegates_to_obtain(monkeypatch):
@@ -25,6 +30,9 @@ def test_acme_cert_manager_issue_certificate_delegates_to_obtain(monkeypatch):
         organization="Org",
         user_id="u1",
         renew_threshold_days=25,
+        skip_failing=False,
+        batch_domains=True,
+        self_verify=False,
     )
 
     assert res is expected
@@ -37,6 +45,9 @@ def test_acme_cert_manager_issue_certificate_delegates_to_obtain(monkeypatch):
     assert captured["organization"] == "Org"
     assert captured["user_id"] == "u1"
     assert captured["renew_threshold_days"] == 25
+    assert captured["skip_failing"] is False
+    assert captured["batch_domains"] is True
+    assert captured["self_verify"] is False
 
 
 def test_acme_cert_manager_obtain_uses_internal_issue_path(monkeypatch):
@@ -54,6 +65,9 @@ def test_acme_cert_manager_obtain_uses_internal_issue_path(monkeypatch):
         key_type="ecdsa",
         expiry_days=90,
         renew_threshold_days=30,
+        skip_failing=False,
+        batch_domains=True,
+        self_verify=False,
     )
 
     assert res is expected
@@ -61,7 +75,9 @@ def test_acme_cert_manager_obtain_uses_internal_issue_path(monkeypatch):
     assert captured["key_type"] == "ecdsa"
     assert captured["expiry_days"] == 90
     assert captured["renew_threshold_days"] == 30
-    assert captured["batch_generator"] is None
+    assert captured["batch_generator"] is create_safe_domain_batches
+    assert captured["skip_failing"] is False
+    assert captured["self_verify"] is False
 
 
 def test_cert_manager_client_issue_certificate_delegates_to_obtain(monkeypatch):
@@ -86,6 +102,7 @@ def test_cert_manager_client_issue_certificate_delegates_to_obtain(monkeypatch):
         renew_threshold_days=15,
         skip_failing=False,
         batch_domains=True,
+        self_verify=False,
     )
 
     assert res is expected
@@ -100,6 +117,7 @@ def test_cert_manager_client_issue_certificate_delegates_to_obtain(monkeypatch):
     assert captured["renew_threshold_days"] == 15
     assert captured["skip_failing"] is False
     assert captured["batch_domains"] is True
+    assert captured["self_verify"] is False
 
 
 def test_cert_manager_client_obtain_calls_api_obtain(monkeypatch):
@@ -118,6 +136,7 @@ def test_cert_manager_client_obtain_calls_api_obtain(monkeypatch):
         renew_threshold_days=12,
         skip_failing=False,
         batch_domains=True,
+        self_verify=False,
     )
 
     assert isinstance(res, CertificateResponse)
@@ -127,3 +146,59 @@ def test_cert_manager_client_obtain_calls_api_obtain(monkeypatch):
     assert captured["params"]["renew_threshold_days"] == 12
     assert captured["params"]["skip_failing"] is False
     assert captured["params"]["batch_domains"] is True
+    assert captured["params"]["self_verify"] is False
+
+
+def test_remote_obtain_self_verify_false_skips_server_prefilter():
+    app = Flask(__name__)
+    api = Api(app)
+    api_ns = Namespace("api")
+    api.add_namespace(api_ns)
+
+    class Solver:
+        def supports_domain_strict(self, _domain):
+            return False
+
+    class Manager:
+        challenge_solvers = [Solver()]
+
+        def __init__(self):
+            self.calls = []
+
+        def obtain(self, hosts, **kwargs):
+            self.calls.append({"hosts": hosts, "kwargs": kwargs})
+            return CertificateResponse()
+
+    manager = Manager()
+    create_api_resources(api_ns, manager)
+
+    response = app.test_client().get("/api/obtain?hostname=force.example.com&self_verify=false")
+
+    assert response.status_code == 200
+    assert manager.calls[0]["hosts"] == ["force.example.com"]
+    assert manager.calls[0]["kwargs"]["self_verify"] is False
+
+
+def test_remote_obtain_self_verify_true_delegates_strict_failure_to_manager():
+    app = Flask(__name__)
+    api = Api(app)
+    api_ns = Namespace("api")
+    api.add_namespace(api_ns)
+
+    class Solver:
+        def supports_domain_strict(self, _domain):
+            return False
+
+    class Manager:
+        challenge_solvers = [Solver()]
+
+        def obtain(self, hosts, **kwargs):
+            assert hosts == ["force.example.com"]
+            assert kwargs["self_verify"] is True
+            raise ValueError("None of the domains are owned by this machine or could be verified")
+
+    create_api_resources(api_ns, Manager())
+
+    response = app.test_client().get("/api/obtain?hostname=force.example.com")
+
+    assert response.status_code == 400

{certapi-1.1.2 → certapi-1.1.4}/tests/test_renewal_manager.py

@@ -23,7 +23,7 @@ class DummyClient:
     def set_handler(self, domain, handler):
         self._handlers[domain] = handler
 
-    def issue_certificate(self, hosts, **kwargs):
+    def obtain(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
         self.calls.append({"host": host, "kwargs": kwargs})
         handler = self._handlers.get(host)
@@ -35,6 +35,9 @@ class DummyClient:
             return handler(host, kwargs)
         return handler
 
+    def issue_certificate(self, hosts, **kwargs):
+        return self.obtain(hosts, **kwargs)
+
 
 class DummyClientWithObtain(DummyClient):
     def __init__(self):
@@ -45,12 +48,12 @@ class DummyClientWithObtain(DummyClient):
     def obtain(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
         self.obtain_calls.append({"host": host, "kwargs": kwargs})
-        return super().issue_certificate(hosts, **kwargs)
+        return super().obtain(hosts, **kwargs)
 
     def issue_certificate(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
         self.issue_calls.append({"host": host, "kwargs": kwargs})
-        return super().issue_certificate(hosts, **kwargs)
+        return super().obtain(hosts, **kwargs)
 
 
 class DummyRemoteClient(CertManagerClient):
@@ -408,6 +411,34 @@ def test_renewal_manager_prefers_obtain_when_available():
     assert len(client.issue_calls) == 0
 
 
+def test_renewal_manager_passes_typed_obtain_options_into_renewal_calls():
+    now = datetime(2026, 1, 1, tzinfo=UTC)
+    client = DummyClient()
+    cert = _make_cert_pem("batch.example.com", now, valid_for_days=60)
+    client.set_handler(
+        "batch.example.com",
+        CertificateResponse(issued=[IssuedCert(cert=cert, domains=["batch.example.com"])], existing=[]),
+    )
+
+    mgr = RenewalManager(
+        client,
+        renew_threshold_days=30,
+        clock_fn=lambda: now,
+        batch_domains=True,
+        self_verify=False,
+        organization="certapi-tests",
+    )
+    mgr.set_watch_domains(["batch.example.com"])
+    mgr.trigger_now()
+
+    assert len(client.calls) == 1
+    assert client.calls[0]["kwargs"]["batch_domains"] is True
+    assert client.calls[0]["kwargs"]["self_verify"] is False
+    assert client.calls[0]["kwargs"]["skip_failing"] is False
+    assert client.calls[0]["kwargs"]["renew_threshold_days"] == 30
+    assert client.calls[0]["kwargs"]["organization"] == "certapi-tests"
+
+
 def test_local_keystore_seed_prevents_remote_call_when_fresh():
     now = datetime(2026, 1, 1, tzinfo=UTC)
     key = Key.generate("ecdsa")