certapi 1.1.3__tar.gz → 1.1.4__tar.gz

{certapi-1.1.3/src/certapi.egg-info → certapi-1.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.3
+Version: 1.1.4
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.3 → certapi-1.1.4}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="1.1.3",
+    version="1.1.4",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-1.1.3 → certapi-1.1.4}/src/certapi/client/renewal_manager.py

@@ -2,7 +2,7 @@ import os
 import threading
 import time
 from datetime import datetime, timezone, timedelta
-from typing import Callable, Dict, Optional, Set, Any, List
+from typing import Callable, Dict, Optional, Set, Any, List, Literal
 
 from certapi.crypto import Key, certs_from_pem
 from certapi.client.cert_manager_client import CertManagerClient
@@ -42,9 +42,27 @@ class RenewalManager:
         remote_poll_interval_seconds: int = 30,
         clock_fn: Optional[Callable[[], datetime]] = None,
         sleep_fn: Optional[Callable[[float], None]] = None,
+        key_type: Literal["rsa", "ecdsa", "ed25519"] = "ecdsa",
+        expiry_days: int = 90,
+        batch_domains: bool = False,
+        self_verify: bool = True,
+        country: Optional[str] = None,
+        state: Optional[str] = None,
+        locality: Optional[str] = None,
+        organization: Optional[str] = None,
+        user_id: Optional[str] = None,
     ):
         self.cert_manager_client = cert_manager_client
         self.sync_watch_domains = sync_watch_domains
+        self.key_type = key_type
+        self.expiry_days = expiry_days
+        self.batch_domains = batch_domains
+        self.self_verify = self_verify
+        self.country = country
+        self.state = state
+        self.locality = locality
+        self.organization = organization
+        self.user_id = user_id
         self.sleep_slack_seconds = sleep_slack_seconds
         self.max_sleep_seconds = max_sleep_seconds
         self.renew_retry_interval_seconds = renew_retry_interval_seconds
@@ -293,20 +311,24 @@ class RenewalManager:
 
         try:
             renew_threshold_days = self.cert_min_renew_threshold_secs // (24 * 3600)
-            obtain_fn = getattr(self.cert_manager_client, "obtain", None)
-            if callable(obtain_fn):
-                res = self._call_certificate_backend(
-                    obtain_fn,
-                    [domain],
-                    {"renew_threshold_days": renew_threshold_days, "skip_failing": False},
-                )
-            else:
-                # Backward compatibility for clients that only implement issue_certificate.
-                res = self._call_certificate_backend(
-                    self.cert_manager_client.issue_certificate,
-                    [domain],
-                    {"renew_threshold_days": renew_threshold_days},
-                )
+            obtain_options = {
+                "key_type": self.key_type,
+                "expiry_days": self.expiry_days,
+                "renew_threshold_days": renew_threshold_days,
+                "skip_failing": False,
+                "batch_domains": self.batch_domains,
+                "self_verify": self.self_verify,
+                "country": self.country,
+                "state": self.state,
+                "locality": self.locality,
+                "organization": self.organization,
+                "user_id": self.user_id,
+            }
+            res = self._call_certificate_backend(
+                self.cert_manager_client.obtain,
+                [domain],
+                obtain_options,
+            )
             if res is None:
                 return
             self._update_expiry_cache(res.issued + res.existing)

{certapi-1.1.3 → certapi-1.1.4}/src/certapi/manager/acme_cert_manager.py

@@ -75,6 +75,8 @@ class AcmeCertManager:
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
+        skip_failing: bool = True,
+        batch_domains: bool = False,
         self_verify: bool = True,
     ) -> CertificateResponse:
         return self.obtain(
@@ -87,6 +89,8 @@ class AcmeCertManager:
             organization=organization,
             user_id=user_id,
             renew_threshold_days=renew_threshold_days,
+            skip_failing=skip_failing,
+            batch_domains=batch_domains,
             self_verify=self_verify,
         )
 
@@ -101,6 +105,8 @@ class AcmeCertManager:
         organization: Optional[str] = None,
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
+        skip_failing: bool = True,
+        batch_domains: bool = False,
         self_verify: bool = True,
     ) -> CertificateResponse:
         return self._issue_certificate_internal(
@@ -113,7 +119,8 @@ class AcmeCertManager:
             organization=organization,
             user_id=user_id,
             renew_threshold_days=renew_threshold_days,
-            batch_generator=None,
+            batch_generator=create_safe_domain_batches if batch_domains else None,
+            skip_failing=skip_failing,
             self_verify=self_verify,
         )
 
@@ -129,6 +136,7 @@ class AcmeCertManager:
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
         batch_generator: Callable[[List[str]], List[List[str]]] = create_safe_domain_batches,
+        skip_failing: bool = True,
         self_verify: bool = True,
     ) -> CertificateResponse:
         return self._issue_certificate_internal(
@@ -142,6 +150,7 @@ class AcmeCertManager:
             user_id=user_id,
             renew_threshold_days=renew_threshold_days,
             batch_generator=batch_generator,
+            skip_failing=skip_failing,
             self_verify=self_verify,
         )
 
@@ -157,6 +166,7 @@ class AcmeCertManager:
         user_id: Optional[str] = None,
         renew_threshold_days: Optional[int] = None,
         batch_generator: Optional[Callable[[List[str]], List[List[str]]]] = None,
+        skip_failing: bool = True,
         self_verify: bool = True,
     ) -> CertificateResponse:
         if isinstance(hosts, str):
@@ -196,6 +206,9 @@ class AcmeCertManager:
                 else:
                     print(f"Warning: No challenge solver found that supports domain: {host}. Skipping.")
 
+            if len(domains_by_store) == 0 and not skip_failing:
+                raise ValueError("None of the domains are owned by this machine or could be verified")
+
             for store, domains_to_issue in domains_by_store.items():
                 issuance_batches = (
                     batch_generator(domains_to_issue) if batch_generator is not None else [domains_to_issue]

{certapi-1.1.3 → certapi-1.1.4}/src/certapi/server/api.py

@@ -122,43 +122,25 @@ def create_api_resources(api_ns, cert_manager: AcmeCertManager, renew_queue_size
         def get(self):
             args = obtain_parser.parse_args()
             hostnames = args["hostname"]
-            skip_failing = args.get("skip_failing", False)
-            self_verify = args.get("self_verify", True)
 
             with lock_manager:
-                if self_verify:
-                    verified_hostnames = []
-                    for h in hostnames:
-                        # Find the first solver that supports and can verify this domain.
-                        for solver in reversed(cert_manager.challenge_solvers):
-                            if solver.supports_domain_strict(h):
-                                verified_hostnames.append(h)
-
-                    hostnames = verified_hostnames
-
-                if not hostnames and not skip_failing:
-                    api_ns.abort(400, message="None of the domains are owned by this machine or could be verified")
-
-                if not hostnames:
-                    return CertificateResponse().to_json()
-
-                issue_fn = (
-                    cert_manager.issue_certificate_in_batches
-                    if args.get("batch_domains")
-                    else cert_manager.issue_certificate
-                )
-                data = issue_fn(
-                    hostnames,
-                    key_type=args["key_type"],
-                    expiry_days=args["expiry_days"],
-                    country=args["country"],
-                    state=args["state"],
-                    locality=args["locality"],
-                    organization=args["organization"],
-                    user_id=args["user_id"],
-                    renew_threshold_days=args.get("renew_threshold_days"),
-                    self_verify=False,
-                )
+                try:
+                    data = cert_manager.obtain(
+                        hostnames,
+                        key_type=args["key_type"],
+                        expiry_days=args["expiry_days"],
+                        country=args["country"],
+                        state=args["state"],
+                        locality=args["locality"],
+                        organization=args["organization"],
+                        user_id=args["user_id"],
+                        renew_threshold_days=args.get("renew_threshold_days"),
+                        skip_failing=args.get("skip_failing", False),
+                        batch_domains=args.get("batch_domains", False),
+                        self_verify=args.get("self_verify", True),
+                    )
+                except ValueError as e:
+                    api_ns.abort(400, message=str(e))
 
                 print(data)
                 if data:

{certapi-1.1.3 → certapi-1.1.4/src/certapi.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.3
+Version: 1.1.4
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.3 → certapi-1.1.4}/tests/test_acme_cert_manager_batching.py

@@ -98,6 +98,26 @@ def test_issue_certificate_in_batches_uses_custom_batch_generator():
     assert [issued.domains for issued in response.issued] == issuer.calls
 
 
+def test_obtain_batch_domains_uses_safe_batches():
+    key_store = DummyKeyStore()
+    issuer = DummyIssuer()
+    solver = DummySolver()
+    manager = AcmeCertManager(key_store=key_store, cert_issuer=issuer, challenge_solvers=[solver])
+
+    domains = [
+        "x.abc.def.ghi.example.com",
+        "root.example.com",
+    ]
+    response = manager.obtain(hosts=domains, batch_domains=True)
+
+    assert issuer.calls == [
+        ["root.example.com"],
+        ["x.abc.def"],
+        ["ghi.example.com"],
+    ]
+    assert len(response.issued) == 3
+
+
 def test_issue_certificate_self_verify_false_skips_strict_solver_check():
     class StrictFailingSolver(DummySolver):
         def supports_domain_strict(self, _domain):
@@ -127,3 +147,23 @@ def test_issue_certificate_self_verify_true_uses_strict_solver_check():
 
     assert issuer.calls == []
     assert response.issued == []
+
+
+def test_obtain_self_verify_true_raises_when_all_domains_fail_and_skip_failing_false():
+    class StrictFailingSolver(DummySolver):
+        def supports_domain_strict(self, _domain):
+            return False
+
+    key_store = DummyKeyStore()
+    issuer = DummyIssuer()
+    solver = StrictFailingSolver()
+    manager = AcmeCertManager(key_store=key_store, cert_issuer=issuer, challenge_solvers=[solver])
+
+    try:
+        manager.obtain(hosts=["force.example.com"], skip_failing=False)
+    except ValueError as e:
+        assert "None of the domains are owned" in str(e)
+    else:
+        raise AssertionError("expected strict obtain failure")
+
+    assert issuer.calls == []

{certapi-1.1.3 → certapi-1.1.4}/tests/test_obtain_interface.py

@@ -4,6 +4,7 @@ from flask import Flask
 from flask_restx import Api, Namespace
 
 from certapi.client.cert_manager_client import CertManagerClient
+from certapi.domain_batching import create_safe_domain_batches
 from certapi.http.types import CertificateResponse
 from certapi.manager.acme_cert_manager import AcmeCertManager
 from certapi.server.api import create_api_resources
@@ -29,6 +30,8 @@ def test_acme_cert_manager_issue_certificate_delegates_to_obtain(monkeypatch):
         organization="Org",
         user_id="u1",
         renew_threshold_days=25,
+        skip_failing=False,
+        batch_domains=True,
         self_verify=False,
     )
 
@@ -42,6 +45,8 @@ def test_acme_cert_manager_issue_certificate_delegates_to_obtain(monkeypatch):
     assert captured["organization"] == "Org"
     assert captured["user_id"] == "u1"
     assert captured["renew_threshold_days"] == 25
+    assert captured["skip_failing"] is False
+    assert captured["batch_domains"] is True
     assert captured["self_verify"] is False
 
 
@@ -60,6 +65,8 @@ def test_acme_cert_manager_obtain_uses_internal_issue_path(monkeypatch):
         key_type="ecdsa",
         expiry_days=90,
         renew_threshold_days=30,
+        skip_failing=False,
+        batch_domains=True,
         self_verify=False,
     )
 
@@ -68,7 +75,8 @@ def test_acme_cert_manager_obtain_uses_internal_issue_path(monkeypatch):
     assert captured["key_type"] == "ecdsa"
     assert captured["expiry_days"] == 90
     assert captured["renew_threshold_days"] == 30
-    assert captured["batch_generator"] is None
+    assert captured["batch_generator"] is create_safe_domain_batches
+    assert captured["skip_failing"] is False
     assert captured["self_verify"] is False
 
 
@@ -157,7 +165,7 @@ def test_remote_obtain_self_verify_false_skips_server_prefilter():
         def __init__(self):
             self.calls = []
 
-        def issue_certificate(self, hosts, **kwargs):
+        def obtain(self, hosts, **kwargs):
             self.calls.append({"hosts": hosts, "kwargs": kwargs})
             return CertificateResponse()
 
@@ -171,7 +179,7 @@ def test_remote_obtain_self_verify_false_skips_server_prefilter():
     assert manager.calls[0]["kwargs"]["self_verify"] is False
 
 
-def test_remote_obtain_self_verify_true_keeps_server_prefilter():
+def test_remote_obtain_self_verify_true_delegates_strict_failure_to_manager():
     app = Flask(__name__)
     api = Api(app)
     api_ns = Namespace("api")
@@ -184,8 +192,10 @@ def test_remote_obtain_self_verify_true_keeps_server_prefilter():
     class Manager:
         challenge_solvers = [Solver()]
 
-        def issue_certificate(self, hosts, **kwargs):
-            raise AssertionError("unverified host should not reach manager")
+        def obtain(self, hosts, **kwargs):
+            assert hosts == ["force.example.com"]
+            assert kwargs["self_verify"] is True
+            raise ValueError("None of the domains are owned by this machine or could be verified")
 
     create_api_resources(api_ns, Manager())
 

{certapi-1.1.3 → certapi-1.1.4}/tests/test_renewal_manager.py

@@ -23,7 +23,7 @@ class DummyClient:
     def set_handler(self, domain, handler):
         self._handlers[domain] = handler
 
-    def issue_certificate(self, hosts, **kwargs):
+    def obtain(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
         self.calls.append({"host": host, "kwargs": kwargs})
         handler = self._handlers.get(host)
@@ -35,6 +35,9 @@ class DummyClient:
             return handler(host, kwargs)
         return handler
 
+    def issue_certificate(self, hosts, **kwargs):
+        return self.obtain(hosts, **kwargs)
+
 
 class DummyClientWithObtain(DummyClient):
     def __init__(self):
@@ -45,12 +48,12 @@ class DummyClientWithObtain(DummyClient):
     def obtain(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
         self.obtain_calls.append({"host": host, "kwargs": kwargs})
-        return super().issue_certificate(hosts, **kwargs)
+        return super().obtain(hosts, **kwargs)
 
     def issue_certificate(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
         self.issue_calls.append({"host": host, "kwargs": kwargs})
-        return super().issue_certificate(hosts, **kwargs)
+        return super().obtain(hosts, **kwargs)
 
 
 class DummyRemoteClient(CertManagerClient):
@@ -408,6 +411,34 @@ def test_renewal_manager_prefers_obtain_when_available():
     assert len(client.issue_calls) == 0
 
 
+def test_renewal_manager_passes_typed_obtain_options_into_renewal_calls():
+    now = datetime(2026, 1, 1, tzinfo=UTC)
+    client = DummyClient()
+    cert = _make_cert_pem("batch.example.com", now, valid_for_days=60)
+    client.set_handler(
+        "batch.example.com",
+        CertificateResponse(issued=[IssuedCert(cert=cert, domains=["batch.example.com"])], existing=[]),
+    )
+
+    mgr = RenewalManager(
+        client,
+        renew_threshold_days=30,
+        clock_fn=lambda: now,
+        batch_domains=True,
+        self_verify=False,
+        organization="certapi-tests",
+    )
+    mgr.set_watch_domains(["batch.example.com"])
+    mgr.trigger_now()
+
+    assert len(client.calls) == 1
+    assert client.calls[0]["kwargs"]["batch_domains"] is True
+    assert client.calls[0]["kwargs"]["self_verify"] is False
+    assert client.calls[0]["kwargs"]["skip_failing"] is False
+    assert client.calls[0]["kwargs"]["renew_threshold_days"] == 30
+    assert client.calls[0]["kwargs"]["organization"] == "certapi-tests"
+
+
 def test_local_keystore_seed_prevents_remote_call_when_fresh():
     now = datetime(2026, 1, 1, tzinfo=UTC)
     key = Key.generate("ecdsa")