chia-blockchain 2.5.1rc1__py3-none-any.whl

chia/simulator/start_simulator.py

@@ -0,0 +1,143 @@
+from __future__ import annotations
+
+import logging
+import sys
+from dataclasses import dataclass
+from multiprocessing import freeze_support
+from pathlib import Path
+from typing import Any, Optional
+
+from chia.apis import ApiProtocolRegistry
+from chia.full_node.full_node import FullNode
+from chia.server.outbound_message import NodeType
+from chia.server.signal_handlers import SignalHandlers
+from chia.server.start_service import Service, async_run
+from chia.simulator.block_tools import BlockTools, test_constants
+from chia.simulator.full_node_simulator import FullNodeSimulator
+from chia.simulator.simulator_full_node_rpc_api import SimulatorFullNodeRpcApi
+from chia.types.blockchain_format.sized_bytes import bytes32
+from chia.util.bech32m import decode_puzzle_hash
+from chia.util.chia_logging import initialize_logging
+from chia.util.config import load_config, load_config_cli, override_config
+from chia.util.default_root import resolve_root_path
+from chia.util.ints import uint16
+
+SimulatorFullNodeService = Service[FullNode, FullNodeSimulator, SimulatorFullNodeRpcApi]
+
+# See: https://bugs.python.org/issue29288
+"".encode("idna")
+
+SERVICE_NAME = "full_node"
+log = logging.getLogger(__name__)
+PLOTS = 3  # 3 plots should be enough
+PLOT_SIZE = 19  # anything under k19 is a bit buggy
+
+
+async def create_full_node_simulator_service(
+    root_path: Path,
+    config: dict[str, Any],
+    bt: BlockTools,
+    connect_to_daemon: bool = True,
+    override_capabilities: Optional[list[tuple[uint16, str]]] = None,
+) -> SimulatorFullNodeService:
+    service_config = config[SERVICE_NAME]
+    constants = bt.constants
+
+    node = await FullNode.create(
+        config=service_config,
+        root_path=root_path,
+        consensus_constants=constants,
+    )
+
+    peer_api = FullNodeSimulator(node, bt, config)
+    network_id = service_config["selected_network"]
+    return Service(
+        root_path=root_path,
+        config=config,
+        node=node,
+        peer_api=peer_api,
+        node_type=NodeType.FULL_NODE,
+        advertised_port=service_config["port"],
+        service_name=SERVICE_NAME,
+        on_connect_callback=node.on_connect,
+        network_id=network_id,
+        rpc_info=(SimulatorFullNodeRpcApi, service_config["rpc_port"]),
+        connect_to_daemon=connect_to_daemon,
+        override_capabilities=override_capabilities,
+        class_for_type=ApiProtocolRegistry,
+    )
+
+
+@dataclass
+class StartedSimulator:
+    service: SimulatorFullNodeService
+    exit_code: int
+
+
+async def async_main(
+    test_mode: bool = False,
+    automated_testing: bool = False,
+    root_path: Optional[Path] = None,
+) -> StartedSimulator:
+    root_path = resolve_root_path(override=root_path)
+    # helping mypy out for now
+    assert root_path is not None
+
+    # Same as full node, but the root_path is defined above
+    config = load_config(root_path, "config.yaml")
+    service_config = load_config_cli(root_path, "config.yaml", SERVICE_NAME)
+    config[SERVICE_NAME] = service_config
+    # THIS IS Simulator specific.
+    fingerprint: Optional[int] = None
+    farming_puzzle_hash: Optional[bytes32] = None
+    plot_dir: str = "simulator/plots"
+    if "simulator" in config:
+        overrides = {}
+        plot_dir = config["simulator"].get("plot_directory", "simulator/plots")
+        if config["simulator"]["key_fingerprint"] is not None:
+            fingerprint = int(config["simulator"]["key_fingerprint"])
+        if config["simulator"]["farming_address"] is not None:
+            farming_puzzle_hash = decode_puzzle_hash(config["simulator"]["farming_address"])
+    else:  # old config format
+        overrides = {
+            "full_node.selected_network": "testnet0",
+            "full_node.database_path": service_config["simulator_database_path"],
+            "full_node.peers_file_path": service_config["simulator_peers_file_path"],
+            "full_node.introducer_peer": {"host": "127.0.0.1", "port": 58555},
+        }
+    overrides["simulator.use_current_time"] = True
+
+    # create block tools
+    bt = BlockTools(
+        test_constants,
+        root_path,
+        config_overrides=overrides,
+        automated_testing=automated_testing,
+        plot_dir=plot_dir,
+    )
+    await bt.setup_keys(fingerprint=fingerprint, reward_ph=farming_puzzle_hash)
+    await bt.setup_plots(num_og_plots=PLOTS, num_pool_plots=0, num_non_keychain_plots=0, plot_size=PLOT_SIZE)
+    # Everything after this is not simulator specific, excluding the if test_mode.
+    initialize_logging(
+        service_name=SERVICE_NAME,
+        logging_config=service_config["logging"],
+        root_path=root_path,
+    )
+    service = await create_full_node_simulator_service(root_path, override_config(config, overrides), bt)
+    if not test_mode:
+        async with SignalHandlers.manage() as signal_handlers:
+            await service.setup_process_global_state(signal_handlers=signal_handlers)
+            await service.run()
+
+    return StartedSimulator(service=service, exit_code=0)
+
+
+def main() -> int:
+    freeze_support()
+    root_path = resolve_root_path(override=None)
+
+    return async_run(async_main(root_path=root_path)).exit_code
+
+
+if __name__ == "__main__":
+    sys.exit(main())

chia/simulator/wallet_tools.py

@@ -0,0 +1,246 @@
+from __future__ import annotations
+
+from typing import Any, Optional
+
+from chia_rs import AugSchemeMPL, G1Element, G2Element, PrivateKey
+from clvm.casts import int_from_bytes, int_to_bytes
+
+from chia.consensus.constants import ConsensusConstants
+from chia.types.blockchain_format.coin import Coin
+from chia.types.blockchain_format.program import Program
+from chia.types.blockchain_format.serialized_program import SerializedProgram
+from chia.types.blockchain_format.sized_bytes import bytes32
+from chia.types.coin_spend import CoinSpend
+from chia.types.condition_opcodes import ConditionOpcode
+from chia.types.condition_with_args import ConditionWithArgs
+from chia.types.spend_bundle import SpendBundle
+from chia.util.condition_tools import agg_sig_additional_data, conditions_dict_for_solution, make_aggsig_final_message
+from chia.util.hash import std_hash
+from chia.util.ints import uint32, uint64
+from chia.wallet.conditions import AssertCoinAnnouncement
+from chia.wallet.derive_keys import master_sk_to_wallet_sk
+from chia.wallet.puzzles.p2_delegated_puzzle_or_hidden_puzzle import (
+    DEFAULT_HIDDEN_PUZZLE_HASH,
+    calculate_synthetic_secret_key,
+    puzzle_for_pk,
+    solution_for_conditions,
+)
+
+DEFAULT_SEED = b"seed" * 8
+assert len(DEFAULT_SEED) == 32
+
+
+class WalletTool:
+    next_address = 0
+    # TODO: make this a dataclass to make these instance attributes instead of mutable class attributes
+    pubkey_num_lookup: dict[bytes, uint32] = {}  # noqa: RUF012
+    puzzle_pk_cache: dict[bytes32, PrivateKey] = {}  # noqa: RUF012
+
+    def __init__(self, constants: ConsensusConstants, sk: Optional[PrivateKey] = None):
+        self.constants = constants
+        self.current_balance = 0
+        self.my_utxos: set = set()
+        if sk is not None:
+            self.private_key = sk
+        else:
+            self.private_key = AugSchemeMPL.key_gen(DEFAULT_SEED)
+        self.generator_lookups: dict = {}
+        self.puzzle_pk_cache: dict = {}
+        self.get_new_puzzle()
+
+    def get_next_address_index(self) -> uint32:
+        self.next_address = uint32(self.next_address + 1)
+        return self.next_address
+
+    def get_private_key_for_puzzle_hash(self, puzzle_hash: bytes32) -> PrivateKey:
+        sk = self.puzzle_pk_cache.get(puzzle_hash)
+        if sk:
+            return sk
+        for child in range(self.next_address):
+            pubkey = master_sk_to_wallet_sk(self.private_key, uint32(child)).get_g1()
+            if puzzle_hash == puzzle_for_pk(pubkey).get_tree_hash():
+                return master_sk_to_wallet_sk(self.private_key, uint32(child))
+        raise ValueError(f"Do not have the keys for puzzle hash {puzzle_hash}")
+
+    def puzzle_for_pk(self, pubkey: G1Element) -> Program:
+        return puzzle_for_pk(pubkey)
+
+    def get_new_puzzle(self) -> Program:
+        next_address_index: uint32 = self.get_next_address_index()
+        sk: PrivateKey = master_sk_to_wallet_sk(self.private_key, next_address_index)
+        pubkey: G1Element = sk.get_g1()
+        self.pubkey_num_lookup[bytes(pubkey)] = next_address_index
+
+        puzzle: Program = puzzle_for_pk(pubkey)
+
+        self.puzzle_pk_cache[puzzle.get_tree_hash()] = sk
+        return puzzle
+
+    def get_new_puzzlehash(self) -> bytes32:
+        puzzle = self.get_new_puzzle()
+        return puzzle.get_tree_hash()
+
+    def sign(self, value: bytes, pubkey: bytes) -> G2Element:
+        privatekey: PrivateKey = master_sk_to_wallet_sk(self.private_key, self.pubkey_num_lookup[pubkey])
+        return AugSchemeMPL.sign(privatekey, value)
+
+    def make_solution(self, condition_dic: dict[ConditionOpcode, list[ConditionWithArgs]]) -> Program:
+        ret = []
+
+        for con_list in condition_dic.values():
+            for cvp in con_list:
+                if cvp.opcode == ConditionOpcode.CREATE_COIN and len(cvp.vars) > 2:
+                    formatted: list[Any] = []
+                    formatted.extend(cvp.vars)
+                    formatted[2] = cvp.vars[2:]
+                    ret.append([cvp.opcode.value, *formatted])
+                else:
+                    ret.append([cvp.opcode.value, *cvp.vars])
+        return solution_for_conditions(Program.to(ret))
+
+    def generate_unsigned_transaction(
+        self,
+        amount: uint64,
+        new_puzzle_hash: bytes32,
+        coins: list[Coin],
+        condition_dic: dict[ConditionOpcode, list[ConditionWithArgs]],
+        fee: int = 0,
+        secret_key: Optional[PrivateKey] = None,
+        additional_outputs: Optional[list[tuple[bytes32, int]]] = None,
+        memo: Optional[bytes32] = None,
+    ) -> list[CoinSpend]:
+        spends = []
+
+        spend_value = sum(c.amount for c in coins)
+
+        if ConditionOpcode.CREATE_COIN not in condition_dic:
+            condition_dic[ConditionOpcode.CREATE_COIN] = []
+        if ConditionOpcode.CREATE_COIN_ANNOUNCEMENT not in condition_dic:
+            condition_dic[ConditionOpcode.CREATE_COIN_ANNOUNCEMENT] = []
+
+        coin_create = [new_puzzle_hash, int_to_bytes(amount)]
+        if memo is not None:
+            coin_create.append(memo)
+        output = ConditionWithArgs(ConditionOpcode.CREATE_COIN, coin_create)
+        condition_dic[output.opcode].append(output)
+        if additional_outputs is not None:
+            for o in additional_outputs:
+                out = ConditionWithArgs(ConditionOpcode.CREATE_COIN, [o[0], int_to_bytes(o[1])])
+                condition_dic[out.opcode].append(out)
+
+        amount_total = sum(int_from_bytes(cvp.vars[1]) for cvp in condition_dic[ConditionOpcode.CREATE_COIN])
+        change = spend_value - amount_total - fee
+        if change > 0:
+            change_puzzle_hash = self.get_new_puzzlehash()
+            change_output = ConditionWithArgs(ConditionOpcode.CREATE_COIN, [change_puzzle_hash, int_to_bytes(change)])
+            condition_dic[output.opcode].append(change_output)
+
+        secondary_coins_cond_dic: dict[ConditionOpcode, list[ConditionWithArgs]] = dict()
+        secondary_coins_cond_dic[ConditionOpcode.ASSERT_COIN_ANNOUNCEMENT] = []
+        for n, coin in enumerate(coins):
+            puzzle_hash = coin.puzzle_hash
+            if secret_key is None:
+                secret_key = self.get_private_key_for_puzzle_hash(puzzle_hash)
+            pubkey = secret_key.get_g1()
+            puzzle: Program = puzzle_for_pk(pubkey)
+            if n == 0:
+                message_list = [c.name() for c in coins]
+                for outputs in condition_dic[ConditionOpcode.CREATE_COIN]:
+                    coin_to_append = Coin(
+                        coin.name(), bytes32(outputs.vars[0]), uint64(int_from_bytes(outputs.vars[1]))
+                    )
+                    message_list.append(coin_to_append.name())
+                message = std_hash(b"".join(message_list))
+                condition_dic[ConditionOpcode.CREATE_COIN_ANNOUNCEMENT].append(
+                    ConditionWithArgs(ConditionOpcode.CREATE_COIN_ANNOUNCEMENT, [message])
+                )
+                primary_announcement_hash = AssertCoinAnnouncement(
+                    asserted_id=coin.name(), asserted_msg=message
+                ).msg_calc
+                secondary_coins_cond_dic[ConditionOpcode.ASSERT_COIN_ANNOUNCEMENT].append(
+                    ConditionWithArgs(ConditionOpcode.ASSERT_COIN_ANNOUNCEMENT, [primary_announcement_hash])
+                )
+                main_solution = self.make_solution(condition_dic)
+                spends.append(
+                    CoinSpend(
+                        coin, SerializedProgram.from_program(puzzle), SerializedProgram.from_program(main_solution)
+                    )
+                )
+            else:
+                spends.append(
+                    CoinSpend(
+                        coin,
+                        SerializedProgram.from_program(puzzle),
+                        SerializedProgram.from_program(self.make_solution(secondary_coins_cond_dic)),
+                    )
+                )
+        return spends
+
+    def sign_transaction(self, coin_spends: list[CoinSpend]) -> SpendBundle:
+        signatures = []
+        data = agg_sig_additional_data(self.constants.AGG_SIG_ME_ADDITIONAL_DATA)
+        agg_sig_opcodes = [
+            ConditionOpcode.AGG_SIG_PARENT,
+            ConditionOpcode.AGG_SIG_PUZZLE,
+            ConditionOpcode.AGG_SIG_AMOUNT,
+            ConditionOpcode.AGG_SIG_PUZZLE_AMOUNT,
+            ConditionOpcode.AGG_SIG_PARENT_AMOUNT,
+            ConditionOpcode.AGG_SIG_PARENT_PUZZLE,
+            ConditionOpcode.AGG_SIG_ME,
+        ]
+        for coin_spend in coin_spends:
+            secret_key = self.get_private_key_for_puzzle_hash(coin_spend.coin.puzzle_hash)
+            synthetic_secret_key = calculate_synthetic_secret_key(secret_key, DEFAULT_HIDDEN_PUZZLE_HASH)
+            conditions_dict = conditions_dict_for_solution(
+                coin_spend.puzzle_reveal, coin_spend.solution, self.constants.MAX_BLOCK_COST_CLVM
+            )
+
+            for cwa in conditions_dict.get(ConditionOpcode.AGG_SIG_UNSAFE, []):
+                msg = cwa.vars[1]
+                signature = AugSchemeMPL.sign(synthetic_secret_key, msg)
+                signatures.append(signature)
+
+            for agg_sig_opcode in agg_sig_opcodes:
+                for cwa in conditions_dict.get(agg_sig_opcode, []):
+                    msg = make_aggsig_final_message(agg_sig_opcode, cwa.vars[1], coin_spend.coin, data)
+                    signature = AugSchemeMPL.sign(synthetic_secret_key, msg)
+                    signatures.append(signature)
+
+        aggsig = AugSchemeMPL.aggregate(signatures)
+        spend_bundle = SpendBundle(coin_spends, aggsig)
+        return spend_bundle
+
+    def generate_signed_transaction(
+        self,
+        amount: uint64,
+        new_puzzle_hash: bytes32,
+        coin: Coin,
+        condition_dic: Optional[dict[ConditionOpcode, list[ConditionWithArgs]]] = None,
+        fee: int = 0,
+        additional_outputs: Optional[list[tuple[bytes32, int]]] = None,
+        memo: Optional[bytes32] = None,
+    ) -> SpendBundle:
+        if condition_dic is None:
+            condition_dic = {}
+        transaction = self.generate_unsigned_transaction(
+            amount, new_puzzle_hash, [coin], condition_dic, fee, additional_outputs=additional_outputs, memo=memo
+        )
+        assert transaction is not None
+        return self.sign_transaction(transaction)
+
+    def generate_signed_transaction_multiple_coins(
+        self,
+        amount: uint64,
+        new_puzzle_hash: bytes32,
+        coins: list[Coin],
+        condition_dic: Optional[dict[ConditionOpcode, list[ConditionWithArgs]]] = None,
+        fee: int = 0,
+        additional_outputs: Optional[list[tuple[bytes32, int]]] = None,
+    ) -> SpendBundle:
+        if condition_dic is None:
+            condition_dic = {}
+        transaction = self.generate_unsigned_transaction(
+            amount, new_puzzle_hash, coins, condition_dic, fee, additional_outputs=additional_outputs
+        )
+        assert transaction is not None
+        return self.sign_transaction(transaction)

chia/ssl/chia_ca.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDKTCCAhGgAwIBAgIUXIpxI5MoZQ65/vhc7DK/d5ymoMUwDQYJKoZIhvcNAQEL
+BQAwRDENMAsGA1UECgwEQ2hpYTEQMA4GA1UEAwwHQ2hpYSBDQTEhMB8GA1UECwwY
+T3JnYW5pYyBGYXJtaW5nIERpdmlzaW9uMB4XDTIxMDEyMzA4NTEwNloXDTMxMDEy
+MTA4NTEwNlowRDENMAsGA1UECgwEQ2hpYTEQMA4GA1UEAwwHQ2hpYSBDQTEhMB8G
+A1UECwwYT3JnYW5pYyBGYXJtaW5nIERpdmlzaW9uMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAzz/L219Zjb5CIKnUkpd2julGC+j3E97KUiuOalCH9wdq
+gpJi9nBqLccwPCSFXFew6CNBIBM+CW2jT3UVwgzjdXJ7pgtu8gWj0NQ6NqSLiXV2
+WbpZovfrVh3x7Z4bjPgI3ouWjyehUfmK1GPIld4BfUSQtPlUJ53+XT32GRizUy+b
+0CcJ84jp1XvyZAMajYnclFRNNJSw9WXtTlMUu+Z1M4K7c4ZPwEqgEnCgRc0TCaXj
+180vo7mCHJQoDiNSCRATwfH+kWxOOK/nePkq2t4mPSFaX8xAS4yILISIOWYn7sNg
+dy9D6gGNFo2SZ0FR3x9hjUjYEV3cPqg3BmNE3DDynQIDAQABoxMwETAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAEugnFQjzHhS0eeCqUwOHmP3ww
+/rXPkKF+bJ6uiQgXZl+B5W3m3zaKimJeyatmuN+5ST1gUET+boMhbA/7grXAsRsk
+SFTHG0T9CWfPiuimVmGCzoxLGpWDMJcHZncpQZ72dcy3h7mjWS+U59uyRVHeiprE
+hvSyoNSYmfvh7vplRKS1wYeA119LL5fRXvOQNW6pSsts17auu38HWQGagSIAd1UP
+5zEvDS1HgvaU1E09hlHzlpdSdNkAx7si0DMzxKHUg9oXeRZedt6kcfyEmryd52Mj
+1r1R9mf4iMIUv1zc2sHVc1omxnCw9+7U4GMWLtL5OgyJyfNyoxk3tC+D3KNU
+-----END CERTIFICATE-----

chia/ssl/chia_ca.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDPP8vbX1mNvkIg
+qdSSl3aO6UYL6PcT3spSK45qUIf3B2qCkmL2cGotxzA8JIVcV7DoI0EgEz4JbaNP
+dRXCDON1cnumC27yBaPQ1Do2pIuJdXZZulmi9+tWHfHtnhuM+Ajei5aPJ6FR+YrU
+Y8iV3gF9RJC0+VQnnf5dPfYZGLNTL5vQJwnziOnVe/JkAxqNidyUVE00lLD1Ze1O
+UxS75nUzgrtzhk/ASqAScKBFzRMJpePXzS+juYIclCgOI1IJEBPB8f6RbE44r+d4
++Sra3iY9IVpfzEBLjIgshIg5Zifuw2B3L0PqAY0WjZJnQVHfH2GNSNgRXdw+qDcG
+Y0TcMPKdAgMBAAECggEAa6lLgEl3HyAQACHZUNGoADOEdNlvyP26gpcn42i0SQqs
+NOpQyI67Sc6o6wVZ1g+j0ePGiCAW4RT4emVriSPi4Xc4bpiP6OAvKmOlXg96gUzo
+z1H0EKnTsifaLsMssr2C9gDzlKhUsF3+1biEUf5DLcz5k1nWcsIrikqO1pizR2mL
+nMuhW+kRwR6bY75pGlQ8JmqQ3BTS6YBMJ+BkZ8XOBcj9c8mvxTL4tVk4Wnc9dcd+
+dlkP1PkCM79WIF6pswW5ZDwGlU6pqk08qPzENjei/De6IBg8Lt4uJve79agV6Uxz
+Y4xfRCWMunlj4VJwUcAzGhyjcBB1ZJi9JDBvnFmaDQKBgQDrMoBJ+vDcS0+2GQtH
+k0GZ6wjhFttjqIVWFLmWgtvNO1K2+y6zwQjpFCAuAAUXXgfbVhIfFvp0HUxujjkE
+3zeCYOlS8o9ESyWoPdg8woWjkZcya/4mE2jlj1+GI4SfHMska0EHUd4aaDk1en2a
+vYKH27zD+yV+4IdyRsD0Bi93EwKBgQDhlHnODvf5QDVro+b3dsthkaP6F/s5oH/o
+eLD1jEIGAN9Yz10njyLPfzaeiNPm6LSsKVXlgCjxQIuHTU2n0BsFke4F1ib0jOK4
+o3NN4rfVRb5O9vP50THv4+VhB9806FwiB371JeOhmitCSwiYp0wZmV3WURF4e4Fr
+Cr3YlC+1jwKBgQC03BTCzvFAtbkKMp/13krn7VDaphT2wbQmybEdCGu1mhS1GNqE
+57/OW+eS9/jySyCHjdxJhAX8HDuWGE/Ia03oOFWzr0p0HcVLZqNNtdfGPEKkR18c
+MHjNbj7qi42EPUQJMWDEHDRK4jJ76UGFKI2jo1m46vueYVJGkhn2jHsbeQKBgDim
+/Ew20Col6QSmfhwKFpvjYsYtfaeEWns8zFxupCozz+PS+Dc2KGzqKwJ3pJgqOy29
+l9fybtXf+uq5DFan2hF1C80lclUaiNoMGqol1TtXr6rPNIi59AumNXY/7tuvu2vE
+bCsPH/L28ARPKdKEuYT4Umu/ol6aze7fHLymwrCbAoGAbm4vMLIy8wHYrAj5/een
+YthUYbQ+XWOrrI1dJoGiwCIXTL4iBSO1ZjkR6M7yg9Zxv0BuqA+2tZqImLXsqIq/
+g7Jtrn7LfogS3KOiVa3QAHoXegMrRf4S3DyP/GW8E27MMvqBEkdCDX53h07wvPng
+0NRspbyMaX43/tp8ZWkaZf0=
+-----END PRIVATE KEY-----

chia/ssl/create_ssl.py

@@ -0,0 +1,249 @@
+from __future__ import annotations
+
+import datetime
+import os
+from pathlib import Path
+from typing import Any, Optional
+
+import importlib_resources
+from cryptography import x509
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives.serialization import load_pem_private_key
+from cryptography.x509.oid import NameOID
+
+from chia.util.ssl_check import DEFAULT_PERMISSIONS_CERT_FILE, DEFAULT_PERMISSIONS_KEY_FILE
+
+_all_private_node_names: list[str] = [
+    "full_node",
+    "wallet",
+    "farmer",
+    "harvester",
+    "timelord",
+    "crawler",
+    "data_layer",
+    "daemon",
+]
+_all_public_node_names: list[str] = ["full_node", "wallet", "farmer", "introducer", "timelord", "data_layer"]
+
+
+def get_chia_ca_crt_key() -> tuple[Any, Any]:
+    here = importlib_resources.files(__name__.rpartition(".")[0])
+    crt = here.joinpath("chia_ca.crt").read_bytes()
+    key = here.joinpath("chia_ca.key").read_bytes()
+    return crt, key
+
+
+def get_mozilla_ca_crt() -> str:
+    mozilla_path = Path(__file__).parent.parent.parent.absolute() / "mozilla-ca/cacert.pem"
+    return str(mozilla_path)
+
+
+def write_ssl_cert_and_key(cert_path: Path, cert_data: bytes, key_path: Path, key_data: bytes, overwrite: bool = True):
+    flags = os.O_CREAT | os.O_EXCL | os.O_WRONLY
+
+    for path, data, mode in [
+        (cert_path, cert_data, DEFAULT_PERMISSIONS_CERT_FILE),
+        (key_path, key_data, DEFAULT_PERMISSIONS_KEY_FILE),
+    ]:
+        if path.exists():
+            if not overwrite:
+                continue
+
+            path.unlink()
+
+        with open(os.open(str(path), flags, mode), "wb") as f:
+            f.write(data)  # lgtm [py/clear-text-storage-sensitive-data]
+
+
+def ensure_ssl_dirs(dirs: list[Path]):
+    """Create SSL dirs with a default 755 mode if necessary"""
+    for dir in dirs:
+        if not dir.exists():
+            dir.mkdir(mode=0o755, parents=True)
+
+
+def generate_ca_signed_cert(ca_crt: bytes, ca_key: bytes, cert_out: Path, key_out: Path):
+    one_day = datetime.timedelta(1, 0, 0)
+    root_cert = x509.load_pem_x509_certificate(ca_crt, default_backend())
+    root_key = load_pem_private_key(ca_key, None, default_backend())
+
+    cert_key = rsa.generate_private_key(public_exponent=65537, key_size=2048, backend=default_backend())
+    new_subject = x509.Name(
+        [
+            x509.NameAttribute(NameOID.COMMON_NAME, "Chia"),
+            x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Chia"),
+            x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, "Organic Farming Division"),
+        ]
+    )
+
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(new_subject)
+        .issuer_name(root_cert.issuer)
+        .public_key(cert_key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(datetime.datetime.today() - one_day)
+        .not_valid_after(datetime.datetime(2100, 8, 2))
+        .add_extension(
+            x509.SubjectAlternativeName([x509.DNSName("chia.net")]),
+            critical=False,
+        )
+        .sign(root_key, hashes.SHA256(), default_backend())
+    )
+
+    cert_pem = cert.public_bytes(encoding=serialization.Encoding.PEM)
+    key_pem = cert_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+
+    write_ssl_cert_and_key(cert_out, cert_pem, key_out, key_pem)
+
+
+def make_ca_cert(cert_path: Path, key_path: Path):
+    root_key = rsa.generate_private_key(public_exponent=65537, key_size=2048, backend=default_backend())
+    subject = issuer = x509.Name(
+        [
+            x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Chia"),
+            x509.NameAttribute(NameOID.COMMON_NAME, "Chia CA"),
+            x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, "Organic Farming Division"),
+        ]
+    )
+    root_cert = (
+        x509.CertificateBuilder()
+        .subject_name(subject)
+        .issuer_name(issuer)
+        .public_key(root_key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(datetime.datetime.now(datetime.timezone.utc))
+        .not_valid_after(datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=3650))
+        .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+        .sign(root_key, hashes.SHA256(), default_backend())
+    )
+
+    cert_pem = root_cert.public_bytes(encoding=serialization.Encoding.PEM)
+    key_pem = root_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+
+    write_ssl_cert_and_key(cert_path, cert_pem, key_path, key_pem)
+
+
+def create_all_ssl(
+    root_path: Path,
+    *,
+    private_ca_crt_and_key: Optional[tuple[bytes, bytes]] = None,
+    node_certs_and_keys: Optional[dict[str, dict]] = None,
+    private_node_names: list[str] = _all_private_node_names,
+    public_node_names: list[str] = _all_public_node_names,
+    overwrite: bool = True,
+):
+    # remove old key and crt
+    config_dir = root_path / "config"
+    old_key_path = config_dir / "trusted.key"
+    old_crt_path = config_dir / "trusted.crt"
+    if old_key_path.exists():
+        print(f"Old key not needed anymore, deleting {old_key_path}")
+        os.remove(old_key_path)
+    if old_crt_path.exists():
+        print(f"Old crt not needed anymore, deleting {old_crt_path}")
+        os.remove(old_crt_path)
+
+    ssl_dir = config_dir / "ssl"
+    ca_dir = ssl_dir / "ca"
+    ensure_ssl_dirs([ssl_dir, ca_dir])
+
+    private_ca_key_path = ca_dir / "private_ca.key"
+    private_ca_crt_path = ca_dir / "private_ca.crt"
+    chia_ca_crt, chia_ca_key = get_chia_ca_crt_key()
+    chia_ca_crt_path = ca_dir / "chia_ca.crt"
+    chia_ca_key_path = ca_dir / "chia_ca.key"
+    write_ssl_cert_and_key(chia_ca_crt_path, chia_ca_crt, chia_ca_key_path, chia_ca_key, overwrite=overwrite)
+
+    # If Private CA crt/key are passed-in, write them out
+    if private_ca_crt_and_key is not None:
+        private_ca_crt, private_ca_key = private_ca_crt_and_key
+        write_ssl_cert_and_key(private_ca_crt_path, private_ca_crt, private_ca_key_path, private_ca_key)
+
+    if not private_ca_key_path.exists() or not private_ca_crt_path.exists():
+        # Create private CA
+        print(f"Can't find private CA, creating a new one in {root_path} to generate TLS certificates")
+        make_ca_cert(private_ca_crt_path, private_ca_key_path)
+        # Create private certs for each node
+        ca_key = private_ca_key_path.read_bytes()
+        ca_crt = private_ca_crt_path.read_bytes()
+        generate_ssl_for_nodes(
+            ssl_dir,
+            ca_crt,
+            ca_key,
+            prefix="private",
+            nodes=private_node_names,
+            node_certs_and_keys=node_certs_and_keys,
+            overwrite=overwrite,
+        )
+    else:
+        # This is entered when user copied over private CA
+        print(f"Found private CA in {root_path}, using it to generate TLS certificates")
+        ca_key = private_ca_key_path.read_bytes()
+        ca_crt = private_ca_crt_path.read_bytes()
+        generate_ssl_for_nodes(
+            ssl_dir,
+            ca_crt,
+            ca_key,
+            prefix="private",
+            nodes=private_node_names,
+            node_certs_and_keys=node_certs_and_keys,
+            overwrite=overwrite,
+        )
+
+    chia_ca_crt, chia_ca_key = get_chia_ca_crt_key()
+    generate_ssl_for_nodes(
+        ssl_dir,
+        chia_ca_crt,
+        chia_ca_key,
+        prefix="public",
+        nodes=public_node_names,
+        overwrite=False,
+        node_certs_and_keys=node_certs_and_keys,
+    )
+
+
+def generate_ssl_for_nodes(
+    ssl_dir: Path,
+    ca_crt: bytes,
+    ca_key: bytes,
+    *,
+    prefix: str,
+    nodes: list[str],
+    overwrite: bool = True,
+    node_certs_and_keys: Optional[dict[str, dict]] = None,
+):
+    for node_name in nodes:
+        node_dir = ssl_dir / node_name
+        ensure_ssl_dirs([node_dir])
+        key_path = node_dir / f"{prefix}_{node_name}.key"
+        crt_path = node_dir / f"{prefix}_{node_name}.crt"
+        if node_certs_and_keys is not None:
+            certs_and_keys = node_certs_and_keys.get(node_name, {}).get(prefix, {})
+            crt = certs_and_keys.get("crt", None)
+            key = certs_and_keys.get("key", None)
+            if crt is not None and key is not None:
+                write_ssl_cert_and_key(crt_path, crt, key_path, key)
+                continue
+
+        if key_path.exists() and crt_path.exists() and overwrite is False:
+            continue
+        generate_ca_signed_cert(ca_crt, ca_key, crt_path, key_path)
+
+
+def main():
+    return make_ca_cert(Path("./chia_ca.crt"), Path("./chia_ca.key"))
+
+
+if __name__ == "__main__":
+    main()