tiny-ca 0.2.1__tar.gz → 0.3.0__tar.gz

{tiny_ca-0.2.1/tiny_ca.egg-info → tiny_ca-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tiny-ca
-Version: 0.2.1
+Version: 0.3.0
 Summary: A lightweight, 100%-tested Python library for managing the full lifecycle of X.509 certificates — issuance, revocation, rotation, CRL generation, PKCS#12 export, and more.
 Author-email: Denis Shchutskyi <denisshchutskyi@gmail.com>
 License: MIT
@@ -23,11 +23,9 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cryptography>=46.0.0
 Requires-Dist: pydantic[email]>=2.12.0
-Requires-Dist: sqlalchemy>=2.0.0
+Requires-Dist: sqlalchemy[asyncio]>=2.0.0
 Provides-Extra: async
-Requires-Dist: aiofiles>=25.1.0; extra == "async"
 Requires-Dist: aiosqlite>=0.22.0; extra == "async"
-Requires-Dist: types-aiofiles>=25.1.0; extra == "async"
 Provides-Extra: postgres
 Requires-Dist: psycopg2-binary>=2.9.0; extra == "postgres"
 Provides-Extra: postgres-async
@@ -118,14 +116,16 @@ app.include_router(router, prefix="/api/v1")
 |---|---|
 | **CA bootstrap** | Self-signed root CA and intermediate (sub) CA with configurable `path_length` |
 | **Issuance** | Leaf certificates with SANs (DNS + IP), EKU (Server/Client Auth), email attribute |
-| **Lifecycle** | Revoke (RFC 5280 reasons), renew (same key), rotate (new key), hard-delete |
-| **CRL** | Build, sign, and verify Certificate Revocation Lists with configurable validity |
+| **Key algorithms** | RSA (2048+), ECDSA P-256 / P-384, Ed25519 — for the CA and for leaves |
+| **Lifecycle** | Revoke (RFC 5280 reasons), renew (same key), rotate (new key), hard-delete — every CA-signed certificate is registered, so it can always be revoked |
+| **CRL** | RFC 5280 CRLs with `CRLNumber`, AKI and per-entry reason codes; optional CRL Distribution Points / AIA in issued certificates |
+| **Validation** | Direct (`validate_cert`) or through intermediates (`validate_chain`, with `BasicConstraints` / `pathLen` checks); registry check is fail-closed |
 | **Inspection** | Structured `CertificateDetails` snapshot from any `x509.Certificate` — fully serialisable |
 | **Export** | PKCS#12 (`.p12`/`.pfx`) bundles with full CA chain |
 | **Co-signing** | Re-sign third-party certificates under your CA, preserving Subject and extensions |
 | **Chain** | Build `[leaf, ca]` fullchain ready for nginx, Apache, or Envoy |
 | **Monitoring** | List certs with filters, find expiring-soon, bulk-expire stale records |
-| **Storage** | `LocalStorage` (sync) and `AsyncLocalStorage` (async, aiofiles) with UUID-based isolation |
+| **Storage** | `LocalStorage` (sync) and `AsyncLocalStorage` (async) with UUID-based isolation, `0600` private keys and path-traversal protection |
 | **Database** | `SyncDBHandler` (SQLAlchemy) and `AsyncDBHandler` (aiosqlite) — SQLite, PostgreSQL, MySQL |
 | **API parity** | `CertLifecycleManager` and `AsyncCertLifecycleManager` are feature-identical |
 | **Serial numbers** | `SerialWithEncoding` — 160-bit RFC 5280-compliant, type-prefixed, name-encoded |
@@ -137,7 +137,7 @@ app.include_router(router, prefix="/api/v1")
 
 - **Python** 3.11 or higher
 - **Core:** `cryptography >= 46`, `sqlalchemy >= 2`, `pydantic >= 2`
-- **Async extras:** `aiofiles`, `aiosqlite`
+- **Async extras:** `aiosqlite`
 - **PostgreSQL:** `psycopg2-binary` (sync) / `asyncpg` (async)
 - **MySQL:** `pymysql` (sync) / `aiomysql` (async)
 
@@ -158,7 +158,7 @@ CertLifecycleManager / AsyncCertLifecycleManager   ← application entry-point
         │
         ├── BaseStorage (ABC)
         │       ├── LocalStorage                    ← sync filesystem (UUID-isolated)
-        │       └── AsyncLocalStorage               ← async filesystem (aiofiles)
+        │       └── AsyncLocalStorage               ← async filesystem (worker threads)
         │
         └── BaseDB (ABC)
                 ├── SyncDBHandler                   ← SQLAlchemy sync
@@ -202,7 +202,13 @@ from tiny_ca.storage.local_storage import LocalStorage
 from tiny_ca.db.sync_db_manager import SyncDBHandler
 from tiny_ca.models.certificate import CAConfig
 
-storage = LocalStorage(base_folder="./pki")
+from cryptography.hazmat.primitives.serialization import BestAvailableEncryption
+
+# Private keys are always written with mode 0600; encrypt them at rest too.
+storage = LocalStorage(
+    base_folder="./pki",
+    base_encryption_algorithm=BestAvailableEncryption(b"key-passphrase"),
+)
 db = SyncDBHandler(db_url="sqlite:///pki.db")
 mgr = CertLifecycleManager(storage=storage, db_handler=db)
 
@@ -218,10 +224,19 @@ Attach the factory so the manager can issue certificates:
 from tiny_ca.ca_factory.utils.file_loader import CAFileLoader
 from tiny_ca.ca_factory.factory import CertificateFactory
 
-loader = CAFileLoader(ca_cert_path=cert_path, ca_key_path=key_path)
-mgr.factory = CertificateFactory(loader)
+loader = CAFileLoader(ca_cert_path=cert_path, ca_key_path=key_path,
+                      ca_key_password=b"key-passphrase")
+mgr.factory = CertificateFactory(
+    loader,
+    # Optional: tell relying parties where to find the CRL / CA certificate.
+    crl_distribution_points=["http://pki.example/crl.pem"],
+    ca_issuers_urls=["http://pki.example/ca.pem"],
+)
 ```
 
+`CAConfig` / `ClientConfig` accept `key_algorithm=KeyAlgorithm.EC_P256`
+(also `EC_P384`, `ED25519`, default `RSA`) — see [Configuration Models](#configuration-models).
+
 ### 2. Issue a Leaf Certificate
 
 ```python
@@ -245,7 +260,9 @@ cert, key, csr = mgr.issue_certificate(
 ### 3. Renew a Certificate (same key)
 
 Keeps the existing public key — only validity window and serial number change.
-Use when the key has **not** been compromised.
+Use when the key has **not** been compromised.  The renewed certificate is
+stored and registered (so it can be revoked); the original is revoked with
+reason `superseded`.  The private key stays in the original folder.
 
 ```python
 renewed = mgr.renew_certificate(serial=cert.serial_number, days_valid=365)
@@ -253,7 +270,9 @@ renewed = mgr.renew_certificate(serial=cert.serial_number, days_valid=365)
 
 ### 4. Rotate a Certificate (new key)
 
-Atomically revokes the old cert and issues a replacement with a fresh key pair.
+Issues a replacement with a fresh key pair, then revokes the old cert
+(`superseded`).  If the old cert cannot be revoked, the replacement is rolled
+back and `CertRevocationError` is raised.
 
 ```python
 new_cert, new_key, new_csr = mgr.rotate_certificate(
@@ -278,6 +297,10 @@ crl = mgr.generate_crl(days_valid=7)   # written to <base_folder>/crl.pem
 mgr.verify_crl(crl)                     # raises ValidationCertError on failure
 ```
 
+Revoked certificates stay on the CRL until they expire.  If the database
+cannot be read, `generate_crl` raises `DBOperationError` and the previous
+`crl.pem` is left untouched — an empty CRL is never published.
+
 ### 7. Issue an Intermediate CA
 
 ```python
@@ -286,6 +309,10 @@ sub_ca_cert, sub_ca_key = mgr.issue_intermediate_ca(
     path_length=0, organization="ACME Corp", country="UA",
     cert_path="intermediate",
 )
+
+# The intermediate is registered (revocable via the root's CRL).  Verify a
+# leaf issued by it through the chain:
+mgr.verify_certificate(leaf_cert, intermediates=[sub_ca_cert])
 ```
 
 ### 8. Export PKCS#12
@@ -303,6 +330,7 @@ with open("nginx.p12", "wb") as f:
 from cryptography import x509
 third_party = x509.load_pem_x509_certificate(open("partner.pem", "rb").read())
 cosigned = mgr.cosign_certificate(cert=third_party, days_valid=365)
+# stored + registered like any other certificate issued by this CA
 ```
 
 ### 10. Inspect a Certificate
@@ -387,7 +415,8 @@ python examples/acomplete_example.py
 | `common_name` | `str` | `"Internal CA"` | CA Common Name (CN) |
 | `organization` | `str` | `"My Company"` | Organization (O) |
 | `country` | `str` | `"UA"` | Two-letter ISO 3166-1 alpha-2 code |
-| `key_size` | `int` | `2048` | RSA key length in bits |
+| `key_size` | `int` | `2048` | RSA key length in bits (≥ 2048; ignored for EC / Ed25519) |
+| `key_algorithm` | `KeyAlgorithm` | `RSA` | `RSA`, `EC_P256`, `EC_P384` or `ED25519` |
 | `days_valid` | `int` | `3650` | Validity period in days |
 | `valid_from` | `datetime \| None` | `None` | Explicit UTC start; `None` = now |
 
@@ -397,14 +426,15 @@ python examples/acomplete_example.py
 |---|---|---|---|
 | `common_name` | `str` | — | Certificate CN |
 | `serial_type` | `CertType` | `SERVICE` | Certificate category |
-| `key_size` | `int` | `2048` | RSA key length |
+| `key_size` | `int` | `2048` | RSA key length (≥ 2048; ignored for EC / Ed25519) |
+| `key_algorithm` | `KeyAlgorithm` | `RSA` | `RSA`, `EC_P256`, `EC_P384` or `ED25519` |
 | `days_valid` | `int` | `3650` | Validity period |
 | `email` | `EmailStr \| None` | `None` | `emailAddress` Subject attribute |
 | `is_server_cert` | `bool` | `True` | Adds ServerAuth EKU + CN as DNS SAN |
 | `is_client_cert` | `bool` | `False` | Adds ClientAuth EKU |
 | `san_dns` | `list[str] \| None` | `None` | Extra DNS Subject Alternative Names |
 | `san_ip` | `list[str] \| None` | `None` | IP address SANs |
-| `name` | `str \| None` | `None` | Override output file base name |
+| `name` | `str \| None` | `None` | Override output file base name (letters, digits, `.`, `-`, `_`; no leading dot) |
 
 ### `CertType`
 
@@ -431,14 +461,23 @@ storage = LocalStorage(base_folder="./pki")
 ./pki/
 └── [cert_path/]
     └── <uuid>/
-        ├── nginx.pem    ← x509.Certificate
-        ├── nginx.key    ← RSA private key
-        └── nginx.csr    ← CSR
+        ├── nginx.pem    ← x509.Certificate        (0644)
+        ├── nginx.key    ← private key             (0600)
+        └── nginx.csr    ← CSR                     (0644)
 ```
 
+- Private keys are written with mode `0600`.  They are **unencrypted unless**
+  `base_encryption_algorithm=BestAvailableEncryption(password)` is passed — a
+  warning is logged once per storage instance otherwise.
+- `file_name`, `cert_path` and `uuid_str` are validated: absolute paths, `..`
+  segments and backslashes raise `InvalidPathError`.
+- Without `is_overwrite=True` files are created with `O_EXCL`, so an existing
+  file is never replaced.
+
 ### `AsyncLocalStorage` (async)
 
-Drop-in async replacement — same constructor, same layout, all I/O via `aiofiles`.
+Drop-in async replacement — same constructor, same layout and the same
+security properties; blocking I/O runs in worker threads.
 
 ---
 
@@ -469,6 +508,13 @@ await db._db.init_db()
 | `delete_by_uuid(uuid)` | Hard-delete a record |
 | `update_status_expired()` | Bulk-mark stale VALID records as EXPIRED |
 
+Read methods (and `update_status_expired`) raise `DBOperationError` on any
+database failure instead of returning `None` / an empty list — a CA must fail
+closed.  `register_cert_in_db` returns `False` on failure; the managers turn
+that into `DBOperationError` and remove the artefacts they wrote.  Datetimes
+are stored as naive UTC (`DateTime` columns without time zone), which keeps
+PostgreSQL / asyncpg happy.
+
 ---
 
 ## Serial Number Encoding
@@ -478,7 +524,7 @@ await db._db.init_db()
 ```
 ┌──────────────┬──────────────────────┬────────────────────┐
 │  16-bit type │  80-bit name         │  64-bit random     │
-│  prefix      │  (up to 10 chars)    │  (UUID fragment)   │
+│  prefix      │  (up to 10 chars)    │  (secrets.randbits)│
 └──────────────┴──────────────────────┴────────────────────┘
 ```
 
@@ -491,6 +537,10 @@ cert_type, name = SerialWithEncoding.parse(serial)
 # cert_type == CertType.SERVICE, name == "nginx"
 ```
 
+Non-ASCII characters are stored as `?`, so a Cyrillic CN can never overflow
+into the type prefix.  The top bit is always zero, so the DER encoding fits the
+20-octet limit of RFC 5280.
+
 ---
 
 ## Error Reference
@@ -507,6 +557,9 @@ cert_type, name = SerialWithEncoding.parse(serial)
 | `IsNotFile` | CA PEM path is a directory | Provide a file, not a directory |
 | `WrongType` | Unsupported file extension | Use `.pem`, `.key`, or `.csr` |
 | `ErrorLoadCert` | PEM deserialisation failed | Check file format and integrity |
+| `DBOperationError` | Registry could not be read / written | Check the database; nothing was trusted or published |
+| `CertRevocationError` | Rotation/renewal could not revoke the old cert | Retry; the replacement was rolled back |
+| `InvalidPathError` | Storage path would escape `base_folder` | Use plain names / relative sub-paths |
 
 ---
 
@@ -516,7 +569,16 @@ cert_type, name = SerialWithEncoding.parse(serial)
 Yes — load it with `CAFileLoader` or `AsyncCAFileLoader`.
 
 **What's the difference between `renew` and `rotate`?**
-`renew` keeps the key pair and extends validity. `rotate` generates a new key and revokes the old cert.
+`renew` keeps the key pair and extends validity. `rotate` generates a new key. Both revoke the old cert with reason `superseded`.
+
+**Why does `verify_certificate` reject a certificate signed by my CA?**
+Since 0.3.0 a certificate issued directly by the CA must also be present in the
+registry — otherwise its revocation status is unknown.  Certificates created
+with older versions via `renew` / `cosign` were not registered; re-issue them.
+
+**How do I see the library's logs?**
+`tiny_ca` only attaches a `NullHandler`; configure the `"TinyCA"` logger in your
+application, e.g. `logging.getLogger("TinyCA").setLevel(logging.INFO)`.
 
 **How do I schedule CRL regeneration?**
 Use APScheduler or any cron solution:
@@ -624,4 +686,3 @@ Do **not** open public issues for security vulnerabilities. Email the maintainer
 | SQLAlchemy | MIT |
 | Pydantic | MIT |
 | aiosqlite | MIT |
-| aiofiles | Apache 2.0 |

{tiny_ca-0.2.1 → tiny_ca-0.3.0}/README.md

@@ -76,14 +76,16 @@ app.include_router(router, prefix="/api/v1")
 |---|---|
 | **CA bootstrap** | Self-signed root CA and intermediate (sub) CA with configurable `path_length` |
 | **Issuance** | Leaf certificates with SANs (DNS + IP), EKU (Server/Client Auth), email attribute |
-| **Lifecycle** | Revoke (RFC 5280 reasons), renew (same key), rotate (new key), hard-delete |
-| **CRL** | Build, sign, and verify Certificate Revocation Lists with configurable validity |
+| **Key algorithms** | RSA (2048+), ECDSA P-256 / P-384, Ed25519 — for the CA and for leaves |
+| **Lifecycle** | Revoke (RFC 5280 reasons), renew (same key), rotate (new key), hard-delete — every CA-signed certificate is registered, so it can always be revoked |
+| **CRL** | RFC 5280 CRLs with `CRLNumber`, AKI and per-entry reason codes; optional CRL Distribution Points / AIA in issued certificates |
+| **Validation** | Direct (`validate_cert`) or through intermediates (`validate_chain`, with `BasicConstraints` / `pathLen` checks); registry check is fail-closed |
 | **Inspection** | Structured `CertificateDetails` snapshot from any `x509.Certificate` — fully serialisable |
 | **Export** | PKCS#12 (`.p12`/`.pfx`) bundles with full CA chain |
 | **Co-signing** | Re-sign third-party certificates under your CA, preserving Subject and extensions |
 | **Chain** | Build `[leaf, ca]` fullchain ready for nginx, Apache, or Envoy |
 | **Monitoring** | List certs with filters, find expiring-soon, bulk-expire stale records |
-| **Storage** | `LocalStorage` (sync) and `AsyncLocalStorage` (async, aiofiles) with UUID-based isolation |
+| **Storage** | `LocalStorage` (sync) and `AsyncLocalStorage` (async) with UUID-based isolation, `0600` private keys and path-traversal protection |
 | **Database** | `SyncDBHandler` (SQLAlchemy) and `AsyncDBHandler` (aiosqlite) — SQLite, PostgreSQL, MySQL |
 | **API parity** | `CertLifecycleManager` and `AsyncCertLifecycleManager` are feature-identical |
 | **Serial numbers** | `SerialWithEncoding` — 160-bit RFC 5280-compliant, type-prefixed, name-encoded |
@@ -95,7 +97,7 @@ app.include_router(router, prefix="/api/v1")
 
 - **Python** 3.11 or higher
 - **Core:** `cryptography >= 46`, `sqlalchemy >= 2`, `pydantic >= 2`
-- **Async extras:** `aiofiles`, `aiosqlite`
+- **Async extras:** `aiosqlite`
 - **PostgreSQL:** `psycopg2-binary` (sync) / `asyncpg` (async)
 - **MySQL:** `pymysql` (sync) / `aiomysql` (async)
 
@@ -116,7 +118,7 @@ CertLifecycleManager / AsyncCertLifecycleManager   ← application entry-point
         │
         ├── BaseStorage (ABC)
         │       ├── LocalStorage                    ← sync filesystem (UUID-isolated)
-        │       └── AsyncLocalStorage               ← async filesystem (aiofiles)
+        │       └── AsyncLocalStorage               ← async filesystem (worker threads)
         │
         └── BaseDB (ABC)
                 ├── SyncDBHandler                   ← SQLAlchemy sync
@@ -160,7 +162,13 @@ from tiny_ca.storage.local_storage import LocalStorage
 from tiny_ca.db.sync_db_manager import SyncDBHandler
 from tiny_ca.models.certificate import CAConfig
 
-storage = LocalStorage(base_folder="./pki")
+from cryptography.hazmat.primitives.serialization import BestAvailableEncryption
+
+# Private keys are always written with mode 0600; encrypt them at rest too.
+storage = LocalStorage(
+    base_folder="./pki",
+    base_encryption_algorithm=BestAvailableEncryption(b"key-passphrase"),
+)
 db = SyncDBHandler(db_url="sqlite:///pki.db")
 mgr = CertLifecycleManager(storage=storage, db_handler=db)
 
@@ -176,10 +184,19 @@ Attach the factory so the manager can issue certificates:
 from tiny_ca.ca_factory.utils.file_loader import CAFileLoader
 from tiny_ca.ca_factory.factory import CertificateFactory
 
-loader = CAFileLoader(ca_cert_path=cert_path, ca_key_path=key_path)
-mgr.factory = CertificateFactory(loader)
+loader = CAFileLoader(ca_cert_path=cert_path, ca_key_path=key_path,
+                      ca_key_password=b"key-passphrase")
+mgr.factory = CertificateFactory(
+    loader,
+    # Optional: tell relying parties where to find the CRL / CA certificate.
+    crl_distribution_points=["http://pki.example/crl.pem"],
+    ca_issuers_urls=["http://pki.example/ca.pem"],
+)
 ```
 
+`CAConfig` / `ClientConfig` accept `key_algorithm=KeyAlgorithm.EC_P256`
+(also `EC_P384`, `ED25519`, default `RSA`) — see [Configuration Models](#configuration-models).
+
 ### 2. Issue a Leaf Certificate
 
 ```python
@@ -203,7 +220,9 @@ cert, key, csr = mgr.issue_certificate(
 ### 3. Renew a Certificate (same key)
 
 Keeps the existing public key — only validity window and serial number change.
-Use when the key has **not** been compromised.
+Use when the key has **not** been compromised.  The renewed certificate is
+stored and registered (so it can be revoked); the original is revoked with
+reason `superseded`.  The private key stays in the original folder.
 
 ```python
 renewed = mgr.renew_certificate(serial=cert.serial_number, days_valid=365)
@@ -211,7 +230,9 @@ renewed = mgr.renew_certificate(serial=cert.serial_number, days_valid=365)
 
 ### 4. Rotate a Certificate (new key)
 
-Atomically revokes the old cert and issues a replacement with a fresh key pair.
+Issues a replacement with a fresh key pair, then revokes the old cert
+(`superseded`).  If the old cert cannot be revoked, the replacement is rolled
+back and `CertRevocationError` is raised.
 
 ```python
 new_cert, new_key, new_csr = mgr.rotate_certificate(
@@ -236,6 +257,10 @@ crl = mgr.generate_crl(days_valid=7)   # written to <base_folder>/crl.pem
 mgr.verify_crl(crl)                     # raises ValidationCertError on failure
 ```
 
+Revoked certificates stay on the CRL until they expire.  If the database
+cannot be read, `generate_crl` raises `DBOperationError` and the previous
+`crl.pem` is left untouched — an empty CRL is never published.
+
 ### 7. Issue an Intermediate CA
 
 ```python
@@ -244,6 +269,10 @@ sub_ca_cert, sub_ca_key = mgr.issue_intermediate_ca(
     path_length=0, organization="ACME Corp", country="UA",
     cert_path="intermediate",
 )
+
+# The intermediate is registered (revocable via the root's CRL).  Verify a
+# leaf issued by it through the chain:
+mgr.verify_certificate(leaf_cert, intermediates=[sub_ca_cert])
 ```
 
 ### 8. Export PKCS#12
@@ -261,6 +290,7 @@ with open("nginx.p12", "wb") as f:
 from cryptography import x509
 third_party = x509.load_pem_x509_certificate(open("partner.pem", "rb").read())
 cosigned = mgr.cosign_certificate(cert=third_party, days_valid=365)
+# stored + registered like any other certificate issued by this CA
 ```
 
 ### 10. Inspect a Certificate
@@ -345,7 +375,8 @@ python examples/acomplete_example.py
 | `common_name` | `str` | `"Internal CA"` | CA Common Name (CN) |
 | `organization` | `str` | `"My Company"` | Organization (O) |
 | `country` | `str` | `"UA"` | Two-letter ISO 3166-1 alpha-2 code |
-| `key_size` | `int` | `2048` | RSA key length in bits |
+| `key_size` | `int` | `2048` | RSA key length in bits (≥ 2048; ignored for EC / Ed25519) |
+| `key_algorithm` | `KeyAlgorithm` | `RSA` | `RSA`, `EC_P256`, `EC_P384` or `ED25519` |
 | `days_valid` | `int` | `3650` | Validity period in days |
 | `valid_from` | `datetime \| None` | `None` | Explicit UTC start; `None` = now |
 
@@ -355,14 +386,15 @@ python examples/acomplete_example.py
 |---|---|---|---|
 | `common_name` | `str` | — | Certificate CN |
 | `serial_type` | `CertType` | `SERVICE` | Certificate category |
-| `key_size` | `int` | `2048` | RSA key length |
+| `key_size` | `int` | `2048` | RSA key length (≥ 2048; ignored for EC / Ed25519) |
+| `key_algorithm` | `KeyAlgorithm` | `RSA` | `RSA`, `EC_P256`, `EC_P384` or `ED25519` |
 | `days_valid` | `int` | `3650` | Validity period |
 | `email` | `EmailStr \| None` | `None` | `emailAddress` Subject attribute |
 | `is_server_cert` | `bool` | `True` | Adds ServerAuth EKU + CN as DNS SAN |
 | `is_client_cert` | `bool` | `False` | Adds ClientAuth EKU |
 | `san_dns` | `list[str] \| None` | `None` | Extra DNS Subject Alternative Names |
 | `san_ip` | `list[str] \| None` | `None` | IP address SANs |
-| `name` | `str \| None` | `None` | Override output file base name |
+| `name` | `str \| None` | `None` | Override output file base name (letters, digits, `.`, `-`, `_`; no leading dot) |
 
 ### `CertType`
 
@@ -389,14 +421,23 @@ storage = LocalStorage(base_folder="./pki")
 ./pki/
 └── [cert_path/]
     └── <uuid>/
-        ├── nginx.pem    ← x509.Certificate
-        ├── nginx.key    ← RSA private key
-        └── nginx.csr    ← CSR
+        ├── nginx.pem    ← x509.Certificate        (0644)
+        ├── nginx.key    ← private key             (0600)
+        └── nginx.csr    ← CSR                     (0644)
 ```
 
+- Private keys are written with mode `0600`.  They are **unencrypted unless**
+  `base_encryption_algorithm=BestAvailableEncryption(password)` is passed — a
+  warning is logged once per storage instance otherwise.
+- `file_name`, `cert_path` and `uuid_str` are validated: absolute paths, `..`
+  segments and backslashes raise `InvalidPathError`.
+- Without `is_overwrite=True` files are created with `O_EXCL`, so an existing
+  file is never replaced.
+
 ### `AsyncLocalStorage` (async)
 
-Drop-in async replacement — same constructor, same layout, all I/O via `aiofiles`.
+Drop-in async replacement — same constructor, same layout and the same
+security properties; blocking I/O runs in worker threads.
 
 ---
 
@@ -427,6 +468,13 @@ await db._db.init_db()
 | `delete_by_uuid(uuid)` | Hard-delete a record |
 | `update_status_expired()` | Bulk-mark stale VALID records as EXPIRED |
 
+Read methods (and `update_status_expired`) raise `DBOperationError` on any
+database failure instead of returning `None` / an empty list — a CA must fail
+closed.  `register_cert_in_db` returns `False` on failure; the managers turn
+that into `DBOperationError` and remove the artefacts they wrote.  Datetimes
+are stored as naive UTC (`DateTime` columns without time zone), which keeps
+PostgreSQL / asyncpg happy.
+
 ---
 
 ## Serial Number Encoding
@@ -436,7 +484,7 @@ await db._db.init_db()
 ```
 ┌──────────────┬──────────────────────┬────────────────────┐
 │  16-bit type │  80-bit name         │  64-bit random     │
-│  prefix      │  (up to 10 chars)    │  (UUID fragment)   │
+│  prefix      │  (up to 10 chars)    │  (secrets.randbits)│
 └──────────────┴──────────────────────┴────────────────────┘
 ```
 
@@ -449,6 +497,10 @@ cert_type, name = SerialWithEncoding.parse(serial)
 # cert_type == CertType.SERVICE, name == "nginx"
 ```
 
+Non-ASCII characters are stored as `?`, so a Cyrillic CN can never overflow
+into the type prefix.  The top bit is always zero, so the DER encoding fits the
+20-octet limit of RFC 5280.
+
 ---
 
 ## Error Reference
@@ -465,6 +517,9 @@ cert_type, name = SerialWithEncoding.parse(serial)
 | `IsNotFile` | CA PEM path is a directory | Provide a file, not a directory |
 | `WrongType` | Unsupported file extension | Use `.pem`, `.key`, or `.csr` |
 | `ErrorLoadCert` | PEM deserialisation failed | Check file format and integrity |
+| `DBOperationError` | Registry could not be read / written | Check the database; nothing was trusted or published |
+| `CertRevocationError` | Rotation/renewal could not revoke the old cert | Retry; the replacement was rolled back |
+| `InvalidPathError` | Storage path would escape `base_folder` | Use plain names / relative sub-paths |
 
 ---
 
@@ -474,7 +529,16 @@ cert_type, name = SerialWithEncoding.parse(serial)
 Yes — load it with `CAFileLoader` or `AsyncCAFileLoader`.
 
 **What's the difference between `renew` and `rotate`?**
-`renew` keeps the key pair and extends validity. `rotate` generates a new key and revokes the old cert.
+`renew` keeps the key pair and extends validity. `rotate` generates a new key. Both revoke the old cert with reason `superseded`.
+
+**Why does `verify_certificate` reject a certificate signed by my CA?**
+Since 0.3.0 a certificate issued directly by the CA must also be present in the
+registry — otherwise its revocation status is unknown.  Certificates created
+with older versions via `renew` / `cosign` were not registered; re-issue them.
+
+**How do I see the library's logs?**
+`tiny_ca` only attaches a `NullHandler`; configure the `"TinyCA"` logger in your
+application, e.g. `logging.getLogger("TinyCA").setLevel(logging.INFO)`.
 
 **How do I schedule CRL regeneration?**
 Use APScheduler or any cron solution:
@@ -582,4 +646,3 @@ Do **not** open public issues for security vulnerabilities. Email the maintainer
 | SQLAlchemy | MIT |
 | Pydantic | MIT |
 | aiosqlite | MIT |
-| aiofiles | Apache 2.0 |

{tiny_ca-0.2.1 → tiny_ca-0.3.0}/pyproject.toml

@@ -10,7 +10,7 @@ build-backend = "setuptools.build_meta"
 # ──────────────────────────────────────────────
 [project]
 name = "tiny-ca"
-version = "0.2.1"
+version = "0.3.0"
 description = "A lightweight, 100%-tested Python library for managing the full lifecycle of X.509 certificates — issuance, revocation, rotation, CRL generation, PKCS#12 export, and more."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -34,7 +34,7 @@ classifiers = [
 dependencies = [
     "cryptography>=46.0.0",
     "pydantic[email]>=2.12.0",
-    "sqlalchemy>=2.0.0",
+    "sqlalchemy[asyncio]>=2.0.0",
 ]
 
 [project.urls]
@@ -48,9 +48,7 @@ Changelog = "https://github.com/Shchusia/tiny_ca/blob/master/CHANGELOG.md"
 # ──────────────────────────────────────────────
 [project.optional-dependencies]
 async = [
-    "aiofiles>=25.1.0",
     "aiosqlite>=0.22.0",
-    "types-aiofiles>=25.1.0",
 ]
 postgres = [
     "psycopg2-binary>=2.9.0",
@@ -138,7 +136,7 @@ fixable = ["ALL"]
 unfixable = []
 
 [tool.ruff.lint.isort]
-known-first-party = ["your_package"]
+known-first-party = ["tiny_ca"]
 force-sort-within-sections = true
 
 [tool.ruff.lint.per-file-ignores]
@@ -201,3 +199,4 @@ skips = ["*/*_test.py", "*/test_*.py", "*/grafana.py", "B608"]
 [tool.pytest.ini_options]
 pythonpath = ["."]
 testpaths = ["tests"]
+asyncio_mode = "auto"

{tiny_ca-0.2.1 → tiny_ca-0.3.0}/tests/test_afile_loader.py

@@ -10,6 +10,7 @@ Run with:
 from __future__ import annotations
 
 import asyncio
+import sys
 import tempfile
 from pathlib import Path
 
@@ -102,7 +103,7 @@ def pem_dir_encrypted(ca_cert: x509.Certificate, ca_key: rsa.RSAPrivateKey):
 
 
 def run(coro):
-    return asyncio.get_event_loop().run_until_complete(coro)
+    return asyncio.run(coro)
 
 
 # ===========================================================================
@@ -287,7 +288,25 @@ class TestLoadSyncErrors:
         with pytest.raises(ErrorLoadCert):
             run(loader.load())
 
-    def test_non_rsa_key_raises_type_error(self, tmp_path, ca_cert):
+    def test_unsupported_key_type_raises_type_error(self, tmp_path, ca_cert):
+        from cryptography.hazmat.primitives.asymmetric import dsa
+
+        bad_key = dsa.generate_private_key(key_size=2048)
+        cert_file = tmp_path / "ca.pem"
+        key_file = tmp_path / "dsa.pem"
+        cert_file.write_bytes(ca_cert.public_bytes(serialization.Encoding.PEM))
+        key_file.write_bytes(
+            bad_key.private_bytes(
+                serialization.Encoding.PEM,
+                serialization.PrivateFormat.PKCS8,
+                serialization.NoEncryption(),
+            )
+        )
+        loader = AsyncCAFileLoader(cert_file, key_file)
+        with pytest.raises(TypeError, match="CA key must be"):
+            run(loader.load())
+
+    def test_ec_key_is_accepted(self, tmp_path, ca_cert):
         from cryptography.hazmat.primitives.asymmetric import ec
 
         ec_key = ec.generate_private_key(ec.SECP256R1(), default_backend())
@@ -302,8 +321,8 @@ class TestLoadSyncErrors:
             )
         )
         loader = AsyncCAFileLoader(cert_file, key_file)
-        with pytest.raises(TypeError, match="RSA"):
-            run(loader.load())
+        run(loader.load())
+        assert isinstance(loader.ca_key, ec.EllipticCurvePrivateKey)
 
 
 # ===========================================================================