x509kit 0.3.2__tar.gz → 0.4.0__tar.gz

{x509kit-0.3.2/src/x509kit.egg-info → x509kit-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: x509kit
-Version: 0.3.2
+Version: 0.4.0
 Summary: Pure-Python X.509 / PKCS#10 / CRL / OCSP / PKCS#12 toolkit — stdlib only
 Author-email: ArtProsto <artemkamirn@mail.ru>
 License: MIT

x509kit-0.4.0/examples/13_acme_server.py

@@ -0,0 +1,211 @@
+"""13 - Минимальный ACME-сервер.
+
+Run: python examples/13_acme_server.py [--auto-verify] [--port 14000]
+
+--auto-verify — не делать реальный http-01 fetch (для локальных тестов).
+               В продакшене НЕ использовать.
+
+Endpoints:
+  GET  /directory         — метаданные сервера
+  HEAD /new-nonce         — свежий nonce
+  POST /new-account       — создать аккаунт
+  POST /new-order         — создать order
+  POST /authz/<id>        — получить authz
+  POST /challenge/<id>    — активировать challenge
+  POST /finalize/<id>     — финализировать order (CSR)
+  POST /cert/<id>         — скачать сертификат
+"""
+import argparse
+import json
+import sys
+import threading
+from http.server import HTTPServer, BaseHTTPRequestHandler
+
+from x509kit import CertificateBuilder, CACert, Ed25519Keys
+from x509kit.acme import (
+    ACMEServer, ACMEError, b64u, verify_jws,
+)
+
+
+def build_ca():
+    key = Ed25519Keys.generate()
+    ca = (CertificateBuilder(is_ca=True)
+        .add_subject({"C": "XX", "O": "ACME Demo", "CN": "ACME Demo Root"})
+        .add_public_key(key)
+        .add_serial_random().add_validity(days=3650)
+        .add_basic_constraints(path_len=0)
+        .add_key_usage("keyCertSign", "cRLSign")
+        .self_signed().sign(key))
+    return ca, key
+
+
+def make_handler(acme: ACMEServer):
+    class Handler(BaseHTTPRequestHandler):
+        server_ref = acme
+
+        def log_message(self, fmt, *args):
+            sys.stderr.write(f"[acme] {fmt % args}\n")
+
+        # ---- helpers ----
+        def _send(self, status: int, body: bytes, ctype: str,
+                  extra_headers=None):
+            self.send_response(status)
+            self.send_header("Content-Type", ctype)
+            self.send_header("Content-Length", str(len(body)))
+            self.send_header("Replay-Nonce", self.server_ref.new_nonce())
+            # RFC 8555 §7.1: многие клиенты (в т.ч. certbot) требуют rel="up"
+            self.send_header("Link",
+                f'<{self.server_ref.base_url}/directory>;rel="up"')
+            for k, v in (extra_headers or {}).items():
+                self.send_header(k, v)
+            self.end_headers()
+            self.wfile.write(body)
+
+        def _json(self, status, obj, extra_headers=None):
+            body = json.dumps(obj, separators=(",", ":")).encode()
+            self._send(status, body, "application/json", extra_headers)
+
+        def _problem(self, err: ACMEError):
+            from x509kit.acme import _acme_problem
+            body = json.dumps(_acme_problem(err), separators=(",", ":")).encode()
+            self._send(err.status, body, "application/problem+json")
+
+        def _read_jws(self):
+            n = int(self.headers.get("Content-Length", "0"))
+            raw = self.rfile.read(n)
+            try:
+                return json.loads(raw.decode("utf-8"))
+            except Exception as e:
+                raise ACMEError("malformed", f"not JSON: {e}")
+
+        def _verify(self, jws, url):
+            try:
+                return verify_jws(
+                    jws,
+                    expected_url=url,
+                    nonce_checker=self.server_ref.consume_nonce,
+                    key_resolver=self.server_ref.account_key,
+                )
+            except Exception as e:
+                # Convert nonce/signature errors to ACME problem
+                msg = str(e)
+                kind = "badNonce" if "nonce" in msg.lower() else "malformed"
+                raise ACMEError(kind, msg, 400)
+
+        # ---- HTTP verbs ----
+        def do_GET(self):
+            path = self.path.split("?", 1)[0]
+            if path == "/directory":
+                self._json(200, self.server_ref.directory())
+            else:
+                self._problem(ACMEError("malformed", f"GET {path}", 404))
+
+        def do_HEAD(self):
+            path = self.path.split("?", 1)[0]
+            if path == "/new-nonce":
+                self.send_response(200)
+                self.send_header("Replay-Nonce", self.server_ref.new_nonce())
+                self.send_header("Cache-Control", "no-store")
+                self.end_headers()
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+        def do_POST(self):
+            path = self.path.split("?", 1)[0]
+            url = self.server_ref.base_url + path
+
+            try:
+                jws = self._read_jws()
+                result = self._verify(jws, url)
+                self._dispatch(path, result)
+            except ACMEError as e:
+                self._problem(e)
+            except Exception as e:
+                self._problem(ACMEError("serverInternal", str(e), 500))
+
+        def _dispatch(self, path, result):
+            S = self.server_ref
+
+            if path == "/new-account":
+                kid, created = S.new_account(result.jwk, result.payload)
+                view = S.account_view(kid)
+                status = 201 if created else 200
+                self._json(status, view, {"Location": kid})
+                return
+
+            if path == "/new-order":
+                if result.kid is None:
+                    raise ACMEError("malformed", "kid required", 400)
+                view = S.new_order(result.kid, result.payload)
+                order_url = f"{S.base_url}/order/{view['id']}"
+                self._json(201, view, {"Location": order_url})
+                return
+
+            if path.startswith("/order/"):
+                order_id = path[len("/order/"):]
+                if not order_id:
+                    raise ACMEError("malformed",
+                                    "order URL is missing id", 404)
+                self._json(200, S.get_order(order_id))
+                return
+
+            if path.startswith("/authz/"):
+                authz_id = path[len("/authz/"):]
+                self._json(200, S.get_authz(authz_id))
+                return
+
+            if path.startswith("/challenge/"):
+                chal_id = path[len("/challenge/"):]
+                # payload обычно {}
+                self._json(200, S.trigger_challenge(chal_id))
+                return
+
+            if path.startswith("/finalize/"):
+                order_id = path[len("/finalize/"):]
+                self._json(200, S.finalize(order_id, result.payload))
+                return
+
+            if path.startswith("/cert/"):
+                cert_id = path[len("/cert/"):]
+                pem = S.get_certificate(cert_id)
+                self._send(200, pem.encode(),
+                           "application/pem-certificate-chain")
+                return
+
+            raise ACMEError("malformed", f"unknown path: {path}", 404)
+
+    return Handler
+
+
+def main():
+    p = argparse.ArgumentParser()
+    p.add_argument("--port", type=int, default=14000)
+    p.add_argument("--host", default="127.0.0.1")
+    p.add_argument("--auto-verify", action="store_true",
+                   help="challenge valid без реальной проверки (только для тестов!)")
+    args = p.parse_args()
+
+    ca, ca_key = build_ca()
+    base_url = f"http://{args.host}:{args.port}"
+    acme = ACMEServer(ca, ca_key, base_url,
+                      cert_days=90,
+                      auto_verify=args.auto_verify)
+
+    Handler = make_handler(acme)
+    srv = HTTPServer((args.host, args.port), Handler)
+
+    print(f"ACME server: {base_url}/directory")
+    print(f"Directory:   {base_url}/directory")
+    print(f"auto_verify: {args.auto_verify}")
+    print("Ctrl+C to stop.")
+    print()
+    print("Test with: python examples/14_acme_client.py")
+    try:
+        srv.serve_forever()
+    except KeyboardInterrupt:
+        print("\nStopped.")
+
+
+if __name__ == "__main__":
+    main()

x509kit-0.4.0/examples/14_acme_client.py

@@ -0,0 +1,167 @@
+"""14 - Минимальный ACME-клиент для локального сервера.
+
+Run (в другом терминале, пока сервер работает):
+    python examples/14_acme_client.py
+
+Создаёт аккаунт Ed25519, заказывает сертификат для "example.local",
+проходит http-01 challenge (auto_verify), финализирует и скачивает cert.
+"""
+import json
+import sys
+import urllib.request
+from base64 import urlsafe_b64decode, urlsafe_b64encode
+
+from x509kit import CSRBuilder, Ed25519Keys
+
+
+def b64u(data):
+    if isinstance(data, str):
+        data = data.encode()
+    return urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+def http(method, url, body=None, headers=None):
+    req = urllib.request.Request(url, method=method)
+    if body is not None:
+        req.data = body if isinstance(body, bytes) else body.encode()
+    for k, v in (headers or {}).items():
+        req.add_header(k, v)
+    with urllib.request.urlopen(req) as r:
+        data = r.read()
+        return r.status, dict(r.headers), data
+
+
+def jws_body(payload: dict, protected_extra: dict, key):
+    protected = dict(protected_extra)
+    protected_b64 = b64u(json.dumps(protected, separators=(",", ":")))
+    payload_b64 = b64u(json.dumps(payload, separators=(",", ":")))
+    signing_input = (protected_b64 + "." + payload_b64).encode()
+    sig = key.sign(signing_input)
+    return json.dumps({
+        "protected": protected_b64,
+        "payload": payload_b64,
+        "signature": b64u(sig),
+    }, separators=(",", ":")).encode()
+
+
+def main():
+    BASE = "http://127.0.0.1:14000"
+
+    # --- 1. Directory ---
+    print("[1] GET /directory")
+    _, _, body = http("GET", f"{BASE}/directory")
+    directory = json.loads(body)
+    print(f"    newAccount: {directory['newAccount']}")
+
+    # --- 2. new-nonce ---
+    print("[2] HEAD /new-nonce")
+    _, hdrs, _ = http("HEAD", directory["newNonce"])
+    nonce = hdrs["Replay-Nonce"]
+    print(f"    nonce: {nonce[:16]}…")
+
+    # --- 3. Ключ аккаунта ---
+    account_key = Ed25519Keys.generate()
+    jwk = {
+        "kty": "OKP",
+        "crv": "Ed25519",
+        "x": b64u(account_key.pub),
+    }
+
+    # --- 4. new-account ---
+    print("[3] POST /new-account")
+    body = jws_body(
+        {"termsOfServiceAgreed": True, "contact": []},
+        {"alg": "EdDSA", "jwk": jwk, "nonce": nonce,
+         "url": directory["newAccount"]},
+        account_key,
+    )
+    status, hdrs, _ = http("POST", directory["newAccount"], body,
+                            {"Content-Type": "application/jose+json"})
+    kid = hdrs["Location"]
+    nonce = hdrs["Replay-Nonce"]
+    print(f"    kid: {kid}")
+
+    # --- 5. new-order ---
+    print("[4] POST /new-order")
+    order_payload = {
+        "identifiers": [{"type": "dns", "value": "example.local"}],
+    }
+    body = jws_body(
+        order_payload,
+        {"alg": "EdDSA", "kid": kid, "nonce": nonce,
+         "url": directory["newOrder"]},
+        account_key,
+    )
+    _, hdrs, raw = http("POST", directory["newOrder"], body,
+                        {"Content-Type": "application/jose+json"})
+    nonce = hdrs["Replay-Nonce"]
+    order = json.loads(raw)
+    print(f"    status: {order['status']}")
+    authz_url = order["authorizations"][0]
+
+    # --- 6. authz ---
+    print("[5] POST /authz/<id>  (POST-as-GET)")
+    body = jws_body({}, {"alg": "EdDSA", "kid": kid, "nonce": nonce,
+                          "url": authz_url}, account_key)
+    _, hdrs, raw = http("POST", authz_url, body,
+                        {"Content-Type": "application/jose+json"})
+    nonce = hdrs["Replay-Nonce"]
+    authz = json.loads(raw)
+    chal_url = authz["challenges"][0]["url"]
+    print(f"    authz status: {authz['status']}")
+    print(f"    challenge:    {authz['challenges'][0]['type']}")
+
+    # --- 7. Trigger challenge ---
+    print("[6] POST /challenge/<id>")
+    body = jws_body({}, {"alg": "EdDSA", "kid": kid, "nonce": nonce,
+                          "url": chal_url}, account_key)
+    _, hdrs, raw = http("POST", chal_url, body,
+                        {"Content-Type": "application/jose+json"})
+    nonce = hdrs["Replay-Nonce"]
+    chal = json.loads(raw)
+    print(f"    challenge status: {chal['status']}")
+    if chal["status"] != "valid":
+        print(f"    error: {chal.get('error', {}).get('detail', '?')}")
+        sys.exit(1)
+
+    # --- 8. Finalize ---
+    print("[7] POST /finalize/<order>")
+    leaf_key = Ed25519Keys.generate()
+    csr = (CSRBuilder()
+        .add_subject({"CN": "example.local"})
+        .add_public_key(leaf_key)
+        .add_san_dns("example.local")
+        .sign(leaf_key))
+    finalize_payload = {"csr": b64u(csr.der)}
+    body = jws_body(
+        finalize_payload,
+        {"alg": "EdDSA", "kid": kid, "nonce": nonce,
+         "url": order["finalize"]},
+        account_key,
+    )
+    _, hdrs, raw = http("POST", order["finalize"], body,
+                        {"Content-Type": "application/jose+json"})
+    nonce = hdrs["Replay-Nonce"]
+    order2 = json.loads(raw)
+    cert_url = order2["certificate"]
+    print(f"    order status: {order2['status']}")
+    print(f"    certificate:  {cert_url}")
+
+    # --- 9. Download certificate ---
+    print("[8] POST /cert/<id>  (POST-as-GET)")
+    body = jws_body({}, {"alg": "EdDSA", "kid": kid, "nonce": nonce,
+                          "url": cert_url}, account_key)
+    _, _, raw = http("POST", cert_url, body,
+                     {"Content-Type": "application/jose+json"})
+    pem = raw.decode()
+    print()
+    print("=== Certificate (first 400 chars) ===")
+    print(pem[:400])
+
+    open("acme_leaf.pem", "w").write(pem)
+    print()
+    print("Saved: acme_leaf.pem")
+
+
+if __name__ == "__main__":
+    main()

{x509kit-0.3.2 → x509kit-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "x509kit"
-version = "0.3.2"
+version = "0.4.0"
 description = "Pure-Python X.509 / PKCS#10 / CRL / OCSP / PKCS#12 toolkit — stdlib only"
 readme = "README.md"
 requires-python = ">=3.9"

{x509kit-0.3.2 → x509kit-0.4.0}/src/x509kit/__init__.py

@@ -318,7 +318,16 @@ from .x509 import (
     __version__,
 )
 
+from .acme import (
+    ACMEServer, ACMEError,
+    b64u, b64u_decode,
+    jwk_to_key, jwk_thumbprint, verify_jws,
+)
+
 __all__ = [
+    "ACMEServer", "ACMEError",
+    "b64u", "b64u_decode",
+    "jwk_to_key", "jwk_thumbprint", "verify_jws",
     "ASN1",
     # Ключи
     "RSAKeys", "Ed25519Keys", "ECDSAKeys", "EC_CURVES",

x509kit-0.4.0/src/x509kit/acme.py

@@ -0,0 +1,538 @@
+# -*- coding: utf-8 -*-
+"""
+x509kit.acme — минимальный ACME-сервер (RFC 8555) поверх x509kit.
+
+Поддерживает:
+  directory, new-nonce, new-account (jwk), new-order, authz,
+  http-01 challenge, finalize (CSR → cert), cert download.
+
+Не поддерживает:
+  DNS-01, TLS-ALPN-01, wildcard, external account binding,
+  key rollover, revocation.
+
+Состояние — в памяти. Перезапуск → всё потеряно.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import secrets
+import time
+import urllib.request
+from datetime import datetime, timedelta, timezone
+
+from .x509 import (
+    ASN1, CertificateBuilder, CACert, CSR, der_int, der_seq,
+    Ed25519Keys, ECDSAKeys, RSAKeys, X509Error,
+)
+
+
+# ======================================================================
+#  Base64url (RFC 4648 §5)
+# ======================================================================
+
+def b64u(data) -> str:
+    if isinstance(data, str):
+        data = data.encode("utf-8")
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def b64u_decode(s) -> bytes:
+    if isinstance(s, bytes):
+        s = s.decode("ascii")
+    pad = "=" * (-len(s) % 4)
+    return base64.urlsafe_b64decode(s + pad)
+
+
+# ======================================================================
+#  JWK (RFC 7517) и thumbprint (RFC 7638)
+# ======================================================================
+
+def jwk_to_key(jwk: dict):
+    """JWK dict → публичный ключ x509kit."""
+    kty = jwk.get("kty")
+    if kty == "OKP" and jwk.get("crv") == "Ed25519":
+        return Ed25519Keys(pub=b64u_decode(jwk["x"]))
+    if kty == "EC":
+        crv = jwk.get("crv")
+        curve_oid = {"P-256": "1.2.840.10045.3.1.7",
+                     "P-384": "1.3.132.0.34",
+                     "P-521": "1.3.132.0.35"}.get(crv)
+        if curve_oid is None:
+            raise X509Error(f"unsupported EC curve: {crv}")
+        x = int.from_bytes(b64u_decode(jwk["x"]), "big")
+        y = int.from_bytes(b64u_decode(jwk["y"]), "big")
+        return ECDSAKeys(curve_oid, point=(x, y))
+    if kty == "RSA":
+        n = int.from_bytes(b64u_decode(jwk["n"]), "big")
+        e = int.from_bytes(b64u_decode(jwk["e"]), "big")
+        return RSAKeys(n=n, e=e)
+    raise X509Error(f"unsupported JWK kty={kty}")
+
+
+def jwk_thumbprint(jwk: dict) -> str:
+    """RFC 7638 thumbprint (base64url SHA-256)."""
+    kty = jwk["kty"]
+    if kty == "OKP":
+        canonical = {"crv": jwk["crv"], "kty": kty, "x": jwk["x"]}
+    elif kty == "EC":
+        canonical = {"crv": jwk["crv"], "kty": kty,
+                     "x": jwk["x"], "y": jwk["y"]}
+    elif kty == "RSA":
+        canonical = {"e": jwk["e"], "kty": kty, "n": jwk["n"]}
+    else:
+        raise X509Error(f"unsupported kty: {kty}")
+    js = json.dumps(canonical, separators=(",", ":"), sort_keys=True)
+    return b64u(hashlib.sha256(js.encode("utf-8")).digest())
+
+
+# ======================================================================
+#  JWS verification (RFC 7515)
+# ======================================================================
+
+def _ecdsa_raw_to_der(raw: bytes) -> bytes:
+    """64 байта r||s → DER SEQUENCE."""
+    if len(raw) % 2 != 0:
+        raise X509Error(f"bad ECDSA sig length: {len(raw)}")
+    half = len(raw) // 2
+    r = int.from_bytes(raw[:half], "big")
+    s = int.from_bytes(raw[half:], "big")
+    return der_seq(der_int(r), der_int(s))
+
+
+class JWSResult:
+    __slots__ = ("protected", "payload", "key", "jwk", "kid",
+                 "url", "nonce", "alg")
+
+    def __init__(self, protected, payload, key, jwk, kid, url, nonce, alg):
+        self.protected = protected
+        self.payload = payload
+        self.key = key
+        self.jwk = jwk
+        self.kid = kid
+        self.url = url
+        self.nonce = nonce
+        self.alg = alg
+
+
+def verify_jws(jws: dict, *, expected_url: str,
+               nonce_checker=None, key_resolver=None) -> JWSResult:
+    """Проверить JWS. Все ошибки → X509Error.
+
+    jws = {"protected": b64u, "payload": b64u, "signature": b64u}
+    """
+    try:
+        protected_b64 = jws["protected"]
+        payload_b64 = jws.get("payload", "")
+        signature_b64 = jws["signature"]
+    except KeyError as e:
+        raise X509Error(f"JWS missing field: {e}")
+
+    try:
+        protected = json.loads(b64u_decode(protected_b64))
+    except Exception as e:
+        raise X509Error(f"JWS protected header is not valid JSON: {e}")
+
+    try:
+        payload = json.loads(b64u_decode(payload_b64)) if payload_b64 else {}
+    except Exception as e:
+        raise X509Error(f"JWS payload is not valid JSON: {e}")
+
+    # --- URL ---
+    url = protected.get("url")
+    if url != expected_url:
+        raise X509Error(f"JWS url mismatch: {url!r} != {expected_url!r}")
+
+    # --- nonce ---
+    nonce = protected.get("nonce")
+    if not nonce:
+        raise X509Error("JWS missing nonce")
+    if nonce_checker is not None and not nonce_checker(nonce):
+        raise X509Error(f"JWS bad or reused nonce: {nonce!r}")
+
+    # --- key: jwk (для new-account) или kid (для остальных) ---
+    has_jwk = "jwk" in protected
+    has_kid = "kid" in protected
+    if has_jwk and has_kid:
+        raise X509Error("JWS must have jwk OR kid, not both")
+    if not has_jwk and not has_kid:
+        raise X509Error("JWS must have either jwk or kid")
+
+    if has_jwk:
+        jwk = protected["jwk"]
+        key = jwk_to_key(jwk)
+        kid = None
+    else:
+        kid = protected["kid"]
+        if key_resolver is None:
+            raise X509Error("JWS uses kid, but no key resolver provided")
+        key = key_resolver(kid)
+        jwk = None
+
+    # --- signature ---
+    alg = protected.get("alg")
+    signing_input = (protected_b64 + "." + payload_b64).encode("ascii")
+    try:
+        signature = b64u_decode(signature_b64)
+    except Exception as e:
+        raise X509Error(f"JWS signature is not valid base64url: {e}")
+
+    if alg == "EdDSA":
+        if not isinstance(key, Ed25519Keys):
+            raise X509Error("alg=EdDSA but key is not Ed25519")
+        ok = key.verify(signing_input, signature)
+    elif alg in ("ES256", "ES384", "ES512"):
+        if not isinstance(key, ECDSAKeys):
+            raise X509Error(f"alg={alg} but key is not ECDSA")
+        hash_name = {"ES256": "sha256", "ES384": "sha384", "ES512": "sha512"}[alg]
+        try:
+            der_sig = _ecdsa_raw_to_der(signature)
+        except X509Error:
+            raise
+        ok = key.verify(signing_input, der_sig, hash_name)
+    elif alg == "RS256":
+        if not isinstance(key, RSAKeys):
+            raise X509Error("alg=RS256 but key is not RSA")
+        ok = key.verify_pkcs1v15(signing_input, signature, "sha256")
+    else:
+        raise X509Error(f"unsupported JWS alg: {alg}")
+
+    if not ok:
+        raise X509Error("JWS signature invalid")
+
+    return JWSResult(protected, payload, key, jwk, kid, url, nonce, alg)
+
+
+# ======================================================================
+#  ACME errors
+# ======================================================================
+
+class ACMEError(X509Error):
+    """Ошибка ACME с типом (urn:ietf:params:acme:error:...) и HTTP-кодом."""
+
+    def __init__(self, kind: str, detail: str, status: int = 400):
+        super().__init__(f"{kind}: {detail}")
+        self.kind = kind
+        self.detail = detail
+        self.status = status
+
+
+def _acme_problem(err: ACMEError) -> dict:
+    return {
+        "type": f"urn:ietf:params:acme:error:{err.kind}",
+        "detail": err.detail,
+    }
+
+
+# ======================================================================
+#  ACME Server
+# ======================================================================
+
+class ACMEServer:
+    """Минимальный ACME-сервер с http-01 challenge.
+
+    ca       — CACert (CA:TRUE)
+    ca_key   — приватный ключ CA (RSA/Ed25519/ECDSA)
+    base_url — базовый URL, например "http://localhost:14000"
+    chain    — список промежуточных сертификатов (опционально)
+    """
+
+    def __init__(self, ca: CACert, ca_key, base_url: str, *,
+                 chain=None, cert_days: int = 90, auto_verify: bool = False):
+        if not ca_key.is_private:
+            raise X509Error("ca_key must be a private key")
+        if ca.public_key.to_public_pem() != ca_key.to_public_pem():
+            raise X509Error("ca_key does not match ca.public_key")
+
+        self.ca = ca
+        self.ca_key = ca_key
+        self.base_url = base_url.rstrip("/")
+        self.chain = list(chain or [])
+        self.cert_days = cert_days
+        self.auto_verify = auto_verify
+
+        self.nonces: set[str] = set()
+        self.accounts: dict[str, dict] = {}       # kid -> {jwk, key, ...}
+        self.orders:   dict[str, dict] = {}       # order_id
+        self.authzs:   dict[str, dict] = {}       # authz_id
+        self.chals:    dict[str, dict] = {}       # chal_id
+        self.certs:    dict[str, dict] = {}       # cert_id
+
+    # ---- nonces ----------------------------------------------------
+    def new_nonce(self) -> str:
+        n = b64u(secrets.token_bytes(16))
+        self.nonces.add(n)
+        return n
+
+    def consume_nonce(self, n: str) -> bool:
+        if n in self.nonces:
+            self.nonces.discard(n)
+            return True
+        return False
+
+    # ---- directory -------------------------------------------------
+    def directory(self) -> dict:
+        return {
+            "newNonce":   f"{self.base_url}/new-nonce",
+            "newAccount": f"{self.base_url}/new-account",
+            "newOrder":   f"{self.base_url}/new-order",
+            "revokeCert": f"{self.base_url}/revoke-cert",
+            "keyChange":  f"{self.base_url}/key-change",
+            "meta": {
+                "termsOfService": f"{self.base_url}/tos",
+                "website":        self.base_url,
+            },
+        }
+
+    # ---- accounts --------------------------------------------------
+    def new_account(self, jwk: dict, payload: dict):
+        thumbprint = jwk_thumbprint(jwk)
+        kid = f"{self.base_url}/acct/{thumbprint}"
+
+        if kid in self.accounts:
+            return kid, False
+
+        if not payload.get("termsOfServiceAgreed", False):
+            raise ACMEError("malformed", "termsOfServiceAgreed must be true")
+
+        self.accounts[kid] = {
+            "jwk": jwk,
+            "key": jwk_to_key(jwk),
+            "contact": payload.get("contact", []),
+            "created": time.time(),
+        }
+        return kid, True
+
+    def account_key(self, kid: str):
+        acc = self.accounts.get(kid)
+        if acc is None:
+            raise ACMEError("accountDoesNotExist", f"unknown kid: {kid}", 400)
+        return acc["key"]
+
+    def account_view(self, kid: str) -> dict:
+        acc = self.accounts[kid]
+        return {
+            "status": "valid",
+            "contact": acc["contact"],
+            "createdAt": datetime.fromtimestamp(
+                acc["created"], tz=timezone.utc,
+            ).strftime("%Y-%m-%dT%H:%M:%SZ"),
+        }
+
+    # ---- orders ----------------------------------------------------
+    def new_order(self, kid: str, payload: dict) -> dict:
+        idents = payload.get("identifiers") or []
+        if not idents:
+            raise ACMEError("malformed", "no identifiers in order")
+        for i in idents:
+            if i.get("type") != "dns":
+                raise ACMEError("unsupportedIdentifier",
+                                f"only 'dns' supported, got {i.get('type')}")
+
+        order_id = b64u(secrets.token_bytes(16))
+        authz_ids = [self._new_authz(kid, ident) for ident in idents]
+
+        expires = datetime.now(timezone.utc) + timedelta(days=7)
+        self.orders[order_id] = {
+            "id": order_id,
+            "account": kid,
+            "status": "pending",
+            "identifiers": idents,
+            "authz_ids": authz_ids,
+            "expires": expires.isoformat(),
+            "finalize_url": f"{self.base_url}/finalize/{order_id}",
+            "cert_id": None,
+        }
+        return self._order_view(order_id)
+
+    def _order_view(self, order_id: str) -> dict:
+        order = self.orders[order_id]
+        self._refresh_order(order)
+        view = {
+            "id": order_id,
+            "status": order["status"],
+            "expires": order["expires"],
+            "identifiers": order["identifiers"],
+            "authorizations": [
+                f"{self.base_url}/authz/{a}" for a in order["authz_ids"]
+            ],
+            "finalize": f"{self.base_url}/finalize/{order_id}",
+        }
+        if order["cert_id"]:
+            view["certificate"] = f"{self.base_url}/cert/{order['cert_id']}"
+        return view
+
+    def _refresh_order(self, order: dict) -> None:
+        if order["status"] not in ("pending", "ready"):
+            return
+        all_valid = True
+        any_invalid = False
+        for a in order["authz_ids"]:
+            st = self.authzs[a]["status"]
+            if st == "invalid":
+                any_invalid = True
+                break
+            if st != "valid":
+                all_valid = False
+        if any_invalid:
+            order["status"] = "invalid"
+        elif all_valid:
+            order["status"] = "ready"
+
+    def get_order(self, order_id: str) -> dict:
+        if order_id not in self.orders:
+            raise ACMEError("orderNotReady", f"unknown order: {order_id}", 404)
+        return self._order_view(order_id)
+
+    # ---- authz / challenge ----------------------------------------
+    def _new_authz(self, kid: str, ident: dict) -> str:
+        authz_id = b64u(secrets.token_bytes(16))
+        chal_id = b64u(secrets.token_bytes(16))
+        token = b64u(secrets.token_bytes(32))
+
+        jwk = self.accounts[kid]["jwk"]
+        key_auth = f"{token}.{jwk_thumbprint(jwk)}"
+
+        self.authzs[authz_id] = {
+            "id": authz_id, "account": kid,
+            "identifier": ident,
+            "status": "pending",
+            "challenge_id": chal_id,
+        }
+        self.chals[chal_id] = {
+            "id": chal_id, "authz": authz_id,
+            "type": "http-01", "token": token,
+            "key_auth": key_auth, "status": "pending",
+            "error": None,
+        }
+        return authz_id
+
+    def get_authz(self, authz_id: str) -> dict:
+        a = self.authzs.get(authz_id)
+        if a is None:
+            raise ACMEError("malformed", f"unknown authz: {authz_id}", 404)
+        c = self.chals[a["challenge_id"]]
+        return {
+            "status": a["status"],
+            "expires": (datetime.now(timezone.utc)
+                        + timedelta(days=7)).isoformat(),
+            "identifier": a["identifier"],
+            "challenges": [self._chal_view(c)],
+        }
+
+    def _chal_view(self, c: dict) -> dict:
+        v = {
+            "type": c["type"],
+            "url": f"{self.base_url}/challenge/{c['id']}",
+            "status": c["status"],
+            "token": c["token"],
+        }
+        if c["error"]:
+            v["error"] = {
+                "type": "urn:ietf:params:acme:error:unauthorized",
+                "detail": c["error"],
+            }
+        return v
+
+    def trigger_challenge(self, chal_id: str, *, fetcher=None) -> dict:
+        c = self.chals.get(chal_id)
+        if c is None:
+            raise ACMEError("malformed", f"unknown challenge: {chal_id}", 404)
+        if c["status"] == "valid":
+            return self._chal_view(c)
+
+        authz = self.authzs[c["authz"]]
+        domain = authz["identifier"]["value"]
+        path = f"/.well-known/acme-challenge/{c['token']}"
+
+        if self.auto_verify:
+            c["status"] = "valid"
+            authz["status"] = "valid"
+            return self._chal_view(c)
+
+        fetch = fetcher or self._default_fetcher
+        try:
+            body = fetch(f"http://{domain}{path}")
+        except Exception as e:
+            c["error"] = f"fetch failed: {e}"
+            c["status"] = "invalid"
+            authz["status"] = "invalid"
+            return self._chal_view(c)
+
+        if body.strip() != c["key_auth"]:
+            c["error"] = "key authorization mismatch"
+            c["status"] = "invalid"
+            authz["status"] = "invalid"
+            return self._chal_view(c)
+
+        c["status"] = "valid"
+        authz["status"] = "valid"
+        return self._chal_view(c)
+
+    @staticmethod
+    def _default_fetcher(url: str) -> str:
+        with urllib.request.urlopen(url, timeout=10) as r:
+            return r.read().decode("utf-8", "replace")
+
+    # ---- finalize --------------------------------------------------
+    def finalize(self, order_id: str, payload: dict) -> dict:
+        if order_id not in self.orders:
+            raise ACMEError("orderNotReady", f"unknown order: {order_id}", 404)
+        order = self.orders[order_id]
+        self._refresh_order(order)
+        if order["status"] != "ready":
+            raise ACMEError("orderNotReady",
+                            f"order status is {order['status']}, expected ready",
+                            403)
+
+        csr_b64 = payload.get("csr")
+        if not csr_b64:
+            raise ACMEError("malformed", "finalize payload missing csr")
+        csr_der = b64u_decode(csr_b64)
+
+        try:
+            csr = CSR(csr_der)
+        except X509Error as e:
+            raise ACMEError("badCSR", f"cannot parse CSR: {e}")
+        if not csr.verify_signature():
+            raise ACMEError("badCSR", "CSR self-signature invalid")
+
+        csr_names = set(csr.dns_names)
+        for ident in order["identifiers"]:
+            if ident["value"] not in csr_names:
+                raise ACMEError("badCSR",
+                                f"CSR missing identifier {ident['value']!r}")
+
+        leaf = (CertificateBuilder.from_csr(csr)
+            .add_issuer(self.ca)
+            .add_serial_random()
+            .add_validity(days=self.cert_days)
+            .sign(self.ca_key))
+
+        cert_id = b64u(secrets.token_bytes(16))
+        # RFC 8555 §7.4.2: сервер ОБЯЗАН отдать fullchain — leaf + issuer(s).
+        # Certbot требует минимум 2 сертификата. Если промежуточных нет,
+        # включаем сам CA как последний элемент chain.
+        chain_der = [c.der for c in self.chain]
+        if not chain_der:
+            chain_der = [self.ca.der]
+        self.certs[cert_id] = {
+            "der": leaf.der,
+            "chain_der": chain_der,
+            "order": order_id,
+        }
+        order["status"] = "valid"
+        order["cert_id"] = cert_id
+        return self._order_view(order_id)
+
+    def get_certificate(self, cert_id: str) -> str:
+        c = self.certs.get(cert_id)
+        if c is None:
+            raise ACMEError("malformed", f"unknown cert: {cert_id}", 404)
+        from .x509 import Cert as _C
+        pem = _C(c["der"]).to_pem()
+        for d in c["chain_der"]:
+            pem += _C(d).to_pem()
+        return pem

{x509kit-0.3.2 → x509kit-0.4.0}/src/x509kit/x509.py

@@ -44,7 +44,7 @@ import socket
 import unicodedata
 import warnings as _warnings
 
-__version__ = "0.3.2"
+__version__ = "0.4.0"
 
 
 # ======================================================================

{x509kit-0.3.2 → x509kit-0.4.0/src/x509kit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: x509kit
-Version: 0.3.2
+Version: 0.4.0
 Summary: Pure-Python X.509 / PKCS#10 / CRL / OCSP / PKCS#12 toolkit — stdlib only
 Author-email: ArtProsto <artemkamirn@mail.ru>
 License: MIT

{x509kit-0.3.2 → x509kit-0.4.0}/src/x509kit.egg-info/SOURCES.txt

@@ -22,10 +22,13 @@ examples/09_encrypted_key.py
 examples/10_verify_chain.py
 examples/11_name_canonicalization.py
 examples/12_extensions.py
+examples/13_acme_server.py
+examples/14_acme_client.py
 examples/README.md
 flask/test_live_ca.py
 flask/test_mtls.py
 src/x509kit/__init__.py
+src/x509kit/acme.py
 src/x509kit/py.typed
 src/x509kit/x509.py
 src/x509kit.egg-info/PKG-INFO

{x509kit-0.3.2 → x509kit-0.4.0}/test_all.py

@@ -1060,27 +1060,23 @@ def test_cert_info():
 
     info = cert.info()
 
-    checks = [
-        ("начинается с 'Certificate:'", info.startswith("Certificate:")),
-        ("есть 'Version: 3'",           "Version: 3" in info),
-        ("есть 'Serial Number:'",       "Serial Number:" in info),
-        ("есть 'Signature Algorithm:'", "Signature Algorithm:" in info),
-        ("есть 'Issuer:'",              "Issuer:" in info),
-        ("есть 'Validity'",             "Validity" in info),
-        ("есть 'Not Before'",           "Not Before:" in info),
-        ("есть 'Not After'",            "Not After :" in info),
-        ("есть 'Subject:'",             "Subject:" in info),
-        ("есть 'Subject Public Key Info:'",
-         "Subject Public Key Info:" in info),
-        ("есть 'Public Key Algorithm: ED25519'",
-         "Public Key Algorithm: ED25519" in info),
-        ("есть 'X509v3 extensions:'",   "X509v3 extensions:" in info),
-        ("есть 'X509v3 Subject Alternative Name'",
-         "X509v3 Subject Alternative Name" in info),
-        ("есть SAN содержимое",         "info.example" in info),
-    ]
-    for label, ok in checks:
-        T.expect(label, ok)
+    T.expect("начинается с 'Certificate:'", info.startswith("Certificate:"))
+    T.expect("есть 'Version: 3'",           "Version: 3" in info)
+    T.expect("есть 'Serial Number:'",       "Serial Number:" in info)
+    T.expect("есть 'Signature Algorithm:'", "Signature Algorithm:" in info)
+    T.expect("есть 'Issuer:'",              "Issuer:" in info)
+    T.expect("есть 'Validity'",             "Validity" in info)
+    T.expect("есть 'Not Before'",           "Not Before:" in info)
+    T.expect("есть 'Not After'",            "Not After :" in info)
+    T.expect("есть 'Subject:'",             "Subject:" in info)
+    T.expect("есть 'Subject Public Key Info:'",
+             "Subject Public Key Info:" in info)
+    T.expect("есть 'Public Key Algorithm: ED25519'",
+             "Public Key Algorithm: ED25519" in info)
+    T.expect("есть 'X509v3 extensions:'",   "X509v3 extensions:" in info)
+    T.expect("есть 'X509v3 Subject Alternative Name'",
+             "X509v3 Subject Alternative Name" in info)
+    T.expect("есть SAN содержимое",         "info.example" in info)
 
 
 def test_pkcs12_shortcuts():