Package: blitz-ca
A tool for managing the signing and generation of CSRs as well as the creation of certificate AuthoritiesFeaturesIts not the openssl commandSane flagsIts not the openssl commandinternal API to leverage in your own appsIts not the openssl commandSingle File Certificate store based off sqlite makes backups easyHuman readable times that become more accurate as the appointed time gets closer
eg ‘3 days from now’ to ‘3 hours from now’ to ‘03:14’Ability to add comments to certificates, keys and requestsGenerate CRLs’Webserver to provision new certificates to bearers of a valid (but soon to
expire) certificate allowing automatic update of certificates via a cronjobInstallationTo create a virtual environment use the following commandspyvenv-3.4 –system-site-packages venv
. bin/venv/activate
pip install blitz-cato activate the environment in another terminal repeat the activate step as shown below. bin/venv/activateas this is an argparse based program, comprehensive help is available by specifying ‘-h’ or ‘–help’
to receive help on a sub command, use ‘-h’ as above after the sub command itselfAt this time there is no other documentation avalible but those who have
created certificates and CSRs with the openssl command should be fammilar
enough with the terminolgy and process to use the program.ExamplesCreating a self signed certificateblitz-ca cert new www.pocketnix.orgCreating a certificate with a Subject Alternative Nameblitz-ca cert new www.pocketnix.org pocketnix.orgTo specify values such as the Email address, locality or country to embed in the cert you can use the
form ‘shortname=value’ or ‘longname=value’ and add it on the end. These values are case sensitive and
in the case of the long hand versions are camelCaseblitz-ca cert new www.pocketnix.org “locality=The Moon”emailAddress=operations@moonbase.pocketnix.orgAlternatively, to be prompted for the values of most of the commonly used or expected fields add the
‘-p’ flagblitz-ca cert new -p www.pocketnix.orgThe alternate Subject alt names are also supported allowing you to issue a mail signing certificate for
multiple email addressesblitz-ca cert new pocketnix.orgemailAddress=myemail@pocketnix.orgemail:anotheremail@pocketnix.orgWhat WorksKey GenerationCert GenerationRequest GenerationRequest SigningArbitrary x509 extensionsSubject alternative namesKey usageRSA and DSA keys of arbitrary bit lengthWhat does not WorkTracking of issued certsCRL GenerationAuto Enrolment webserverConfirmation before signing a requestElliptic Curve keysNotesIf you do not specify a key then one will be created for you automaticly aspart of the CSR or certificate generation. if you are having trouble matching a
CSR up to a private key at generation time, consider using the ‘-C’ flag to add
a comment to both the private key and CSRSigning a request will copy extensions from the request into the certificate
however there is currently no way to audit the request before signing and approve
extensionsCertificates are backdated by 1 hour to help prevent issues with clients/servers
with clock drift (if you have 1 hour of clock drift you ahve bigger issues but
daylight savigns may cause issues)Release History0.1.1 (2014-11-05)Re-release to fix upload0.1 (2014-11-05)Initial ReleaseKey generationCert generationRequest generationRequest signing