Package: certauth2
Fork ofhttps://github.com/ikreymer/certauthwith a lot of changes.Use cryptography.Ability to use password with the ca or host certificatesAbility to select encoding to use for backendAbility to cache credentials in the desired formatCertificate Authority Certificate Maker ToolsThis package provides a small library, built on top ofcryptography, which allows for creating a custom certificate authority certificate, and genereating on-demand dynamic host certs.It is most useful for use with a man-in-the-middle HTTPS proxy, for example, for recording or replaying web content.Trusting the CA created by this tool should be used with caution in a controlled setting to avoid security risks.CertificateAuthority APITheCertificateAuthorityclass provides an interface to manage a root CA and generate dynamic host certificates suitable
for use with the native Pythonssllibrary as well as pyOpenSSLSSLmodule and also with thecryptographymodule.The class provides several options for storing the root CA and generated host CAs.File-based Certificate Cache# Create a store that returns paths to the files it created, also choose an encoding for saving the files## DER return 3 paths (cert, key, chain) , the chain is a tar archive with a der encoded file per cert in chain## PEM and PKCS12 return 1 pathcertStore=ondiskPathStore("/tmp/certs",encoding=Encoding.PEM)# First argument is the certificate to use the format for a file based certificate is:## A tuple with 3 elements: <filepath:str>, <cert_name:str|None>, <password:str|None>## Or a single string: <filepath:str>ca=CertificateAuthority(('my-ca.pem','My Custom CA',None),cache=certStore)(filename,)=ca['example.com']In this configuration, the root CA is stored atmy-ca.pemand dynamically generated certs
are placed in/tmp/certs. Thefilenamereturned would be/tmp/certs/example.com.pemin this example.This filename can then be used with the Pythonssl.load_cert_chain(certfile)command.Note that the dynamically created certs are never deleted bycertauth, it remains up to the user to handle cleanup occasionally if desired.In-memory Certificate Cachefromcertauth2importCertificateAuthorityca=CertificateAuthority(("My Custom CA","my-ca.pem",None),cache=50)key,cert,chain=ca["example.com"].to_pyopenssl()This configuration stores the root CA atmy-ca.pembut uses an in-memory certificate cache for dynamically created certs.
By default the default store returns X509Credentials which are just a NamedTuple of (cert, key, chain) incryptographyformat with methods to help load, dump and transform them into other formats.These certs are stored in an LRU cache, configured to keep at most 50 certs.Thecertandkeycan then be used withOpenSSL.SSL.Context.use_certificatecontext=SSl.Context(...)context.use_privatekey(key)context.use_certificate(cert)forcainchain:context.add_extra_chain_cert(ca)Custom CacheA custom cache implementations which stores and retrieves per-host certificates can also be provided:fromcertauth2importCertificateAuthorityfromcertauth2.cacheimportCacheclassPyOpenSSLCredentialStore(Cache):def__init__(self):self._cache={}def__setitem__(self,key,item):self._cache[key]=item.to_pyopenssl()def__getitem__(self,key):returnself._cache[key]ca=CertificateAuthority('my-ca.pem',cache=PyOpenSSLCredentialStore())key,cert,chain=ca['example.com']context=SSl.Context(...)context.use_privatekey(key)context.use_certificate(cert)forcainchain:context.add_extra_chain_cert(ca)Wildcard CertsTo reduce the number of certs generated, it is convenient to generate wildcard certs.
For full functionality also install tld librarycreds=ca.load_creds('test.example.com',domain_cert=True)This will generate a cert for*.example.com.creds=ca.load_creds('test.example.com',sans=["*.test.example.com"])This will also generate a cert for*.test.example.comandtest.example.comcreds=ca.load_creds('test.example.com',domain_cert=True,sans=["*.test.example.com"])This will also generate a cert for*.test.example.com,test.example.comand*.example.comAlternative FQDNs or IPs in SANSometimes, you want to add alternative FQDNs or IPs as Subject Alternative Names
to your certificate. To do that, simply use thesansparams:creds=ca.load_cert('example.com',sans=['example.org','192.168.1.1'])This will generate a cert forexample.comwithexample.organd192.168.1.1in
the SAN.Each san can be an ip asstr|IPv4Address|IPv6Addressa dns asstrorx509.GeneralNameCLI Usage Examplescertauthalso includes a simple command-line API for certificate creation and management.usage: __main__.py [-h] [-c ISSUERNAME] [--issuerpass ISSUERPASS] [-n HOSTNAME] [-d CERTS_DIR] [-f] [-S SANS] issuer

Certificate Authority Cert Maker Tools

positional arguments:
issuer                Path to existing CA or for a new root CA file

optional arguments:
-h, --help            show this help message and exit
-c ISSUERNAME, --issuername ISSUERNAME
                        Name for issuer CA certificate
--issuerpass ISSUERPASS
                        Issuer cert file password
-n HOSTNAME, --hostname HOSTNAME
                        Hostname certificate to create
-d CERTS_DIR, --certs-dir CERTS_DIR
                        Directory for host certificates
-f, --force           Overwrite certificates if they already exist
-S SANS, --sans SANS  add Subject Alternate Name to the certTo create a new root CA certificate:certauth myrootca.pem--issuername"My Test CA"To create a host certificate signed with CA certificate in directorycerts_dir:certauth myrootca.pem--hostname"example.com"-d./certs_dirIf the root cert doesn’t exist, it’ll be created automatically.
Ifcerts_dir, doesn’t exist, it’ll be created automatically also.The cert forexample.comwill be created ascerts_dir/example.com.pem.
If it already exists, it will not be overwritten (unless-foption is used).The-woption can be used to create a wildcard cert which has subject alternate names (SAN) forexample.comand*.example.com