Package: certauth
Certificate Authority Certificate Maker ToolsThis package provides a small library, built on top ofpyOpenSSL, which allows for creating a custom certificate authority certificate,
and genereating on-demand dynamic host certs using that CA certificate.It is most useful for use with a man-in-the-middle HTTPS proxy, for example, for recording or replaying web content.Trusting the CA created by this tool should be used with caution in a controlled setting to avoid security risks.CertificateAuthority APITheCertificateAuthorityclass provides an interface to manage a root CA and generate dynamic host certificates suitable
for use with the native Pythonssllibrary as well as pyOpenSSLSSLmodule.The class provides several options for storing the root CA and generated host CAs.File-based Certificate Cacheca=CertificateAuthority('My Custom CA','my-ca.pem',cert_cache='/tmp/certs')filename=ca.cert_for_host('example.com')In this configuration, the root CA is stored atmy-ca.pemand dynamically generated certs
are placed in/tmp/certs. Thefilenamereturned would be/tmp/certs/example.com.pemin this example.This filename can then be used with the Pythonssl.load_cert_chain(certfile)command.Note that the dynamically created certs are never deleted bycertauth, it remains up to the user to handle cleanup occasionally if desired.In-memory Certificate Cacheca=CertificateAuthority('My Custom CA','my-ca.pem',cert_cache=50)cert,key=ca.load_cert('example.com')This configuration stores the root CA atmy-ca.pembut uses an in-memory certificate cache for dynamically created certs.
These certs are stored in an LRU cache, configured to keep at most 50 certs.Thecertandkeycan then be used withOpenSSL.SSL.Context.use_certificatecontext=SSl.Context(...)context.use_privatekey(key)context.use_certificate(cert)Custom CacheA custom cache implementations which stores and retrieves per-host certificates can also be provided:ca=CertificateAuthority('My Custom CA','my-ca.pem',cert_cache=CustomCache())cert,key=ca.load_cert('example.com')classCustomCache:def__setitem__(self,host,cert_string):# store cert_string for hostdefget(self,host):# return cached cert_string, if availablecert_string=...returncert_stringWildcard CertsTo reduce the number of certs generated, it is convenient to generate wildcard certs.cert,key=ca.load_cert('example.com',wildcard=True)This will generate a cert for*.example.com.To automatically generate a wildcard cert for parent domain, use:cert,key=ca.load_cert('test.example.com',wildcard=True,wildcard_for_parent=True)This will also generate a cert for*.example.comStarting with 1.3.0,certauthusestldextractto determine the tld for a given host,
and will not use a parent domain if it is itself a tld suffix.For example, calling:cert,key=ca.load_cert('example.co.uk',wildcard=True,wildcard_for_parent=True)will now result in a cert for*.example.co.uk, not*.co.uk.CLI Usage Examplescertauthalso includes a simple command-line API for certificate creation and management.usage: certauth [-h] [-c CERTNAME] [-n HOSTNAME] [-d CERTS_DIR] [-f] [-w]
              root_ca_cert

positional arguments:
  root_ca_cert          Path to existing or new root CA file

optional arguments:
  -h, --help            show this help message and exit
  -c CERTNAME, --certname CERTNAME
                      Name for root certificate
  -n HOSTNAME, --hostname HOSTNAME
                      Hostname certificate to create
  -d CERTS_DIR, --certs-dir CERTS_DIR
                      Directory for host certificates
  -f, --force           Overwrite certificates if they already exist
  -w, --wildcard_cert   add wildcard SAN to host: *.<host>, <host>To create a new root CA certificate:certauth myrootca.pem--certname"My Test CA"To create a host certificate signed with CA certificate in directorycerts_dir:certauth myrootca.pem--hostname"example.com"-d./certs_dirIf the root cert doesn’t exist, it’ll be created automatically.
Ifcerts_dir, doesn’t exist, it’ll be created automatically also.The cert forexample.comwill be created ascerts_dir/example.com.pem.
If it already exists, it will not be overwritten (unless-foption is used).The-woption can be used to create a wildcard cert which has subject alternate names (SAN) forexample.comand*.example.comHistoryThe CertificateAuthority functionality has evolved from certificate management originally found in the man-in-the-middle proxypymiproxyby Nadeem Douba.It was also extended inwarcproxbyNoah Levittof Internet Archive.The CA functionality was also reused inpywband finally factored out into this separate package for modularity.It is now also used bywsgiproxto provide a generalized HTTPS proxy wrapper to any WSGI application.