Package: certpy
certpySelf-signed SSL certificate generator :closed_lock_with_key:This tool is an experiment to learn"How to create a self-signed certificate".InstallationWithpip:pip install certpyInstall from source (you need to installpython-pdmfirst):git clone https://github.com/aprilahijriyan/certpy.git
cd certpy
pdm installUsageCertPy provides a workflow file, which will be used to instruct the creation of the certificate.The workflow file name iscertpy.yml(you cannot change the file name or extension to.yaml) and the workflow file must be in the directory you are working in.Here's an example of a workflow:# Save it as certpy.yml in the current directory.
certificate_age: &age
  days: 365

certificates:
  kuli:
    type: ca
    distinguished_name:
      countryName: ID
      stateOrProvinceName: Indonesia
      localityName: Jawa Barat
      organizationName: Kuli Dev
      organizationalUnitName: OSS
      commonName: Kuli Dev Root CA
      emailAddress: null
    age: *age
    hash: sha256
    overwrite: true

  server:
    type: server
    distinguished_name:
      commonName: Server
    ca_file: kuli
    age: *age
    hash: sha256
    san:
      ip:
        - 192.168.18.203
      dns:
        - ca.example.com
    overwrite: true

  client:
    type: client
    distinguished_name:
      commonName: Client
    ca_file: kuli
    age: *age
    hash: sha256
    overwrite: trueThen, create a CertPy environment (this is to hold all certificates created by CertPy).# this will create a `~/.certpy` directory and create a default `Root CA` certificate stored in `~/.certpy/ca/certs/rootCA.pem`.certpycainitNow you can create your own certificate from the workflow file!$ certpy create
                                  'kuli' Root CA
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CA File                               ┃ CA Key                                  ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ /home/april/.certpy/ca/certs/kuli.pem │ /home/april/.certpy/ca/private/kuli.key │
└───────────────────────────────────────┴─────────────────────────────────────────┘
                                     'server' Certificate
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Cert File                                   ┃ Cert Key                                      ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ /home/april/.certpy/server/certs/server.pem │ /home/april/.certpy/server/private/server.key │
└─────────────────────────────────────────────┴───────────────────────────────────────────────┘
                                     'client' Certificate
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Cert File                                   ┃ Cert Key                                      ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ /home/april/.certpy/client/certs/client.pem │ /home/april/.certpy/client/private/client.key │
└─────────────────────────────────────────────┴───────────────────────────────────────────────┘You can verify the self-signed certificate, using the command:$ openssl verify -verbose -CAfile /home/april/.certpy/ca/certs/kuli.pem /home/april/.certpy/server/certs/server.pem
/home/april/.certpy/server/certs/server.pem: OKAll certificates generated by CertPy will be stored in the~/.certpydirectory. And each type of certificate is stored in a different directory.ForRoot CAstored in~/.certpy/ca.ForServer Certificatestored in~/.certpy/server.ForClient Certificatestored in~/.certpy/client.In the directory~/.certpy/{ca,server,client}there are 2 directories.Thecertsdirectory is used to store certificates.Theprivatedirectory is used to store certificate keys.Workflow structure detailsAboutcertificatesin workflow fileIt contains the definition of certificate.
In CertPy only supportsRoot CA,ServerandClientcertificate types.Each type of certificate has a different data structure. Read more below...AboutRoot CACertificateThe structure forRoot CAis as follows:type: set tocato mark if this is aRoot CAcertificate. (required)distinguished_name: (object,required)countryName: Country Code (e.g.ID) (optional)stateOrProvinceName: State (e.g.Indonesia) (optional)localityName: Province (e.g.Jawa Barat) (optional)organizationName: Organization Name (e.g.Kuli Dev) (optional)organizationalUnitName: Organization Unit Name (e.g.OSS) (optional)commonName: Common Name (e.g.Kuli Dev Root CA) (required)emailAddress: Email address (e.g.your@company.com) (optional)age: (object,required)You must fill in one of the fields below. For example filldayswith365(which is a certificate valid in 1 year)dayssecondsmicrosecondsmillisecondsminuteshoursweekshash: Seehttps://www.pyopenssl.org/en/latest/api/crypto.html#digest-names(required)overwrite: If it is set totrueit will overwrite the old certificate with the new one. By default, if the certificate already exists it will be skipped. (bool,optional)AboutServerCertificateIts structure is the same asRoot CA.However, there is a slight addition to theServercertificate. Here's a list of the new fields in theservercertificate:ca_file: (strorarray,required)The CA file is required to sign certificates forserverorclient.If it isstr, it will use theRoot CAcertificate from the workflow file.If usingarray, must have 2 items. For example index0isCA Fileand index1isCA Key.san: (object,required)ip: IP address list (array)dns: Domain name list (array)Note: the certificate must be marked withtype: serverif you want to create a certificate forServer.AboutClientCertificateIts structure is the same asServer Certificate.However, on the client certificate it doesn't have asanfield.Note: the certificate must be marked withtype: clientif you want to create a certificate forClient.Related projectsCertPy is heavily inspired by the following tools:mkcertstep-cli