Package: certipie
certipieA utility library to create certificate signing request and self-signed certificates.Why?There are three main reasons why I decide to do this:I am anerdwho loves to code. Yeah, I need to be honest here, it was an opportunity for me to play with the
excellentcryptographylibrary.I currently work in a company where we deal a lot with certificates, and I know it can be handy to have a simple tool
to generate certificate signing request, so I decide to create one.When creating or working with network servers, we often need to test certificate handling, so it is convenient to have
a tool to quickly generate a self-signed certificate.Notes:If you want a tool to handle a whole certificate life cycle for your project, consider using a library likecertbot.If you just want a tool to create certificates on the fly during unit tests, consider usingtrustme.InstallationThe minimal python version supported is3.9. You can install the library usingpipwith the following command:$pipinstallcertipieYou can also use an alternative package manager likepoetry:$poetryaddcertipieUsageThere are three ways to use certipie.The command line interfaceThis is probably the main way to use it. The project includes a convenientcertcommand line interface.$cert
Usage:cert[OPTIONS]COMMAND[ARGS]...Aclitogeneratecertificatesigningrequestandself-signedcertificatethatcanbeusedfortestingpurpose.

Options:--versionShowtheversionandexit.-h,--helpShowthismessageandexit.

Commands:auto-certCreatesaself-signedcertificateusefulfortests.csrCreatesacertificatesigningrequestfilegiven...install-completionInstallcompletionscriptforbash,zshandfish...rsaCreatesapairofprivate/publickeysusingtheRSA...serverServesaswaggerUIwhereyoucanperformthesame...install-completionThe first command you will want to use isinstall-completionlike the name said will allow options and commands
completion. The shells currently supported arebash,fishandzsh.$certinstall-completionrsaTo create a certificate signing request or a self-signed certificate, you need a private key. Thecertcommand allows
you to create anRSAprivate key which is one of the most common (if not the most common) private keys used for this
type of operation.$certrsa
Enterthepassphrase[passphrase]:
Repeatforconfirmation:
Thepairofkeyswassuccessfullyin...Note: On all commands, you can use-hoption to get their usage documentation.csrThis commands helps you create a certificate signing request.$certcsr-fcsr.pem
Organization:orga
State:Ile-de-France
Country:FR
City:Paris
Name:site.com
Thecertificatesigningrequesthasbeensuccessfullycreatedin/home/kevin/...Notes:In the previous example since no private key was passed as input, thecsrcommand creates anRSAone with no
password in the same directory where the certificate signing request is created. If you want to provide one, use the-koption and gives the path to the private key, e.g:cert csr -k /path/to/private/key. It is not mandatory that
the private key is of type RSA. In fact other algorithms are supported like DSA or elliptic curve. For a full list of
supported algorithms, lookPrivateKeytype in modulecertipie.types.If you pass a key file, you will be prompted to give the password. If you don't provide a password to your private
key, just typeEnterto continue.The--countryoption must be a two-letters value. To know the two-letters code of a country, you can check thiswebsite.The--nameoption value is used as the domain name to submit for the certificate signing request. In the previous
example, it will besite.com. Wildcards like*.site.comare supported.If you want to include many domain names in the certificate signing request, not only the--namevalue, you can use
the--alt-namesoption like the following:cert csr --alt-names=site.com,foo.site.com. The valuesmustbe separated by commas.auto-certThis command helps you create a self-signed certificate useful when you want to test a network server like an HTTP
server.$certauto-cert-fcert.pem--validity=360Organization:orga
State:Ile-de-France
Country:FR
City:Paris
Theself-signedcertificatehasbeensuccessfullycreatedin/home/kevin/...Notes:The notes from thecsrcommand also applies here.Since we often work on our own computer in this case,localhostis the default--nameoption.--alt-namesalso accepts ip adresses and networks. You can have a value like the following:cert auto-cert --alt-names=localhost,192.168.1.0/24.--validityoption represents the number of days the certificate will be valid. If not provided, it is365.serverThis commands runs a server which serves a Swagger UI where you can perform the previous commands explained above. This
is handy if you want non-technical staff to be able to use the command line features.$certserverIf you open a browser onhttp://localhost:8000you will see the swagger documentation.Under the hood the server used ishypercorn. You can configure it passing atomlconfiguration file. To know all the settings available, refer to theofficial documentation.$certserver-c/path/to/toml/fileThe REST APIFollowing the previous section about serving a swagger UI, if you think that it does not well suits your organization,
you can adjust it. The api is created using theFastAPIweb framework. For example if
you want to integrate it in your own fastapi application, you can use the router provided by certipie.This way you can adjust the url used for the certificate routes, for example/certificateinstead of/certs, change
documentation url, add some authentication to routes, etc...
Therouterconcept is a powerful feature from FastAPI.fromfastapiimportFastAPIfromcertipieimportrouterapp=FastAPI(title='certificate api',description='Your description',redoc_url=None,docs_url='/documentation')app.include_router(router,prefix='/certificate',tags=['certificate'])Transform the api to suit your needs :)The certipie APIThe last way to leverage certipie is to interact programmatically with its api. The following functions are exposed:create_private_key: Creates an RSA private key.get_public_key_from_private_key: Extracts a public key from a private key.create_csr: Creates a certificate signing request.create_auto_cert: Creates a self-signed certificate.Normally the api usage should be straightforward. The behaviour is the same as the command line. You can also look at
tests if you are blocked.Here is a snippet on how to create a certificate signing request usingcreate_csr:fromcertipieimportcreate_csrcreate_csr('csr.pem','FR','Ile-de-France','Paris','organization','site.com',alternative_names=['site.com','foo.site.com'],private_key='key.pem',passphrase='passphrase')There are two others objets exported:app: The fastapi application used when runningcert servercommand. It is exposed so that you canmountit in another application if you want.PrivateKey: The type annotation for all the private keys supported by thecryptographylibrary.