Package: quara-creds
QUARA CredsCLI usageDisplay helpSeveral subcommands are available. The--helpoption is available at different levels:# General helppync--help# cert command group helppynccert--help# cert sign subcommand helppynccertsign--helpInitialize environmentInitialize with default configurationpyncinitReset configurationpyncinit--forceConfigure authorities from a JSON file (either a path or an URL):pyncinit--authoritieshttps://example.com/authorities.jsonManage keypairsCreate a new keypair for current user:pynckeygenCreate a new keypair for a different user:pynckeygen-ntestList available keypairspynckeylistDisplay a public keypynckeyshow-ntestDisplay a private keypynckeyshow-ntest--privateManager certificate authoritiesList available authorities:pynccalistShow authorities details:pynccashowShow authorities certificates:pynccashow--pemNebula certs examplesCreate a new CA and a sign a new certificatefromquara.creds.nebulaimport(EncryptionKeyPair,SigningCAOptions,SigningOptions,sign_ca_certificate,sign_certificate,verify_certificate,)# Create a new CAca_keypair,ca_crt=sign_ca_certificate(options=SigningCAOptions(Name="test"))# Create a new keypair for the certificateenc_keypair=EncryptionKeyPair()# Sign a new certificatenew_crt=sign_certificate(ca_key=ca_keypair,ca_crt=ca_crt,public_key=enc_keypair,options=SigningOptions(Name="test",Ip="10.100.100.10/24",),)# Write files to diskca_crt.write_pem_file("ca.crt")ca_keypair.write_private_key("ca.key")new_crt.write_pem_file("node.crt")enc_keypair.write_private_key("node.key")enc_keypair.write_public_key("node.pub")# Verify that the certificate is validverify_certificate(ca_crt=ca_crt,crt=new_crt)This example generates 5 files:ca.crt: The CA certificate created during the first step.ca.key: The private key of the CA. The public key is also present within this file.node.crt: The certificate created during the second step.node.key: The private key associated with the certificate. Unlike CA private keys, the public key is not present within the file.node.pub: The public key associated with the certificate. The public key is also embedded within the certificate.Load an existing CA and sign a new certificatefromquara.creds.nebulaimport(Certificate,EncryptionKeyPair,SigningKeyPair,SigningOptions,sign_certificate,verify_certificate,)# Load CA certificateca_crt=Certificate.from_file("ca.crt")# Load CA keypairca_keypair=SigningKeyPair.from_file("ca.key")# Create a new keypair for the certificateenc_keypair=EncryptionKeyPair()# Sign a new certificatenew_crt=sign_certificate(ca_key=ca_keypair,ca_crt=ca_crt,public_key=enc_keypair,options=SigningOptions(Name="test",Ip="10.100.100.10/24",),)# Write files to disknew_crt.write_pem_file("node.crt")enc_keypair.write_private_key("node.key")enc_keypair.write_public_key("node.pub")# Verify that the certificate is validverify_certificate(ca_crt=ca_crt,crt=new_crt)In this case, only 3 files are created, as the CA certificate and the CA key already existed before.Load an existing CA, an existing public key, and sign a new certificatefromquara.creds.nebulaimport(Certificate,PublicEncryptionKey,SigningKeyPair,SigningOptions,sign_certificate,verify_certificate,)# Load CA certificateca_crt=Certificate.from_file("ca.crt")# Load CA keypairca_keypair=SigningKeyPair.from_file("ca.key")# Load public key from filepub_key=PublicEncryptionKey.from_file("node.pub")# Sign a new certificatenew_crt=sign_certificate(ca_key=ca_keypair,ca_crt=ca_crt,public_key=pub_key,options=SigningOptions(Name="test",Ip="10.100.100.10/24",),)# Write files to disknew_crt.write_pem_file("node.crt")# Verify that the certificate is validverify_certificate(ca_crt=ca_crt,crt=new_crt)In this case, only the certificate file is written to disk, as all other information was known before issuing the certificate.