def install_certificate(self, certificate_dict, vhost): cert_chain_abspath = None cert_fd, self.cert_file = le_util.unique_file(CERT_PATH, 644) cert_fd.write( crypto_util.b64_cert_to_pem(certificate_dict["certificate"])) cert_fd.close() logger.info("Server issued certificate; certificate written to %s" % self.cert_file) if certificate_dict.get("chain", None): chain_fd, chain_fn = le_util.unique_file(CHAIN_PATH, 644) for c in certificate_dict.get("chain", []): chain_fd.write(crypto_util.b64_cert_to_pem(c)) chain_fd.close() logger.info("Cert chain written to %s" % chain_fn) # This expects a valid chain file cert_chain_abspath = os.path.abspath(chain_fn) for host in vhost: self.config.deploy_cert(host, os.path.abspath(self.cert_file), os.path.abspath(self.key_file), cert_chain_abspath) # Enable any vhost that was issued to, but not enabled if not host.enabled: logger.info("Enabling Site " + host.file) self.config.enable_site(host) # sites may have been enabled / final cleanup self.config.restart(quiet=self.curses) display.success_installation(self.names)
def save_certificate(self, certificate_msg, cert_path, chain_path): # pylint: disable=no-self-use """Saves the certificate received from the ACME server. :param certificate_msg: ACME "certificate" message from server. :type certificate_msg: :class:`letsencrypt.acme.messages.Certificate` :param str cert_path: Path to attempt to save the cert file :param str chain_path: Path to attempt to save the chain file :returns: cert_file, chain_file (absolute paths to the actual files) :rtype: `tuple` of `str` :raises IOError: If unable to find room to write the cert files """ cert_chain_abspath = None cert_fd, cert_file = le_util.unique_file(cert_path, 0o644) cert_fd.write(certificate_msg.certificate.as_pem()) cert_fd.close() logging.info("Server issued certificate; certificate written to %s", cert_file) if certificate_msg.chain: chain_fd, chain_fn = le_util.unique_file(chain_path, 0o644) for cert in certificate_msg.chain: chain_fd.write(cert.to_pem()) chain_fd.close() logging.info("Cert chain written to %s", chain_fn) # This expects a valid chain file cert_chain_abspath = os.path.abspath(chain_fn) return os.path.abspath(cert_file), cert_chain_abspath
def install_certificate(self, certificate_dict, vhost): cert_chain_abspath = None cert_fd, self.cert_file = le_util.unique_file(CERT_PATH, 644) cert_fd.write( crypto_util.b64_cert_to_pem(certificate_dict["certificate"])) cert_fd.close() logger.info("Server issued certificate; certificate written to %s" % self.cert_file) if certificate_dict.get("chain", None): chain_fd, chain_fn = le_util.unique_file(CHAIN_PATH, 644) for c in certificate_dict.get("chain", []): chain_fd.write(crypto_util.b64_cert_to_pem(c)) chain_fd.close() logger.info("Cert chain written to %s" % chain_fn) # This expects a valid chain file cert_chain_abspath = os.path.abspath(chain_fn) for host in vhost: self.config.deploy_cert(host, os.path.abspath(self.cert_file), os.path.abspath(self.key_file), cert_chain_abspath) # Enable any vhost that was issued to, but not enabled if not host.enabled: logger.info("Enabling Site " + host.file) self.config.enable_site(host) # sites may have been enabled / final cleanup self.config.restart(quiet=self.curses) display.success_installation(self.names)
def save_certificate(self, certificate_msg, cert_path, chain_path): # pylint: disable=no-self-use """Saves the certificate received from the ACME server. :param certificate_msg: ACME "certificate" message from server. :type certificate_msg: :class:`letsencrypt.acme.messages.Certificate` :param str cert_path: Path to attempt to save the cert file :param str chain_path: Path to attempt to save the chain file :returns: cert_file, chain_file (absolute paths to the actual files) :rtype: `tuple` of `str` :raises IOError: If unable to find room to write the cert files """ cert_chain_abspath = None cert_fd, cert_file = le_util.unique_file(cert_path, 0o644) cert_fd.write(certificate_msg.certificate.as_pem()) cert_fd.close() logging.info( "Server issued certificate; certificate written to %s", cert_file) if certificate_msg.chain: chain_fd, chain_fn = le_util.unique_file(chain_path, 0o644) for cert in certificate_msg.chain: chain_fd.write(cert.to_pem()) chain_fd.close() logging.info("Cert chain written to %s", chain_fn) # This expects a valid chain file cert_chain_abspath = os.path.abspath(chain_fn) return os.path.abspath(cert_file), cert_chain_abspath
def get_key_csr_pem(self, csr_return_format='der'): """Return key and CSR, generate if necessary. Returns key and CSR using provided files or generating new files if necessary. Both will be saved in PEM format on the filesystem. The CSR can optionally be returned in DER format as the CSR cannot be loaded back into M2Crypto. :param csr_return_format: If "der" returned CSR is in DER format, PEM otherwise. :param csr_return_format: str :returns: A pair of `(key, csr)`, where `key` is PEM encoded `str` and `csr` is PEM/DER (depedning on `csr_return_format` encoded `str`. :rtype: tuple """ key_pem = None csr_pem = None if not self.key_file: key_pem = crypto_util.make_key(CONFIG.RSA_KEY_SIZE) # Save file le_util.make_or_verify_dir(CONFIG.KEY_DIR, 0o700) key_f, self.key_file = le_util.unique_file( os.path.join(CONFIG.KEY_DIR, "key-letsencrypt.pem"), 0o600) key_f.write(key_pem) key_f.close() logger.info("Generating key: %s" % self.key_file) else: try: key_pem = open(self.key_file).read().replace("\r", "") except: logger.fatal("Unable to open key file: %s" % self.key_file) sys.exit(1) if not self.csr_file: csr_pem, csr_der = crypto_util.make_csr(self.key_file, self.names) # Save CSR le_util.make_or_verify_dir(CONFIG.CERT_DIR, 0o755) csr_f, self.csr_file = le_util.unique_file( os.path.join(CONFIG.CERT_DIR, "csr-letsencrypt.pem"), 0o644) csr_f.write(csr_pem) csr_f.close() logger.info("Creating CSR: %s" % self.csr_file) else: try: csr = M2Crypto.X509.load_request(self.csr_file) csr_pem, csr_der = csr.as_pem(), csr.as_der() except: logger.fatal("Unable to open CSR file: %s" % self.csr_file) sys.exit(1) if csr_return_format == 'der': return key_pem, csr_der else: return key_pem, csr_pem
def get_key_csr_pem(self, csr_return_format='der'): """Return key and CSR, generate if necessary. Returns key and CSR using provided files or generating new files if necessary. Both will be saved in PEM format on the filesystem. The CSR can optionally be returned in DER format as the CSR cannot be loaded back into M2Crypto. :param csr_return_format: If "der" returned CSR is in DER format, PEM otherwise. :param csr_return_format: str :returns: A pair of `(key, csr)`, where `key` is PEM encoded `str` and `csr` is PEM/DER (depedning on `csr_return_format` encoded `str`. :rtype: tuple """ key_pem = None csr_pem = None if not self.key_file: key_pem = crypto_util.make_key(CONFIG.RSA_KEY_SIZE) # Save file le_util.make_or_verify_dir(CONFIG.KEY_DIR, 0o700) key_f, self.key_file = le_util.unique_file( os.path.join(CONFIG.KEY_DIR, "key-letsencrypt.pem"), 0o600) key_f.write(key_pem) key_f.close() logger.info("Generating key: %s" % self.key_file) else: try: key_pem = open(self.key_file).read().replace("\r", "") except: logger.fatal("Unable to open key file: %s" % self.key_file) sys.exit(1) if not self.csr_file: csr_pem, csr_der = crypto_util.make_csr(self.key_file, self.names) # Save CSR le_util.make_or_verify_dir(CONFIG.CERT_DIR, 0o755) csr_f, self.csr_file = le_util.unique_file( os.path.join(CONFIG.CERT_DIR, "csr-letsencrypt.pem"), 0o644) csr_f.write(csr_pem) csr_f.close() logger.info("Creating CSR: %s" % self.csr_file) else: try: csr = M2Crypto.X509.load_request(self.csr_file) csr_pem, csr_der = csr.as_pem(), csr.as_der() except: logger.fatal("Unable to open CSR file: %s" % self.csr_file) sys.exit(1) if csr_return_format == 'der': return key_pem, csr_der else: return key_pem, csr_pem
def init_key(key_size, key_dir): """Initializes privkey. Inits key and CSR using provided files or generating new files if necessary. Both will be saved in PEM format on the filesystem. The CSR is placed into DER format to allow the namedtuple to easily work with the protocol. :param str key_dir: Key save directory. """ try: key_pem = crypto_util.make_key(key_size) except ValueError as err: logging.fatal(str(err)) sys.exit(1) # Save file le_util.make_or_verify_dir(key_dir, 0o700) key_f, key_filename = le_util.unique_file( os.path.join(key_dir, "key-letsencrypt.pem"), 0o600) key_f.write(key_pem) key_f.close() logging.info("Generating key (%d bits): %s", key_size, key_filename) return le_util.Key(key_filename, key_pem)
def init_save_csr(privkey, names, cert_dir, csrname="csr-letsencrypt.pem"): """Initialize a CSR with the given private key. :param privkey: Key to include in the CSR :type privkey: :class:`letsencrypt.client.le_util.Key` :param set names: `str` names to include in the CSR :param str cert_dir: Certificate save directory. :returns: CSR :rtype: :class:`letsencrypt.client.le_util.CSR` """ csr_pem, csr_der = make_csr(privkey.pem, names) # Save CSR le_util.make_or_verify_dir(cert_dir, 0o755) csr_f, csr_filename = le_util.unique_file( os.path.join(cert_dir, csrname), 0o644) csr_f.write(csr_pem) csr_f.close() logging.info("Creating CSR: %s", csr_filename) return le_util.CSR(csr_filename, csr_der, "der")
def init_key(key_size, key_dir): """Initializes privkey. Inits key and CSR using provided files or generating new files if necessary. Both will be saved in PEM format on the filesystem. The CSR is placed into DER format to allow the namedtuple to easily work with the protocol. :param str key_dir: Key save directory. """ try: key_pem = crypto_util.make_key(key_size) except ValueError as err: logging.fatal(str(err)) sys.exit(1) # Save file le_util.make_or_verify_dir(key_dir, 0o700) key_f, key_filename = le_util.unique_file( os.path.join(key_dir, "key-letsencrypt.pem"), 0o600) key_f.write(key_pem) key_f.close() logging.info("Generating key (%d bits): %s", key_size, key_filename) return le_util.Key(key_filename, key_pem)
def init_save_key(key_size, key_dir, keyname="key-letsencrypt.pem"): """Initializes and saves a privkey. Inits key and saves it in PEM format on the filesystem. .. note:: keyname is the attempted filename, it may be different if a file already exists at the path. :param int key_size: RSA key size in bits :param str key_dir: Key save directory. :param str keyname: Filename of key :returns: Key :rtype: :class:`letsencrypt.client.le_util.Key` :raises ValueError: If unable to generate the key given key_size. """ try: key_pem = make_key(key_size) except ValueError as err: logging.fatal(str(err)) raise err # Save file le_util.make_or_verify_dir(key_dir, 0o700, os.geteuid()) key_f, key_path = le_util.unique_file( os.path.join(key_dir, keyname), 0o600) key_f.write(key_pem) key_f.close() logging.info("Generating key (%d bits): %s", key_size, key_path) return le_util.Key(key_path, key_pem)
def get_key_csr_pem(self, csr_return_format = 'der'): """ Returns key and CSR using provided files or generating new files if necessary. Both will be saved in pem format on the filesystem. The CSR can optionally be returned in DER format as the CSR cannot be loaded back into M2Crypto. """ key_pem = None csr_pem = None if not self.key_file: key_pem = crypto_util.make_key(RSA_KEY_SIZE) # Save file le_util.make_or_verify_dir(KEY_DIR, 0700) key_f, self.key_file = le_util.unique_file( KEY_DIR + "key-letsencrypt.pem", 0600) key_f.write(key_pem) key_f.close() logger.info("Generating key: %s" % self.key_file) else: try: key_pem = open(self.key_file).read().replace("\r", "") except: logger.fatal("Unable to open key file: %s" % self.key_file) sys.exit(1) if not self.csr_file: csr_pem, csr_der = crypto_util.make_csr(self.key_file, self.names) # Save CSR le_util.make_or_verify_dir(CERT_DIR, 0755) csr_f, self.csr_file = le_util.unique_file( CERT_DIR + "csr-letsencrypt.pem", 0644) csr_f.write(csr_pem) csr_f.close() logger.info("Creating CSR: %s" % self.csr_file) else: #TODO fix this der situation try: csr_pem = open(self.csr_file).read().replace("\r", "") except: logger.fatal("Unable to open CSR file: %s" % self.csr_file) sys.exit(1) if csr_return_format == 'der': return key_pem, csr_der return key_pem, csr_pem
def save_certificate(self, certr, cert_path, chain_path): # pylint: disable=no-self-use """Saves the certificate received from the ACME server. :param certr: ACME "certificate" resource. :type certr: :class:`letsencrypt.acme.messages.Certificate` :param str cert_path: Path to attempt to save the cert file :param str chain_path: Path to attempt to save the chain file :returns: cert_file, chain_file (absolute paths to the actual files) :rtype: `tuple` of `str` :raises IOError: If unable to find room to write the cert files """ # try finally close cert_chain_abspath = None cert_file, act_cert_path = le_util.unique_file(cert_path, 0o644) # TODO: Except cert_pem = certr.body.as_pem() try: cert_file.write(cert_pem) finally: cert_file.close() logging.info("Server issued certificate; certificate written to %s", act_cert_path) if certr.cert_chain_uri: # TODO: Except chain_cert = self.network.fetch_chain(certr.cert_chain_uri) if chain_cert: chain_file, act_chain_path = le_util.unique_file( chain_path, 0o644) chain_pem = chain_cert.to_pem() try: chain_file.write(chain_pem) finally: chain_file.close() logging.info("Cert chain written to %s", act_chain_path) # This expects a valid chain file cert_chain_abspath = os.path.abspath(act_chain_path) return os.path.abspath(act_cert_path), cert_chain_abspath
def init_key_csr(self): """Initializes privkey and csr. Inits key and CSR using provided files or generating new files if necessary. Both will be saved in PEM format on the filesystem. The CSR is placed into DER format to allow the namedtuple to easily work with the protocol. """ if not self.privkey.file: key_pem = crypto_util.make_key(CONFIG.RSA_KEY_SIZE) # Save file le_util.make_or_verify_dir(CONFIG.KEY_DIR, 0o700) key_f, key_filename = le_util.unique_file( os.path.join(CONFIG.KEY_DIR, "key-letsencrypt.pem"), 0o600) key_f.write(key_pem) key_f.close() logger.info("Generating key: %s" % key_filename) self.privkey = Client.Key(key_filename, key_pem) if not self.csr.file: csr_pem, csr_der = crypto_util.make_csr( self.privkey.pem, self.names) # Save CSR le_util.make_or_verify_dir(CONFIG.CERT_DIR, 0o755) csr_f, csr_filename = le_util.unique_file( os.path.join(CONFIG.CERT_DIR, "csr-letsencrypt.pem"), 0o644) csr_f.write(csr_pem) csr_f.close() logger.info("Creating CSR: %s" % csr_filename) self.csr = Client.CSR(csr_filename, csr_der, "der") elif self.csr.type != "der": # The user is going to pass in a pem format file # That is why we must conver it to der since the # protocol uses der exclusively. csr_obj = M2Crypto.X509.load_request_string(self.csr.data) self.csr = Client.CSR(self.csr.file, csr_obj.as_der(), "der")
def install_certificate(self, certificate_dict, vhost): """Install certificate :returns: Path to a certificate file. :rtype: str """ cert_chain_abspath = None cert_fd, cert_file = le_util.unique_file(CONFIG.CERT_PATH, 0o644) cert_fd.write( crypto_util.b64_cert_to_pem(certificate_dict["certificate"])) cert_fd.close() logging.info( "Server issued certificate; certificate written to %s", cert_file) if certificate_dict.get("chain", None): chain_fd, chain_fn = le_util.unique_file(CONFIG.CHAIN_PATH, 0o644) for cert in certificate_dict.get("chain", []): chain_fd.write(crypto_util.b64_cert_to_pem(cert)) chain_fd.close() logging.info("Cert chain written to %s", chain_fn) # This expects a valid chain file cert_chain_abspath = os.path.abspath(chain_fn) for host in vhost: self.config.deploy_cert(host, os.path.abspath(cert_file), os.path.abspath(self.privkey.file), cert_chain_abspath) # Enable any vhost that was issued to, but not enabled if not host.enabled: logging.info("Enabling Site %s", host.filep) self.config.enable_site(host) # sites may have been enabled / final cleanup self.config.restart(quiet=self.use_curses) display.success_installation(self.names) return cert_file
def init_csr(privkey, names, cert_dir): """Initialize a CSR with the given private key. :param str cert_dir: Certificate save directory. """ csr_pem, csr_der = crypto_util.make_csr(privkey.pem, names) # Save CSR le_util.make_or_verify_dir(cert_dir, 0o755) csr_f, csr_filename = le_util.unique_file( os.path.join(cert_dir, "csr-letsencrypt.pem"), 0o644) csr_f.write(csr_pem) csr_f.close() logging.info("Creating CSR: %s", csr_filename) return le_util.CSR(csr_filename, csr_der, "der")
def init_csr(privkey, names, cert_dir): """Initialize a CSR with the given private key. :param str cert_dir: Certificate save directory. """ csr_pem, csr_der = crypto_util.make_csr(privkey.pem, names) # Save CSR le_util.make_or_verify_dir(cert_dir, 0o755) csr_f, csr_filename = le_util.unique_file( os.path.join(cert_dir, "csr-letsencrypt.pem"), 0o644) csr_f.write(csr_pem) csr_f.close() logging.info("Creating CSR: %s", csr_filename) return le_util.CSR(csr_filename, csr_der, "der")
def _call(self, mode=0o600): from letsencrypt.client.le_util import unique_file return unique_file(self.default_name, mode)
def _call(self, mode=0o600): from letsencrypt.client.le_util import unique_file return unique_file(self.default_name, mode)