def setup_acme_client(self, authority): if not authority.options: raise InvalidAuthority("Invalid authority. Options not set") options = {} for option in json.loads(authority.options): options[option["name"]] = option.get("value") email = options.get('email', current_app.config.get('ACME_EMAIL')) tel = options.get('telephone', current_app.config.get('ACME_TEL')) directory_url = options.get('acme_url', current_app.config.get('ACME_DIRECTORY_URL')) existing_key = options.get('acme_private_key', current_app.config.get('ACME_PRIVATE_KEY')) existing_regr = options.get('acme_regr', current_app.config.get('ACME_REGR')) if existing_key and existing_regr: # Reuse the same account for each certificate issuance key = jose.JWK.json_loads(existing_key) regr = messages.RegistrationResource.json_loads(existing_regr) current_app.logger.debug("Connecting with directory at {0}".format(directory_url)) net = ClientNetwork(key, account=regr) client = BackwardsCompatibleClientV2(net, key, directory_url) return client, {} else: # Create an account for each certificate issuance key = jose.JWKRSA(key=generate_private_key('RSA2048')) current_app.logger.debug("Connecting with directory at {0}".format(directory_url)) net = ClientNetwork(key, account=None) client = BackwardsCompatibleClientV2(net, key, directory_url) registration = client.new_account_and_tos(messages.NewRegistration.from_data(email=email)) current_app.logger.debug("Connected: {0}".format(registration.uri)) return client, registration
def __init__(self, account_id=None): if account_id: self.account = Account.query.get(account_id) self.key = jose.JWKRSA( key=crypto.load_private_key(self.account.key.encode("utf8"))) regr = RegistrationResource.from_json( json.loads(self.account.contents)) net = ClientNetwork(self.key, account=regr) self.client = BackwardsCompatibleClientV2( net, self.key, self.account.directory_uri) else: print("Setup ACME Account")
def setup_acme_account(self, user_id, email=None, server=None, rsa_key=None, organization: str = None, organizational_unit: str = None, country: str = None, state: str = None, location: str = None): if not email: email = config.CERTIFIRE_EMAIL if not server: server = config.LETS_ENCRYPT_PRODUCTION if not rsa_key: rsa_key = crypto.generate_rsa_key() account = Account(user_id, email, server, organization=organization, organizational_unit=organizational_unit, country=country, state=state, location=location) key = jose.JWKRSA(key=rsa_key) net = ClientNetwork(key, account=None, timeout=3600) client = BackwardsCompatibleClientV2(net, key, account.directory_uri) registration = client.new_account_and_tos( messages.NewRegistration.from_data(email=email)) account.key = crypto.export_private_key(rsa_key).decode("utf-8") account.uri = registration.uri account.contents = json.dumps(registration.to_json()) database.add(account) self.account = account self.key = key self.client = client return account
def setup_acme_client(authority): if not authority.options: raise InvalidAuthority("Invalid authority. Options not set") options = {} for option in json.loads(authority.options): options[option["name"]] = option.get("value") email = options.get('email', current_app.config.get('ACME_EMAIL')) tel = options.get('telephone', current_app.config.get('ACME_TEL')) directory_url = options.get('acme_url', current_app.config.get('ACME_DIRECTORY_URL')) key = jose.JWKRSA(key=generate_private_key('RSA2048')) current_app.logger.debug( "Connecting with directory at {0}".format(directory_url)) net = ClientNetwork(key, account=None) client = BackwardsCompatibleClientV2(net, key, directory_url) registration = client.new_account_and_tos( messages.NewRegistration.from_data(email=email)) current_app.logger.debug("Connected: {0}".format(registration.uri)) return client, registration
def setup_acme_client(self, authority): if not authority.options: raise InvalidAuthority("Invalid authority. Options not set") options = {} for option in json.loads(authority.options): options[option["name"]] = option.get("value") email = options.get("email", current_app.config.get("ACME_EMAIL")) tel = options.get("telephone", current_app.config.get("ACME_TEL")) directory_url = options.get( "acme_url", current_app.config.get("ACME_DIRECTORY_URL")) existing_key = options.get("acme_private_key", current_app.config.get("ACME_PRIVATE_KEY")) existing_regr = options.get("acme_regr", current_app.config.get("ACME_REGR")) eab_kid = options.get("eab_kid", None) eab_hmac_key = options.get("eab_hmac_key", None) if existing_key and existing_regr: current_app.logger.debug("Reusing existing ACME account") # Reuse the same account for each certificate issuance # existing_key might be encrypted if not is_json(existing_key): # decrypt the private key, if not already in plaintext (json format) existing_key = data_decrypt(existing_key) key = jose.JWK.json_loads(existing_key) regr = messages.RegistrationResource.json_loads(existing_regr) current_app.logger.debug( "Connecting with directory at {0}".format(directory_url)) net = ClientNetwork(key, account=regr) client = BackwardsCompatibleClientV2(net, key, directory_url) return client, {} else: # Create an account for each certificate issuance key = jose.JWKRSA(key=generate_private_key("RSA2048")) current_app.logger.debug("Creating a new ACME account") current_app.logger.debug( "Connecting with directory at {0}".format(directory_url)) net = ClientNetwork(key, account=None, timeout=3600) client = BackwardsCompatibleClientV2(net, key, directory_url) if eab_kid and eab_hmac_key: # external account binding (eab_kid and eab_hmac_key could be potentially single use to establish # long-term credentials) eab = messages.ExternalAccountBinding.from_data( account_public_key=key.public_key(), kid=eab_kid, hmac_key=eab_hmac_key, directory=client.directory) registration = client.new_account_and_tos( messages.NewRegistration.from_data( email=email, external_account_binding=eab)) else: registration = client.new_account_and_tos( messages.NewRegistration.from_data(email=email)) # if store_account is checked, add the private_key and registration resources to the options if options['store_account']: new_options = json.loads(authority.options) # the key returned by fields_to_partial_json is missing the key type, so we add it manually key_dict = key.fields_to_partial_json() key_dict["kty"] = "RSA" acme_private_key = { "name": "acme_private_key", "value": data_encrypt(json.dumps(key_dict)) } new_options.append(acme_private_key) acme_regr = { "name": "acme_regr", "value": json.dumps({ "body": {}, "uri": registration.uri }) } new_options.append(acme_regr) authorities_service.update_options( authority.id, options=json.dumps(new_options)) current_app.logger.debug("Connected: {0}".format(registration.uri)) return client, registration
def setup_acme_client(self, authority): if not authority.options: raise InvalidAuthority("Invalid authority. Options not set") options = {} for option in json.loads(authority.options): options[option["name"]] = option.get("value") email = options.get("email", current_app.config.get("ACME_EMAIL")) tel = options.get("telephone", current_app.config.get("ACME_TEL")) directory_url = options.get( "acme_url", current_app.config.get("ACME_DIRECTORY_URL") ) existing_key = options.get( "acme_private_key", current_app.config.get("ACME_PRIVATE_KEY") ) existing_regr = options.get("acme_regr", current_app.config.get("ACME_REGR")) if existing_key and existing_regr: current_app.logger.debug("Reusing existing ACME account") # Reuse the same account for each certificate issuance key = jose.JWK.json_loads(existing_key) regr = messages.RegistrationResource.json_loads(existing_regr) current_app.logger.debug( "Connecting with directory at {0}".format(directory_url) ) net = ClientNetwork(key, account=regr) client = BackwardsCompatibleClientV2(net, key, directory_url) return client, {} else: # Create an account for each certificate issuance key = jose.JWKRSA(key=generate_private_key("RSA2048")) current_app.logger.debug("Creating a new ACME account") current_app.logger.debug( "Connecting with directory at {0}".format(directory_url) ) net = ClientNetwork(key, account=None, timeout=3600) client = BackwardsCompatibleClientV2(net, key, directory_url) registration = client.new_account_and_tos( messages.NewRegistration.from_data(email=email) ) # if store_account is checked, add the private_key and registration resources to the options if options['store_account']: new_options = json.loads(authority.options) # the key returned by fields_to_partial_json is missing the key type, so we add it manually key_dict = key.fields_to_partial_json() key_dict["kty"] = "RSA" acme_private_key = { "name": "acme_private_key", "value": json.dumps(key_dict) } new_options.append(acme_private_key) acme_regr = { "name": "acme_regr", "value": json.dumps({"body": {}, "uri": registration.uri}) } new_options.append(acme_regr) authorities_service.update_options(authority.id, options=json.dumps(new_options)) current_app.logger.debug("Connected: {0}".format(registration.uri)) return client, registration
def test_init_downloads_directory(self): uri = 'http://www.letsencrypt-demo.org/directory' from acme.client import BackwardsCompatibleClientV2 BackwardsCompatibleClientV2(net=self.net, key=KEY, server=uri) self.net.get.assert_called_once_with(uri)
def _init(self): uri = 'http://www.letsencrypt-demo.org/directory' from acme.client import BackwardsCompatibleClientV2 return BackwardsCompatibleClientV2(net=self.net, key=KEY, server=uri)