# Crypto_util

Crypto utilities.

class acme.crypto_util.Format(*values)

  File format to be used when parsing or serializing X.509 structures.

  Backwards compatible with the `FILETYPE_ASN1` and `FILETYPE_PEM` constants from pyOpenSSL.

  to_cryptography_encoding() → Encoding

    Converts the Format to the corresponding cryptography `Encoding`.

class acme.crypto_util.SSLSocket(sock: socket, certs: Mapping[bytes, Tuple[PKey, X509] | Tuple[Ed25519PrivateKey | Ed448PrivateKey | RSAPrivateKey | DSAPrivateKey | EllipticCurvePrivateKey, Certificate]] | None = None, method: int = 7, alpn_selection: Callable[[Connection, List[bytes]], bytes] | None = None, cert_selection: Callable[[Connection], Tuple[PKey, X509] | Tuple[Ed25519PrivateKey | Ed448PrivateKey | RSAPrivateKey | DSAPrivateKey | EllipticCurvePrivateKey, Certificate] | None] | None = None)

  SSL wrapper for sockets.

  Variables:

    - sock (socket) – Original wrapped socket.

    - certs (dict) – Mapping from domain names (`bytes`) to `OpenSSL.crypto.X509`.

    - method – See `OpenSSL.SSL.Context` for allowed values.

    - alpn_selection – Hook to select negotiated ALPN protocol for connection.

    - cert_selection – Hook to select certificate for connection. If given, `certs` parameter would be ignored, and therefore must be empty.

  class FakeConnection(connection: Connection)

    Fake OpenSSL.SSL.Connection.

acme.crypto_util.probe_sni(name: bytes, host: bytes, port: int = 443, timeout: int = 300, method: int = 7, source_address: Tuple[str, int] = ('', 0), alpn_protocols: Sequence[bytes] | None = None) → Certificate

  Probe SNI server for SSL certificate.

  Parameters:

    - name (bytes) – Byte string to send as the server name in the client hello message.

    - host (bytes) – Host to connect to.

    - port (int) – Port to connect to.

    - timeout (int) – Timeout in seconds.

    - method – See `OpenSSL.SSL.Context` for allowed values.

    - source_address (tuple) – Enables multi-path probing (selection of source interface). See `socket.creation_connection` for more info. Available only in Python 2.7+.

    - alpn_protocols (`Sequence` of `bytes`) – Protocols to request using ALPN.

  Raises:

    acme.errors.Error – In case of any problems.

  Returns:

    SSL certificate presented by the server.

  Return type:

    cryptography.x509.Certificate

acme.crypto_util.make_csr(private_key_pem: bytes, domains: Set[str] | List[str] | None = None, must_staple: bool = False, ipaddrs: List[IPv4Address | IPv6Address] | None = None) → bytes

  Generate a CSR containing domains or IPs as subjectAltNames.

  Parameters are ordered this way for backwards compatibility when called using positional arguments.

  Parameters:

    - private_key_pem (buffer) – Private key, in PEM PKCS#8 format.

    - domains (list) – List of DNS names to include in subjectAltNames of CSR.

    - must_staple (bool) – Whether to include the TLS Feature extension (aka OCSP Must Staple: https://tools.ietf.org/html/rfc7633).

    - ipaddrs (list) – List of IPaddress(type ipaddress.IPv4Address or ipaddress.IPv6Address) names to include in subbjectAltNames of CSR.

  Returns:

    buffer PEM-encoded Certificate Signing Request.

acme.crypto_util.get_names_from_subject_and_extensions(subject: Name, exts: Extensions) → List[str]

  Gets all DNS SAN names as well as the first Common Name from subject.

  Parameters:

    - subject (`cryptography.x509.Name`) – Name of the x509 object, which may include Common Name

    - exts (`cryptography.x509.Extensions`) – Extensions of the x509 object, which may include SANs

  Returns:

    List of DNS Subject Alternative Names and first Common Name

  Return type:

    `list` of `str`

acme.crypto_util.make_self_signed_cert(private_key: Ed25519PrivateKey | Ed448PrivateKey | RSAPrivateKey | DSAPrivateKey | EllipticCurvePrivateKey, domains: List[str] | None = None, not_before: datetime | None = None, validity: timedelta | None = None, force_san: bool = True, extensions: List[Extension] | None = None, ips: List[IPv4Address | IPv6Address] | None = None) → Certificate

  Generate new self-signed certificate. :param buffer private_key_pem: Private key, in PEM PKCS#8 format. :type domains: `list` of `str` :param int not_before: A datetime after which the cert is valid. If no timezone is specified, UTC is assumed :type not_before: `datetime.datetime` :param validity: Duration for which the cert will be valid. Defaults to 1 week :type validity: `datetime.timedelta` :param buffer private_key_pem: One of `cryptography.hazmat.primitives.asymmetric.types.CertificateIssuerPrivateKeyTypes` :param bool force_san: :param extensions: List of additional extensions to include in the cert. :type extensions: `list` of `x509.Extension[x509.ExtensionType]` :type ips: `list` of (`ipaddress.IPv4Address` or `ipaddress.IPv6Address`) If more than one domain is provided, all of the domains are put into `subjectAltName` X.509 extension and first domain is set as the subject CN. If only one domain is provided no `subjectAltName` extension is used, unless `force_san` is `True`.

acme.crypto_util.dump_cryptography_chain(chain: ~typing.List[~cryptography.x509.base.Certificate], encoding: ~typing.Literal[Encoding.PEM, Encoding.DER] = <Encoding.PEM: 'PEM'>) → bytes

  Dump certificate chain into a bundle.

  Parameters:

    chain (list) – List of `cryptography.x509.Certificate`.

  Returns:

    certificate chain bundle

  Return type:

    bytes

  Deprecated .. deprecated: 3.2.1