<s> """<STR_LIT>""" <EOL> import base64 <EOL> import json <EOL> import logging <EOL> from cryptography import x509 <EOL> from cryptography . x509 import NameOID <EOL> from cryptography . hazmat . backends import default_backend <EOL> from cryptography . hazmat . primitives . asymmetric import padding <EOL> from cryptography . hazmat . primitives . asymmetric . rsa import ( <EOL> generate_private_key , <EOL> RSAPrivateKey , <EOL> ) <EOL> from cryptography . hazmat . primitives . asymmetric . ec import ( <EOL> EllipticCurvePrivateKey , <EOL> ) <EOL> from cryptography . hazmat . primitives . serialization import ( <EOL> load_pem_private_key , <EOL> Encoding , <EOL> PrivateFormat , <EOL> NoEncryption , <EOL> ) <EOL> from cryptography . hazmat . primitives import hashes <EOL> logger = logging . getLogger ( __name__ ) <EOL> def jose_b64 ( data ) : <EOL> """<STR_LIT>""" <EOL> return base64 . urlsafe_b64encode ( data ) . decode ( '<STR_LIT:ascii>' ) . replace ( '<STR_LIT:=>' , '<STR_LIT>' ) <EOL> def generate_rsa_key ( size = <NUM_LIT> ) : <EOL> """<STR_LIT>""" <EOL> return generate_private_key ( <NUM_LIT> , size , default_backend ( ) ) <EOL> def generate_header ( account_key ) : <EOL> """<STR_LIT>""" <EOL> numbers = account_key . public_key ( ) . public_numbers ( ) <EOL> e = numbers . e . to_bytes ( ( numbers . e . bit_length ( ) // <NUM_LIT:8> + <NUM_LIT:1> ) , byteorder = '<STR_LIT>' ) <EOL> n = numbers . n . to_bytes ( ( numbers . n . bit_length ( ) // <NUM_LIT:8> + <NUM_LIT:1> ) , byteorder = '<STR_LIT>' ) <EOL> if n [ <NUM_LIT:0> ] == <NUM_LIT:0> : <EOL> n = n [ <NUM_LIT:1> : ] <EOL> return { <EOL> '<STR_LIT>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : { <EOL> '<STR_LIT>' : '<STR_LIT>' , <EOL> '<STR_LIT:e>' : jose_b64 ( e ) , <EOL> '<STR_LIT:n>' : jose_b64 ( n ) , <EOL> } , <EOL> } <EOL> def generate_jwk_thumbprint ( account_key ) : <EOL> """<STR_LIT>""" <EOL> jwk = generate_header ( account_key ) [ '<STR_LIT>' ] <EOL> as_json = json . dumps ( jwk , sort_keys = True , separators = ( '<STR_LIT:U+002C>' , '<STR_LIT::>' ) ) <EOL> sha256 = hashes . Hash ( hashes . SHA256 ( ) , default_backend ( ) ) <EOL> sha256 . update ( as_json . encode ( '<STR_LIT:utf-8>' ) ) <EOL> return jose_b64 ( sha256 . finalize ( ) ) <EOL> def sign_request ( key , header , protected_header , payload ) : <EOL> """<STR_LIT>""" <EOL> protected = jose_b64 ( json . dumps ( protected_header ) . encode ( '<STR_LIT:utf8>' ) ) <EOL> payload = jose_b64 ( json . dumps ( payload ) . encode ( '<STR_LIT:utf8>' ) ) <EOL> signer = key . signer ( padding . PKCS1v15 ( ) , hashes . SHA256 ( ) ) <EOL> signer . update ( protected . encode ( '<STR_LIT:ascii>' ) ) <EOL> signer . update ( b'<STR_LIT:.>' ) <EOL> signer . update ( payload . encode ( '<STR_LIT:ascii>' ) ) <EOL> return json . dumps ( { <EOL> '<STR_LIT>' : header , <EOL> '<STR_LIT>' : protected , <EOL> '<STR_LIT>' : payload , <EOL> '<STR_LIT>' : jose_b64 ( signer . finalize ( ) ) , <EOL> } ) <EOL> def load_private_key ( data ) : <EOL> """<STR_LIT>""" <EOL> key = load_pem_private_key ( data , password = None , backend = default_backend ( ) ) <EOL> if not isinstance ( key , ( RSAPrivateKey , EllipticCurvePrivateKey ) ) : <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> elif isinstance ( key , RSAPrivateKey ) and key . key_size < <NUM_LIT> : <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> return key <EOL> def export_private_key ( key ) : <EOL> """<STR_LIT>""" <EOL> return key . private_bytes ( Encoding . PEM , PrivateFormat . TraditionalOpenSSL , NoEncryption ( ) ) <EOL> def create_csr ( key , domains ) : <EOL> """<STR_LIT>""" <EOL> assert domains <EOL> name = x509 . Name ( [ <EOL> x509 . NameAttribute ( NameOID . COMMON_NAME , domains [ <NUM_LIT:0> ] ) , <EOL> ] ) <EOL> san = x509 . SubjectAlternativeName ( [ x509 . DNSName ( domain ) for domain in domains ] ) <EOL> csr = x509 . CertificateSigningRequestBuilder ( ) . subject_name ( name ) . add_extension ( san , critical = False ) . sign ( key , hashes . SHA256 ( ) , default_backend ( ) ) <EOL> return export_csr_for_acme ( csr ) <EOL> def export_csr_for_acme ( csr ) : <EOL> """<STR_LIT>""" <EOL> return jose_b64 ( csr . public_bytes ( Encoding . DER ) ) <EOL> def load_csr ( data ) : <EOL> """<STR_LIT>""" <EOL> return x509 . load_pem_x509_csr ( data , default_backend ( ) ) <EOL> def load_der_certificate ( data ) : <EOL> """<STR_LIT>""" <EOL> return x509 . load_der_x509_certificate ( data , default_backend ( ) ) <EOL> def load_pem_certificate ( data ) : <EOL> """<STR_LIT>""" <EOL> return x509 . load_pem_x509_certificate ( data , default_backend ( ) ) <EOL> def get_certificate_domains ( cert ) : <EOL> """<STR_LIT>""" <EOL> for ext in cert . extensions : <EOL> ext = ext . value <EOL> if isinstance ( ext , x509 . SubjectAlternativeName ) : <EOL> return ext . get_values_for_type ( x509 . DNSName ) <EOL> return [ ] <EOL> def export_pem_certificate ( cert ) : <EOL> """<STR_LIT>""" <EOL> return cert . public_bytes ( Encoding . PEM ) <EOL> def export_certificate_for_acme ( cert ) : <EOL> """<STR_LIT>""" <EOL> return jose_b64 ( cert . public_bytes ( Encoding . DER ) ) </s>
