EasyCA

Copyright (c) 2017-2020 Christer Byström

This package provides convinience methods for creating Certificate Authorities (CA), signing Certificate Signing Requests (CSR) and creating self-signed certificates.

This is intended to be used for developing purposes to quickly generate a root CA that can be used for signing test certificates instead of having to install each new test certificate that is being generated.

This package also supports using Subject Alternative Names for DNS and IP addresses, as the Common Name (CN) attribute of the subject will be deprecated at some point.

Under the hood the openssl cli is used.

Python 3.5 and above supported.

API Reference

easyca.create_self_signed(dn=None, alt_names=None, days=90, newkey='rsa:2048')

Create a self-signed certificate.

Parameters

• dn – a dictionary with configuration for distinguished name
• alt_names – a list of of Subject Alternative Names
• days – how many days in the future the CA will be valid
• newkey – key specification like ‘rsa:2048’

Returns

a dict with the members success and message always set

class easyca.CA(ca_path=None, openssl_path=None)

Bases: object

Certificate Authority, using an openssl CA folder structure as a flat-file database.

Parameters

• ca_path – path where to create the required folder structure
• openssl_path – path of openssl binary to use

DB_VERSION = 1

ca_path

get_certificate(serial=None)

Get details of a signed certificate

Parameters

serial – serial number of request

Raises

LookupError – certificate with serial not found

Returns

a dict with information

get_info()

Get information about the CA in ca_path.

Parameters

ca_path – Path to Certificate Authority

Returns

JSON object with status

get_request(serial=None)

Get details of a certificate signing request

Parameters

serial – serial number of request

Raises

LookupError – request with serial not found

Returns

a dict with information

get_request_name_from_path(path)

initialize(dn=None, alt_names=None, days=90, newkey='rsa:2048')

Initialize a Certificate Authority. This creates a folder structure containing a root CA, public and private keys, and folders for Certificate Signing Requests and SignedCertificates.

Parameters

• dn – a DistinguishedName or dict
• alt_names – a list of of Subject Alternative Names
• days – how many days in the future the CA will be valid
• newkey – key specification like ‘rsa:2048’

Raises

• ValueError – missing value needed
• FileExistsErrror – a CA is alreay initialized at this location
• OpenSSLError – an error occurred calling openssl

Returns

a dict with the members success and message always set

initialized

Returns boolean

true if initialized

list_certificates()

Get a list of signed certificates

list_requests()

Get a list of Certificate Signing Requests.

Returns

list – a list of {“id”: <id>, “last_modified”: <datastring>}

revoke_certificate(serial=None)

sign_request(csr=None, days=90)

Sign a Certificate Signing Request. This function carries over Subject Alternative Name entries from the request.

Parameters

• csr – a string with the CSR in PEM format
• days – how many days in the future the certificate will be valid

Raises

ValueError – when the input is not a certificate request

Returns

a dict with the members success and message always set

updatedb()

Updates the database index to purge expired certificates.

class easyca.DistinguishedName(c=None, cn=None, email=None, l=None, o=None, ou=None, st=None)

Bases: dict

Distinguished Name.

Parameters

• c – Country/Region (two letters)
• cn – Common Name - hostname or dns
• email – Email address
• l – Locality
• o – Organization Name
• ou – Organizational Unit
• st – State or Province