A CA object.

Examples: >>> ca = cnert.CA() >>> ca.is_root_ca True >>> ca.is_intermediate_ca False >>> ca.parent is None True

Parameters: subject_attrs: Subject Name Attributes. subject_attrs: Issuer Name Attributes. path_length: Maximum path length certificates subordinate. not_valid_before: CA not valid before date. not_valid_after: CA not valid after date. parent: Parent of CA. intermediate_num: Number of intermediates. signature_hash: Signature hash algorithm for the CA's own certificate. Defaults to SHA-256, or to None for an Edwards key, which takes no hash. extensions: Extra (extension, critical) pairs for the CA's own certificate. One that collides with a built-in extension replaces it wholesale. private_key: Private key for the CA's own certificate; generated when omitted. Reusing one key across a chain is allowed, and is how a key-reuse fixture is built. builtin_extensions: Add cnert's own extensions to the CA's own certificate. When false, only the supplied pairs are added. An authority without basic constraints is not a usable authority, which is deliberate.

Methods:

• issue_cert –

  Issues a certificate

• issue_intermediate –

  Issues an intermediate CA.

is_intermediate_ca: bool

is_root_ca: bool

issue_cert(
    *sans: str,
    subject_attrs: NameAttrs | None = None,
    not_valid_before: datetime | None = None,
    not_valid_after: datetime | None = None,
    serial_number: int | None = None,
    csr: CSR | None = None,
    signature_hash: HashAlgorithm
    | str
    | _UnsetType
    | None = _UNSET,
    extensions: Sequence[tuple[ExtensionType, bool]] = (),
    private_key: CertificateIssuerPrivateKeyTypes
    | None = None,
    builtin_extensions: bool = True,
) -> Cert

issue_intermediate(
    subject_attrs: NameAttrs | None = None,
    not_valid_before: datetime | None = None,
    not_valid_after: datetime | None = None,
    serial_number: int | None = None,
    signature_hash: HashAlgorithm
    | str
    | _UnsetType
    | None = _UNSET,
    extensions: Sequence[tuple[ExtensionType, bool]] = (),
    private_key: CertificateIssuerPrivateKeyTypes
    | None = None,
    builtin_extensions: bool = True,
) -> CA

Bases: Freezer

An object for storing (and freezing) Name Attributes for Subject Name Attributes and Issuer Name Attributes.

Accepts any valid x509.NameAttribute as key arguments with arbitrary string values.

Has methods for returning initialized attributes in a dict and for returning a cryptography.x509.Name

There is alse a method for showing the allowed attributes.

Examples: >>> subject_attrs = cnert.NameAttrs(COMMON_NAME="example.com") >>> subject_attrs.COMMON_NAME 'example.com' >>> subject_attrs.dict_ {'COMMON_NAME': 'example.com'} >>> subject_attrs.x509_name()

    [`allowed_keys()`][cnert.NameAttrs.allowed_keys],
    each with a value or a sequence of values. A sequence
    emits one attribute per value in the order given, so
    `ORGANIZATIONAL_UNIT_NAME=["A", "B"]` renders as
    `OU=A,OU=B`. Attribute types are ordered
    alphabetically; only values within one type follow
    the caller.

Methods:

• allowed_keys –

  Returns a list of allowed key arguments.

• x509_name –

  Examples:

allowed_keys() -> list[str]

x509_name() -> Name

Builds and signs a X509 Certificate.

Methods:

• build –

  Does the Certificate building.

build(
    sans: tuple[str, ...],
    subject_attrs_X509_name: Name,
    issuer_attrs_X509_name: Name,
    serial_number: int,
    not_valid_before: datetime,
    not_valid_after: datetime,
    is_ca: bool,
    public_key: CertificateIssuerPublicKeyTypes,
    issuer_public_key: CertificateIssuerPublicKeyTypes
    | None = None,
    path_length: int | None = None,
    extensions: Sequence[tuple[ExtensionType, bool]] = (),
    builtin_extensions: bool = True,
) -> None

A Cert object.

This object is returned by cnert.CA().issue_cert()

Examples:

>>> ca = CA()
>>> cert = ca.issue_cert()
>>> cert.subject_attrs
NameAttrs(COMMON_NAME="example.com")
>>> cert.issuer_attrs
NameAttrs(ORGANIZATION_NAME="Root CA")
>>> cert.not_valid_before
datetime.datetime(2023, 3, 24, 23, 56, 55, 901545)
>>> cert.not_valid_after
datetime.datetime(2023, 6, 23, 23, 56, 55, 901545)

Parameters: sans: Subject Alternative Names as positional arguments subject_attrs: Subject Name Attributes issuer_attrs: Issure Name Attributes not_valid_before: CA not valid before date not_valid_after: CA not valid after date serial_number: Serial number parent: Certificate of CA. private_key: Private key; generated when omitted. signature_hash: Signature hash algorithm. Defaults to SHA-256, or to None when the signing key is an Edwards key, which takes no hash. extensions: Extra (extension, critical) pairs. One that collides with a built-in extension replaces it wholesale. builtin_extensions: Add cnert's own extensions. When false, only the supplied pairs are added, subject alternative names included. The result is not a valid certificate for real use, which is the point: it is how a bare certificate is built. path_length: Path length is_ca: if CA

Raises: ValueError: If signature_hash does not suit the signing key. See cnert.build_private_key.

MD5: str

SHA1: str

SHA256: str

authority_key_identifier_digest: str | None

private_key_pem_PKCS1: bytes

private_key_pem_PKCS8: bytes

public_key: CertificateIssuerPublicKeyTypes

public_key_pem: bytes

subject_key_identifier_digest: str

A CSR object.

Examples: >>> csr = cnert.CSR()

Parameters: sans: Subject Alternative Names as positional arguments subject_attrs: Subject Name Attributes private_key: Private key; generated when omitted. signature_hash: Signature hash algorithm. Defaults to SHA-256, or to None for an Edwards key, which takes no hash. extensions: Extra (extension, critical) pairs. One that collides with a built-in extension replaces it wholesale. builtin_extensions: Add cnert's own extensions. When false, only the supplied pairs are added, subject alternative names included.

private_key_pem_PKCS1: bytes