| Server IP : 3.96.16.70 / Your IP : 216.73.216.15 Web Server : Apache System : Linux ip-172-31-26-103.ca-central-1.compute.internal 6.1.163-186.299.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Feb 24 16:35:42 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.18 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /lib/python3.9/site-packages/acme/__pycache__/ |
Upload File : |
a
�]e�y � @ sJ d Z ddlZddlZddlmZ ddlmZ ddlZddl Z ddl
Z
ddl m Z ddl m
Z
ddl mZ ddl mZ ddl mZ dd l mZ dd
l mZ dd l mZ dd l mZ ddlZddlZddlZdd
lmZ ddlm Z ddl m Z ddl m Z ddl m Z ddl m!Z! ddl m"Z" e�#e$�Z%dZ&G dd� d�Z'G dd� d�Z(dS )zACME client API.� N)� parsedate_tz)�Any)�cast)�List)�Mapping)�Optional)�Set)�Text)�Tuple)�Union)� HTTPAdapter)�parse_header_links)�
challenges)� crypto_util)�errors)�jws)�messages�- c @ s� e Zd ZdZejddd�dd�Zejejd�dd �Z ejejd
�d d �Z
dNeje ej ejd
�dd�Z
dOejeejd�dd�Zeejd�dd�Zejeejejf d�dd�ZdPeje ej ejd�dd �Zejejejd�d d �Zejejd �d d!�ZdQejejeejd"�d#d$�Z dRejejeejd"�d%d&�Z e j e dd'�d(d)�Z!ed*�d+d,�Z"e#e#ejd-�d.d/�Z$eje%e&e% d0�d1d2�Z'e(e%dejd3�d4d5��Z)e(dSeje e% e e% ejd6�d7d8��Z*ejej ejd9�d:d;�Z+e#e#ejd-�d<d=�Z,ejejd
�d>d?�Z-ejejd�d@dA�Z.dTeje ej/ e e% ejdB�dCdD�Z0ej1e2j3ej4dE�dFdG�Z5e(eje ejdH�dIdJ��Z6e j e e%ddK�dLdM�Z7dS )U�ClientV2zuACME client for a v2 API.
:ivar messages.Directory directory:
:ivar .ClientNetwork net: Client network.
�
ClientNetworkN)� directory�net�returnc C s || _ || _dS )z�Initialize.
:param .messages.Directory directory: Directory Resource
:param .ClientNetwork net: Client network.
N)r r )�selfr r � r �//usr/lib/python3.9/site-packages/acme/client.py�__init__+ s zClientV2.__init__)� new_accountr c C sL | � | jd |�}|jdkr6d|jv r6t�|jd ��| �|�}|| j_|S )z�Register.
:param .NewRegistration new_account:
:raises .ConflictError: in case the account already exists
:returns: Registration Resource.
:rtype: `.RegistrationResource`
�
newAccount�� �Location) �_postr � status_code�headersr �
ConflictError�_regr_from_responser �account)r r �response�regrr r r r 4 s
zClientV2.new_account)r( r c C s | � |d�| j_| jjS )z�Query server about registration.
:param messages.RegistrationResource regr: Existing Registration
Resource.
T)�_get_v2_accountr r& �r r( r r r �query_registrationG s zClientV2.query_registration)r( �updater c C sJ | � |�}|du r|jn|}tjf i t|���}| j||d�}|| j_|S )aK Update registration.
:param messages.RegistrationResource regr: Registration Resource.
:param messages.Registration update: Updated body of the
resource. If not provided, body will be taken from `regr`.
:returns: Updated Registration Resource.
:rtype: `.RegistrationResource`
N��body)r) r. r ZUpdateRegistration�dict�_send_recv_regrr r& )r r( r, r. Z updated_regrr r r �update_registrationS s
z ClientV2.update_registrationF)r( � update_bodyr c C sb d | j _|jjdd�}| �| jd |�}|jd }|j|rJtj� |�
� �n|j|d�}|| j _|S )NT)Zonly_return_existingr r �r. �uri) r r& r. r, r! r r# r � Registration� from_json�json)r r( r2 Zonly_existing_regr' Z updated_uriZnew_regrr r r r) i s
��zClientV2._get_v2_account)�csr_pemr c
C s� t j�t jj|�}t�|�}t�|�}g }|D ]}|�tj tj
|d�� q.|D ]}|�tj tj |d�� qNtj |d�}| �
| jd |�} tj�| �� �}
g } |
jD ] } | �| j| �| �| d�� q�tj|
| j�d�| |d�S )z�Request a new Order object from the server.
:param bytes csr_pem: A CSR in PEM format.
:returns: The newly created order.
:rtype: OrderResource
)�typ�value)� identifiersZnewOrder�r4 r )r. r4 �authorizationsr8 )�OpenSSL�crypto�load_certificate_request� FILETYPE_PEMr Z _pyopenssl_cert_or_req_all_namesZ _pyopenssl_cert_or_req_san_ip�appendr �
IdentifierZIDENTIFIER_FQDNZ
IDENTIFIER_IPZNewOrderr! r �Orderr6 r7 r= �_authzr_from_response� _post_as_get�
OrderResourcer# �get)
r r8 �csrZdnsNamesZipNamesr; �nameZips�orderr' r. r= �urlr r r � new_orderu s0
�
�
�zClientV2.new_order)�authzrr c C s( | � |j�}| �||jj|j�}||fS )a Poll Authorization Resource for status.
:param authzr: Authorization Resource
:type authzr: `.AuthorizationResource`
:returns: Updated Authorization Resource and HTTP response.
:rtype: (`.AuthorizationResource`, `requests.Response`)
)rF r4 rE r. �
identifier)r rN r' Zupdated_authzrr r r �poll� s
�z
ClientV2.poll)�orderr�deadliner c C s6 |du r t j �� t jdd� }| �||�}| �||�S )ad Poll authorizations and finalize the order.
If no deadline is provided, this method will timeout after 90
seconds.
:param messages.OrderResource orderr: order to finalize
:param datetime.datetime deadline: when to stop polling and timeout
:returns: finalized order
:rtype: messages.OrderResource
N�Z ��seconds)�datetime�now� timedelta�poll_authorizations�finalize_order)r rQ rR r r r �poll_and_finalize� s zClientV2.poll_and_finalizec C s� g }|j jD ]L}tj�� |k r | j| �|�|d�}|j jtjkrL|� |� q t
� d� qq t |�t |j j�k rvt
�� �g }|D ]4}|j jtjkr~|j jD ]}|jdur�|� |� q�q~|r�t
�|��|j|d�S )z Poll Order Resource for status.r< � N)r= )r. r= rV rW rE rF �statusr ZSTATUS_PENDINGrB �time�sleep�lenr � TimeoutError� STATUS_VALIDr �errorZValidationErrorr, )r rQ rR Z responsesrL rN ZfailedZchallr r r rY � s&
z ClientV2.poll_authorizations)rQ r c C sR t j�t jj|j�}tjt�|�d�}| � |j
j |�}|j tj
�|�� �d�}|S )a Start the process of finalizing an order.
:param messages.OrderResource orderr: order to finalize
:param datetime.datetime deadline: when to stop polling and timeout
:returns: updated order
:rtype: messages.OrderResource
)rI r- )r> r? r@ rA r8 r ZCertificateRequest�jose�ComparableX509r! r. Zfinalizer, rD r6 r7 )r rQ rI Z wrapped_csr�resr r r �begin_finalization� s
�zClientV2.begin_finalization)rQ rR �fetch_alternative_chainsr c s� t j �� |k r�t�d� � �|j�}tj�|� � �}|j
tj krb|j durVt
�|j ��t
�d��q |j
tjkr |jdur � �|j�}|j||jd�}|r �|d�}� fdd�|D �}|j|d�}|S q t
�� �dS ) z�
Poll an order that has been finalized for its status.
If it becomes valid, obtain the certificate.
:returns: finalized order (with certificate)
:rtype: messages.OrderResource
r\ NzPThe certificate order failed. No further information was provided by the server.)r. Z
fullchain_pemZ alternatec s g | ]}� � |�j�qS r )rF �text)�.0rL �r r r �
<listcomp> � z.ClientV2.poll_finalization.<locals>.<listcomp>)Zalternative_fullchains_pem)rV rW r^ r_ rF r4 r rD r6 r7 r] ZSTATUS_INVALIDrc r Z
IssuanceError�Errorrb � certificater, ri �
_get_linksra ) r rQ rR rh r' r. Zcertificate_responseZalt_chains_urlsZ
alt_chainsr rk r �poll_finalization� s&
� zClientV2.poll_finalizationc C s | � |� | �|||�S )a{ Finalize an order and obtain a certificate.
:param messages.OrderResource orderr: order to finalize
:param datetime.datetime deadline: when to stop polling and timeout
:param bool fetch_alternative_chains: whether to also fetch alternative
certificate chains
:returns: finalized order
:rtype: messages.OrderResource
)rg rq )r rQ rR rh r r r rZ s
zClientV2.finalize_order)�cert�rsnr c C s | � ||| jd � dS )a Revoke certificate.
:param .ComparableX509 cert: `OpenSSL.crypto.X509` wrapped in
`.ComparableX509`
:param int rsn: Reason code for certificate revocation.
:raises .ClientError: If revocation is unsuccessful.
Z
revokeCertN)�_revoker )r rr rs r r r �revoke s zClientV2.revoke�r c C s$ t | jd�o"t | jjd�o"| jjjS )zGChecks if ACME server requires External Account Binding authentication.�meta�external_account_required)�hasattrr rw rx rk r r r rx # s
��z"ClientV2.external_account_required��args�kwargsr c O s, |dd� d |dd� }| j |i |��S )z
Send GET request using the POST-as-GET protocol.
:param args:
:param kwargs:
:return:
Nr\ �N)r! )r r{ r| �new_argsr r r rF ) s zClientV2._post_as_get)r' �
relation_typer c s. d|j vrg S t|j d �}� fdd�|D �S )z�
Retrieves all Link URIs of relation_type from the response.
:param requests.Response response: The requests HTTP response.
:param str relation_type: The relation type to filter by.
ZLinkc s0 g | ](}d |v rd|v r|d � kr|d �qS )�relrL r )rj �l�r r r rl > s �z'ClientV2._get_links.<locals>.<listcomp>)r# r
)r r' r �linksr r� r rp 3 s
zClientV2._get_links)rL r r c C s t j�|�|��� �S )aB
Retrieves the ACME directory (RFC 8555 section 7.1.1) from the ACME server.
:param str url: the URL where the ACME directory is available
:param ClientNetwork net: the ClientNetwork to use to make the request
:returns: the ACME directory object
:rtype: messages.Directory
)r � Directoryr6 rH r7 )�clsrL r r r r �
get_directoryA s
zClientV2.get_directory)r' r4 �terms_of_servicer c C s> d|j v r|j d d }tjtj�|�� �|j�d|�|d�S )Nzterms-of-servicerL r )r. r4 r� )r� r �RegistrationResourcer5 r6 r7 r# rH )r� r' r4 r� r r r r% M s
�z ClientV2._regr_from_response)r( r. r c C s" | � |j|�}| j||j|jd�S )N)r4 r� )r! r4 r% r� )r r( r. r' r r r r0 Y s
�zClientV2._send_recv_regrc O s& |� dt| jd�� | jj|i |��S )z�Wrapper around self.net.post that adds the newNonce URL.
This is used to retry the request in case of a badNonce error.
�
new_nonce_urlZnewNonce)�
setdefault�getattrr r �post�r r{ r| r r r r! g s zClientV2._postc C s | � |tj�ddd���S )z�Deactivate registration.
:param messages.RegistrationResource regr: The Registration Resource
to be deactivated.
:returns: The Registration resource that was deactivated.
:rtype: `.RegistrationResource`
� deactivatedN)r] Zcontact)r1 r r5 r6 r* r r r �deactivate_registrationp s �z ClientV2.deactivate_registrationc C s. t jdd�}| �|j|�}| �||jj|j�S )a Deactivate authorization.
:param messages.AuthorizationResource authzr: The Authorization resource
to be deactivated.
:returns: The Authorization resource that was deactivated.
:rtype: `.AuthorizationResource`
r� )r] )r ZUpdateAuthorizationr! r4 rE r. rO )r rN r. r' r r r �deactivate_authorization~ s
�z!ClientV2.deactivate_authorization)r' rO r4 r c C sF t jt j�|�� �|j�d|�d�}|d urB|jj|krBt �
|��|S )Nr r3 ) r �AuthorizationResourceZ
Authorizationr6 r7 r# rH r. rO r �UnexpectedUpdate)r r' rO r4 rN r r r rE � s �
z ClientV2._authzr_from_response)�challbr' r c C st | � |j|�}z|jd d }W n ty< t�d��Y n0 tj|tj� |�
� �d�}|j|jkrpt� |j��|S )ah Answer challenge.
:param challb: Challenge Resource body.
:type challb: `.ChallengeBody`
:param response: Corresponding Challenge response
:type response: `.challenges.ChallengeResponse`
:returns: Challenge Resource with updated body.
:rtype: `.ChallengeResource`
:raises .UnexpectedUpdate:
ZuprL z"up" Link header missing)�
authzr_urir. ) r! r4 r� �KeyErrorr � ClientErrorr �ChallengeResource�
ChallengeBodyr6 r7 r� )r r� r' Zrespr� Zchallrr r r �answer_challenge� s � zClientV2.answer_challenge)r' �defaultr c C s� |j �dt|��}z t|�}W nx ty� t|�}|dur�z:t�|d durV|d nd�}tj|dd� � | W Y S ttfy� Y n0 |}Y n0 tj� � tj|d� S )a� Compute next `poll` time based on response ``Retry-After`` header.
Handles integers and various datestring formats per
https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.37
:param requests.Response response: Response from `poll`.
:param int default: Default value (in seconds), used when
``Retry-After`` header is not present or invalid.
:returns: Time point when next `poll` should be performed.
:rtype: `datetime.datetime`
z Retry-AfterN���r � rT )
r# rH �str�int�
ValueErrorr rV rX �
OverflowErrorrW )r� r' r� � retry_afterrU ZwhenZtz_secsr r r r� � s
zClientV2.retry_after)rr rs rL r c C s0 | � |tj||d��}|jtjkr,t�d��dS )a. Revoke certificate.
:param .ComparableX509 cert: `OpenSSL.crypto.X509` wrapped in
`.ComparableX509`
:param int rsn: Reason code for certificate revocation.
:param str url: ACME URL to post to
:raises .ClientError: If revocation is unsuccessful.
)ro �reasonz0Successful revocation must return HTTP OK statusN)r! r Z
Revocationr" � http_clientZOKr r� )r rr rs rL r' r r r rt � s
�� �zClientV2._revoke)N)F)N)F)F)NN)NN)8�__name__�
__module__� __qualname__�__doc__r r� r ZNewRegistrationr� r r+ r r5 r1 �boolr) �bytesrG rM r� r
�requests�ResponserP rV r[ rY rg rq rZ rd re r� ru rx r rF r� r rp � classmethodr� r% r0 r! r� r� rC rE r� r ZChallengeResponser� r� r� rt r r r r r $ s� �
�� � #� � � � � �� ! �
�
� � � � � �
�
� r c @ s2 e Zd ZdZdZdZdZdZdej dde
fej e e
j ejeeedd �d
d �Zdd �d
d�Zejeeed�dd�Zed)eje e ejd�dd��Zeeeeejd�dd�Z eeejd�dd�Z efeeeejd�d d �Z ejdd �d d �Z eeed!�d"d#�Z eeejd�d$d%�Z!efeejeeejd&�d'd(�Z"dS )*r zvWrapper around requests that signs POSTs for authentication.
Also adds user agent, and handles Content-Type.
zapplication/jsonzapplication/jose+jsonzapplication/problem+jsonz Replay-NonceNTz acme-python)�keyr& �alg�
verify_ssl�
user_agent�timeoutr c C s\ || _ || _|| _|| _t� | _|| _t�� | _ || _
t � }| j � d|� | j � d|� d S )Nzhttp://zhttps://)
r� r& r� r� �set�_noncesr� r� ZSession�session�_default_timeoutr Zmount)r r� r& r� r� r� r� Zadapterr r r r s
zClientNetwork.__init__rv c C s& z| j �� W n ty Y n0 d S r} )r� �close� Exceptionrk r r r �__del__ s zClientNetwork.__del__)�obj�noncerL r c C s~ |r|j dd��� nd}t�d|� | j||d�}| jdurJ| jd |d< | j|d < tjj |fi t
t t t
f |���j dd�S )
z�Wrap `JSONDeSerializable` object in JWS.
.. todo:: Implement ``acmePath``.
:param josepy.JSONDeSerializable obj:
:param str url: The URL to which this object will be POSTed
:param str nonce:
:rtype: str
� )�indentrm zJWS payload:
%s)r� r� rL Nr4 Zkidr� )Z
json_dumps�encode�logger�debugr� r& r� r ZJWSZsignr r r� r )r r� r� rL �jobjr| r r r � _wrap_in_jws s �
zClientNetwork._wrap_in_jws)r' � content_typer c
C s$ |j �d�}|r"|�d�d �� }z |�� }W n tyD d}Y n0 |jdkrdt�|j �dd���|j s�|dur�|| j
kr�t � d|� zt
j�|��W q� tjy� } zt�||f��W Y d}~q�d}~0 0 n
t�|��nD|dur�|| jkr�t � d |� || jk�r |du �r t�d
|� ���|S ) a� Check response content and its type.
.. note::
Checking is not strict: wrong server response ``Content-Type``
HTTP header is ignored if response is an expected JSON object
(c.f. Boulder #56).
:param str content_type: Expected Content-Type response header.
If JSON is expected and not present in server response, this
function will raise an error. Otherwise, wrong Content-Type
is ignored, but logged.
:raises .messages.Error: If server response body
carries HTTP Problem (https://datatracker.ietf.org/doc/html/rfc7807).
:raises .ClientError: In case of other networking errors.
� Content-Type�;r Ni� r zUNKNOWN-LOCATIONz/Ignoring wrong Content-Type (%r) for JSON Errorz<Ignoring wrong Content-Type (%r) for JSON decodable responsez"Unexpected response Content-Type: )r# rH �split�stripr7 r� r" r r$ �ok�JSON_ERROR_CONTENT_TYPEr� r� r rn r6 rd �DeserializationErrorr� �JSON_CONTENT_TYPE)r� r' r� Z response_ctr� rc r r r �_check_response2 s:
�& �z ClientNetwork._check_response)�methodrL r{ r| r c
O sD |dkr t �d||d � nt �d||� | j|d< |�di � |d �d| j� |�d| j� z | jj||g|�R i |��}W nn tj j
y� } zRd }t � |t
|��}|d
u r�� |�� \} }
} } td | � |
� d | � ���W Y d
}~n
d
}~0 0 d
|d v �r t�|j�}
n d|_|j}
t �d|jd�dd� |j�� D ��|
� |S )a� Send HTTP request.
Makes sure that `verify_ssl` is respected. Logs request and
response (with headers). For allowed parameters please see
`requests.request`.
:param str method: method for the new `requests.Request` object
:param str url: URL for the new `requests.Request` object
:raises requests.exceptions.RequestException: in case of any problems
:returns: HTTP Response
:rtype: `requests.Response`
�POSTz Sending POST request to %s:
%s�datazSending %s request to %s.Zverifyr# z
User-Agentr� zT.*host='(\S*)'.*Max retries exceeded with url\: (\/\w*).*(\[Errno \d+\])([A-Za-z ]*)Nz Requesting �:ZAcceptzutf-8z!Received response:
HTTP %d
%s
%s�
c s s | ]\}}d � ||�V qdS )z{0}: {1}N)�format)rj �k�vr r r � <genexpr>� s �z.ClientNetwork._send_request.<locals>.<genexpr>)r� r� r� r� r� r� r� Zrequestr� �
exceptionsZRequestException�re�matchr� �groupsr� �base64Z b64encodeZcontent�encodingri r" �joinr# �items)r r� rL r{ r| r' �eZ err_regex�m�host�pathZ_err_no�err_msgZ
debug_contentr r r �
_send_requestm s< �
.
��zClientNetwork._send_requestrz c O s | j dg|�R i |��S )a Send HEAD request without checking the response.
Note, that `_check_response` is not called, as it is expected
that status code other than successfully 2xx will be returned, or
messages2.Error will be raised by the server.
ZHEAD)r� r� r r r �head� s zClientNetwork.head)rL r� r| r c K s | j | jd|fi |��|d�S )z$Send GET request and check response.ZGET�r� )r� r� )r rL r� r| r r r rH � s �zClientNetwork.get)r' r c
C s� | j |jv r||j| j }ztjjd �|�}W n2 tjy` } zt� ||��W Y d }~n
d }~0 0 t
� d|� | j �
|� n
t�|��d S )Nr� zStoring nonce: %s)�REPLAY_NONCE_HEADERr# r ZHeader�_fields�decoderd r� r ZBadNoncer� r� r� �addZ MissingNonce)r r' r� Z
decoded_noncerc r r r �
_add_nonce� s " zClientNetwork._add_nonce)rL r� r c C sL | j sBt�d� |d u r$| �|�}n| j| �|�d d�}| �|� | j �� S )NzRequesting fresh noncer� )r� r� r� r� r� r� �pop)r rL r� r' r r r �
_get_nonce� s
zClientNetwork._get_noncec
O sr z| j |i |��W S tjyl } z@|jdkrVt�d|� | j |i |��W Y d}~S � W Y d}~n
d}~0 0 dS )z�POST object wrapped in `.JWS` and check response.
If the server responded with a badNonce error, the request will
be retried once.
ZbadNoncez Retrying request after error:
%sN)�
_post_oncer rn �coder� r� )r r{ r| rc r r r r� � s
zClientNetwork.post)rL r� r� r| r c K sf |� dd �}| �|| �||�|�}|�dd|i� | jd|fd|i|��}| j||d�}| �|� |S )Nr� r# r� r� r� r� )r� r� r� r� r� r� r� )r rL r� r� r| r� r� r' r r r r� � s
zClientNetwork._post_once)N)#r� r� r� r� r� ZJOSE_CONTENT_TYPEr� r� rd ZRS256�DEFAULT_NETWORK_TIMEOUTZJWKr r r� Z JWASignaturer� r� r� r r� ZJSONDeSerializabler� r� r� r� r� r r� r� rH r� r� r� r� r r r r r � s>
�� �
�:G
� ��r ))r� r� rV Z email.utilsr Z http.clientZclientr� Zloggingr� r^ �typingr r r r r r r r
r Zjosepyrd r> r� Zrequests.adaptersr Zrequests.utilsr
Zacmer r r r r Z getLoggerr� r� r� r r r r r r �<module> sB
K