| Server IP : 3.96.16.70 / Your IP : 216.73.216.15 Web Server : Apache System : Linux ip-172-31-26-103.ca-central-1.compute.internal 6.1.163-186.299.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Feb 24 16:35:42 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.18 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /usr/lib/python3.9/site-packages/certbot/__pycache__/ |
Upload File : |
a
�]e ` � @ s
d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm Z ddlm
Z
ddlm Z dd lm Z dd
l
mZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl m Z ddl m Z ddl!m"Z" ddl!m#Z# ddl!m$Z$ ddl%Z%ddl&m'Z' ddl&m(Z( ddl)Z)ddl*m+Z, ddl-m.Z. dd l-m/Z/ dd l-m0Z0 dd l1m2Z2 e �r�dd l3m4Z4 dd l5m6Z6 dd!l7m8Z8 dd"l9m:Z: e�;e<�Z=d|e>ee? e?e?e?e@e0jAd'�d(d)�ZBd}e0jAe ee? e e? f ee? e@e@e0jCd+�d,d-�ZDeEe@d.�d/d0�ZFeEeEe@d1�d2d3�ZGe?eEe
e>e0jCee? f d4�d5d6�ZHd~e>e?ee? eEd8�d9d:�ZIe e?eEf e@d;�d<d=�ZJe/jKdd>�d?d@�ZLe/jKdd>�dAdB�ZMe edCdDe e dEdFf eEeEejNddG�dHdI�ZOe?e?ddJ�dKdL�ZPe/jKdd>�dMdN�ZQeEe
e'jRe>f dO�dPdQ�ZSe'jTfeEee>eEge e'jRe'jUf f e>e e'jRe'jUf dR�dSdT�ZVe'jTfeEee>eEge e'jRe'jUf f e>ee? dR�dUdV�ZWe'jTfeEe>ee? dW�dXdY�ZXeEee>eEge e'jRe'jUf f e>ee? dZ�d[d\�ZYe e'jRe'jUf ee? d]�d^d_�ZZe'jTfeEe>ee? dW�d`da�Z[e'jTfeEe>ee? db�dcdd�Z\e'jTfe ee'jR ee%j] f e>eEde�dfdg�Z^e?ejdh�didj�Z_e?ejdh�dkdl�Z`e?ee'jRgeeE f ejdm�dndo�Zae?e?dp�dqdr�Zbe�cdsejd�Zee?e
e?e?f dt�dudv�Zfe?e>dh�dwdx�Zgdee? e?e@e?dy�dzd{�ZhdS )�z�Certbot client crypto utility functions.
.. todo:: Make the transition to use PSS rather than PKCS1_v1_5 when the server
is capable of handling the signatures.
� N)�Callable)�List)�Optional)�Set)�Tuple)�
TYPE_CHECKING)�Union)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)�ec)� DSAPublicKey)�ECDSA)�EllipticCurvePublicKey)�PKCS1v15)� RSAPublicKey)�Encoding)� NoEncryption)�
PrivateFormat)�crypto)�SSL)� crypto_util)�errors)�
interfaces)�util)�os)�Ed448PublicKey)�Ed25519PublicKey)�
X448PublicKey)�X25519PublicKey�rsa� secp256r1�key-certbot.pemT)�key_size�key_dir�key_type�elliptic_curve�keyname�strict_permissions�returnc
C s� zt | |p d|d�}W nF ty\ } z.tjddd� t�dt|�� |�W Y d}~n
d}~0 0 d}|r�t�|d|� t�t j
� ||�d d
�\} }| � | � |� W d � n1 s�0 Y |d kr�t�d | |� nt�d
| |� t�
||�S )a$ Initializes and saves a privkey.
Inits key and saves it in PEM format on the filesystem.
.. note:: keyname is the attempted filename, it may be different if a file
already exists at the path.
:param int key_size: key size in bits if key size is rsa.
:param str key_dir: Optional key save directory.
:param str key_type: Key Type [rsa, ecdsa]
:param str elliptic_curve: Name of the elliptic curve if key type is ecdsa.
:param str keyname: Filename of key
:param bool strict_permissions: If true and key_dir exists, an exception is raised if
the directory doesn't have 0700 permissions or isn't owned by the current user.
:returns: Key
:rtype: :class:`certbot.util.Key`
:raises ValueError: If unable to generate the key given key_size.
r# )�bitsr( r' � T��exc_infoz&Encountered error while making key: %sNi� i� �wbr" z Generating RSA key (%d bits): %sz"Generating ECDSA key (%d bits): %s)�make_key�
ValueError�logger�debug�error�strr �make_or_verify_dir� unique_filer �path�join�write�Key)
r% r& r' r( r) r* Zkey_pem�err�key_pathZkey_f� r? �7/usr/lib/python3.9/site-packages/certbot/crypto_util.py� generate_key8 s(
�
�(rA F)�privkey�namesr9 � must_stapler* r+ c C s� t j| j||d�}d}|r~t�|d|� t�tj�|d�dd�\}}|� |� |� W d � n1 sh0 Y t
� d|� t� ||d�S ) aC Initialize a CSR with the given private key.
:param privkey: Key to include in the CSR
:type privkey: :class:`certbot.util.Key`
:param set names: `str` names to include in the CSR
:param str path: Optional certificate save directory.
:param bool must_staple: If true, include the TLS Feature extension "OCSP Must-Staple"
:param bool strict_permissions: If true and path exists, an exception is raised if
the directory doesn't have 0755 permissions or isn't owned by the current user.
:returns: CSR
:rtype: :class:`certbot.util.CSR`
)rD Ni� zcsr-certbot.pemi� r0 zCreating CSR: %s�pem)
�acme_crypto_utilZmake_csrrE r r7 r8 r r9 r: r; r3 r4 �CSR)rB rC r9 rD r* Zcsr_pemZ csr_filenameZcsr_fr? r? r@ � generate_csri s ��( rH )�csrr+ c C sH z t �t j| �}|�|�� �W S t jyB tjddd� Y dS 0 dS )z�Validate CSR.
Check if `csr` is a valid CSR for the given domains.
:param bytes csr: CSR in PEM.
:returns: Validity of CSR.
:rtype: bool
r- Tr. FN)r �load_certificate_request� FILETYPE_PEM�verifyZ
get_pubkey�Errorr3 r4 )rI �reqr? r? r@ � valid_csr� s �rO )rI rB r+ c C sR t �t j| �}t �t j|�}z |�|�W S t jyL tjddd� Y dS 0 dS )z�Does private key correspond to the subject public key in the CSR?
:param bytes csr: CSR in PEM.
:param bytes privkey: Private key file contents (PEM)
:returns: Correspondence of private key to CSR subject public key.
:rtype: bool
r- Tr. FN)r rJ rK �load_privatekeyrL rM r3 r4 )rI rB rN Zpkeyr? r? r@ �csr_matches_pubkey� s
� rQ )�csrfile�datar+ c C s� t j}t j}z|t j|�}W nH t jyd z|||�}W n$ t jy^ t�d�| ���Y n0 Y n0 t|�}t �||�}|t j
| |dd�|fS )a1 Import a CSR file, which can be either PEM or DER.
:param str csrfile: CSR filename
:param bytes data: contents of the CSR file
:returns: (`crypto.FILETYPE_PEM`,
util.CSR object representing the CSR,
list of domains requested in the CSR)
:rtype: tuple
z Failed to parse CSR file: {0}rE )�filerS Zform) r rK rJ �
FILETYPE_ASN1rM r �format�"_get_names_from_loaded_cert_or_reqZdump_certificate_requestr rG )rR rS �PEM�loadrI ZdomainsZdata_pemr? r? r@ �import_csr_file� s rZ � )r, r' r( r+ c
C sD |dkr8| dk r t �d�| ���t�� }|�tj| � n�|dk�r&|sPt �d��zZ|�� }|dv r�tt |�� �}|s�t �d|� ���t j
|� t � d�}nt �d �|���W nT t y� t �d �|���Y n4 t
y� } z |t �t|���W Y d
}~n
d
}~0 0 |jtjtjt� d �}t�tj|�}nt �d �|���t�tj|�S )
a� Generate PEM encoded RSA|EC key.
:param int bits: Number of bits if key_type=rsa. At least 1024 for RSA.
:param str key_type: The type of key to generate, but be rsa or ecdsa
:param str elliptic_curve: The elliptic curve to use.
:returns: new RSA or ECDSA key in PEM form with specified number of bits
or of type ec_curve when key_type ecdsa is used.
:rtype: str
r" r[ z Unsupported RSA key length: {}Zecdsaz3When key_type == ecdsa, elliptic_curve must be set.)Z SECP256R1Z SECP384R1Z SECP521R1zInvalid curve type: )�curveZbackendz Unsupported elliptic curve: {}N)�encodingrV Zencryption_algorithmz0Invalid key_type specified: {}. Use [rsa|ecdsa])r rM rV r ZPKeyrA ZTYPE_RSA�upper�getattrr Zgenerate_private_keyr � TypeErrorr r6 Z
private_bytesr rX r ZTraditionalOpenSSLr rP rK Zdump_privatekey) r, r' r( �key�namer\ Z_key�eZ_key_pemr? r? r@ r1 � s>
� &�r1 )rB r+ c C s4 zt �t j| ��� W S tt jfy. Y dS 0 dS )z�Is valid RSA private key?
:param privkey: Private key file contents in PEM
:returns: Validity of private key.
:rtype: bool
FN)r rP rK Zcheckr` rM )rB r? r? r@ �
valid_privkey s �
rd )�renewable_certr+ c C s" t | � t| � t| j| j� dS )a� For checking that your certs were not corrupted on disk.
Several things are checked:
1. Signature verification for the cert.
2. That fullchain matches cert and chain when concatenated.
3. Check that the private key matches the certificate.
:param renewable_cert: cert to verify
:type renewable_cert: certbot.interfaces.RenewableCert
:raises errors.Error: If verification fails.
N)�verify_renewable_cert_sig�verify_fullchain� verify_cert_matches_priv_key� cert_pathr> )re r? r? r@ �verify_renewable_cert s
rj c
C s� z�t | jd��"}t�|�� t� �}W d � n1 s60 Y t | jd��"}t�|�� t� �}W d � n1 st0 Y |�� }|js�J �t ||j
|j |j� W nL t t
tfy� } z.d�| j|�}t�|� t�|��W Y d}~n
d}~0 0 dS )z�Verifies the signature of a RenewableCert object.
:param renewable_cert: cert to verify
:type renewable_cert: certbot.interfaces.RenewableCert
:raises errors.Error: If signature verification fails.
�rbNzbverifying the signature of the certificate located at {0} has failed. Details: {1})�open�
chain_pathr �load_pem_x509_certificate�readr ri �
public_key�signature_hash_algorithm�verify_signed_payload� signatureZtbs_certificate_bytes�IOErrorr2 r
rV r3 � exceptionr rM )re �
chain_file�chain� cert_file�certZpkrc � error_strr? r? r@ rf % s 00
��
rf r r r! r )rp rs �payloadrq r+ c C sJ t | t�r | �||t� |� n(t | t�r<| �||t|�� n
t�d��dS )a� Check the signature of a payload.
:param RSAPublicKey/EllipticCurvePublicKey public_key: the public_key to check signature
:param bytes signature: the signature bytes
:param bytes payload: the payload bytes
:param hashes.HashAlgorithm signature_hash_algorithm: algorithm used to hash the payload
:raises InvalidSignature: If signature verification fails.
:raises errors.Error: If public key type is not supported
z Unsupported public key type.N)�
isinstancer rL r r r r rM )rp rs r{ rq r? r? r@ rr = s
�
�rr )ri r> r+ c
C s~ z,t �t j�}|�| � |�|� |�� W nL tt jfyx } z.d�| ||�}t �
|� t �|��W Y d}~n
d}~0 0 dS )z� Verifies that the private key and cert match.
:param str cert_path: path to a cert in PEM format
:param str key_path: path to a private key file
:raises errors.Error: If they don't match.
z�verifying the certificate located at {0} matches the private key located at {1} has failed. Details: {2}N) r ZContextZ
SSLv23_METHODZuse_certificate_fileZuse_privatekey_fileZcheck_privatekeyrt rM rV r3 ru r )ri r> �contextrc rz r? r? r@ rh X s
�
rh c
C s4 z�t | j��}|�� }W d � n1 s*0 Y t | j��}|�� }W d � n1 s\0 Y t | j��}|�� }W d � n1 s�0 Y || |kr�d}|�| j�}t�|��W nn t �y } z*d�|�}t
� |� t�|��W Y d}~n4d}~0 tj�y. } z|�W Y d}~n
d}~0 0 dS )z� Verifies that fullchain is indeed cert concatenated with chain.
:param renewable_cert: cert to verify
:type renewable_cert: certbot.interfaces.RenewableCert
:raises errors.Error: If cert and chain do not combine to fullchain.
Nz.fullchain does not match cert + chain for {0}!z8reading one of cert, chain, or fullchain has failed: {0}) rl rm ro ri Zfullchain_pathrV Z lineagenamer rM rt r3 ru ) re rv rw rx ry Zfullchain_fileZ fullchainrz rc r? r? r@ rg n s" & & &
rg )rS r+ c C s� g }t jt jfD ]L}zt �|| �|fW S t jyZ } z|�|� W Y d}~qd}~0 0 qt�d�d�dd� |D �����dS )z:Load PEM/DER certificate.
:raises errors.Error:
NzUnable to load: {0}�,c s s | ]}t |�V qd S �N)r6 )�.0r5 r? r? r@ � <genexpr>� s z-pyopenssl_load_certificate.<locals>.<genexpr>) r rK rU �load_certificaterM �appendr rV r: )rS Zopenssl_errorsZ file_typer5 r? r? r@ �pyopenssl_load_certificate� s "�r� )�cert_or_req_str� load_func�typr+ c
C sX z ||| �W S t jyR } z,tjddd� t�dt|�� � W Y d }~n
d }~0 0 d S )Nr- Tr. z6Encountered error while loading certificate or csr: %s)r rM r3 r4 r5 r6 )r� r� r� r= r? r? r@ �_load_cert_or_req� s r� c C s t �t| ||��S r )rF Z_pyopenssl_cert_or_req_sanr� )r� r� r� r? r? r@ �_get_sans_from_cert_or_req� s �r� )ry r� r+ c C s t | tj|�S )z�Get a list of Subject Alternative Names from a certificate.
:param str cert: Certificate (encoded).
:param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1`
:returns: A list of Subject Alternative Names.
:rtype: list
)r� r r� �ry r� r? r? r@ �get_sans_from_cert� s
�r� )� cert_or_reqr� r� r+ c C s t | ||�}t|�S r )r� rW )r� r� r� �loaded_cert_or_reqr? r? r@ �_get_names_from_cert_or_req� s r� )r� r+ c C s
t �| �S r )rF Z _pyopenssl_cert_or_req_all_names)r� r? r? r@ rW � s rW c C s t | tj|�S )z�Get a list of domains from a cert, including the CN if it is set.
:param str cert: Certificate (encoded).
:param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1`
:returns: A list of domain names.
:rtype: list
)r� r r� r� r? r? r@ �get_names_from_cert� s
�r� )rI r� r+ c C s t | tj|�S )z�Get a list of domains from a CSR, including the CN if it is set.
:param str csr: CSR (encoded).
:param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1`
:returns: A list of domain names.
:rtype: list
)r� r rJ )rI r� r? r? r@ �get_names_from_req� s r� )rw �filetyper+ c C s t �| |�S )z�Dump certificate chain into a bundle.
:param list chain: List of `crypto.X509` (or wrapped in
:class:`josepy.util.ComparableX509`).
)rF �dump_pyopenssl_chain)rw r� r? r? r@ r� � s
r� )ri r+ c C s t | tjj�S )z�When does the cert at cert_path start being valid?
:param str cert_path: path to a cert in PEM format
:returns: the notBefore value from the cert at cert_path
:rtype: :class:`datetime.datetime`
)�_notAfterBeforer �X509Z
get_notBefore�ri r? r? r@ � notBefore� s r� c C s t | tjj�S )z�When does the cert at cert_path stop being valid?
:param str cert_path: path to a cert in PEM format
:returns: the notAfter value from the cert at cert_path
:rtype: :class:`datetime.datetime`
)r� r r� Z get_notAfterr� r? r? r@ �notAfter� s r� )ri �methodr+ c
C s� t | d��"}t�tj|�� �}W d � n1 s20 Y ||�}|sRt�d��|dd� d|dd� d|dd� d |dd
� d |d
d � d |d d� g }d
�|�}|�d�}t �
|�S )aP Internal helper function for finding notbefore/notafter.
:param str cert_path: path to a cert in PEM format
:param function method: one of ``crypto.X509.get_notBefore``
or ``crypto.X509.get_notAfter``
:returns: the notBefore or notAfter value from the cert at cert_path
:rtype: :class:`datetime.datetime`
rk Nz>Error while invoking timestamp method, None has been returned.r � � -� � � T�
� :� � �ascii) rl r r� rK ro r rM r: �decode� pyrfc3339�parse)ri r� �fr Z timestampZreformatted_timestampZtimestamp_bytesZ
timestamp_strr? r? r@ r�
s
0
�
r� )�filenamer+ c C sN t �� }t| d��$}|�|�� �d�� W d � n1 s<0 Y |�� S )aN Compute a sha256sum of a file.
NB: In given file, platform specific newlines characters will be converted
into their equivalent unicode counterparts before calculating the hash.
:param str filename: path to the file whose hash will be computed
:returns: sha256 digest of the file in hexadecimal
:rtype: str
�rzUTF-8N)�hashlib�sha256rl �updatero �encode� hexdigest)r� r� Zfile_dr? r? r@ � sha256sum& s 2r� s@ -----BEGIN CERTIFICATE-----
?
.+?
?
-----END CERTIFICATE-----
?
)�
fullchain_pemr+ c C sL t �| �� �}t|�dk r$t�d��dd� |D �}|d d�|dd� �fS ) a Split fullchain_pem into cert_pem and chain_pem
:param str fullchain_pem: concatenated cert + chain
:returns: tuple of string cert_pem and chain_pem
:rtype: tuple
:raises errors.Error: If there are less than 2 certificates in the chain.
� zPfailed to parse fullchain into cert and chain: less than 2 certificates in chainc S s( g | ] }t �t jt �t j|���� �qS r? )r Zdump_certificaterK r� r� )r� ry r? r? r@ �
<listcomp>V s � �z1cert_and_chain_from_fullchain.<locals>.<listcomp>r r- � N)�CERT_PEM_REGEX�findallr� �lenr rM r: )r� �certsZcerts_normalizedr? r? r@ � cert_and_chain_from_fullchainA s
�r� c C sD t | d��"}t�tj|�� �}W d � n1 s20 Y |�� S )z�Retrieve the serial number of a certificate from certificate path
:param str cert_path: path to a cert in PEM format
:returns: serial number of the certificate
:rtype: int
rk N)rl r r� rK ro Zget_serial_number)ri r� r r? r? r@ �get_serial_from_cert] s 0r� )�
fullchains� issuer_cn�warn_on_no_matchr+ c C sl | D ]N}t �|�� �}t�|d t� �}|j�tjj �}|r|d j
|kr| S q|rdt � d|� | d S )a' Chooses the first certificate chain from fullchains whose topmost
intermediate has an Issuer Common Name matching issuer_cn (in other words
the first chain which chains to a root whose name matches issuer_cn).
:param fullchains: The list of fullchains in PEM chain format.
:type fullchains: `list` of `str`
:param `str` issuer_cn: The exact Subject Common Name to match against any
issuer in the certificate chain.
:returns: The best-matching fullchain, PEM-encoded, or the first if none match.
:rtype: `str`
���r z�Certbot has been configured to prefer certificate chains with issuer '%s', but no chain from the CA matched this issuer. Using the default certificate chain instead.)
r� r� r� r rn r ZissuerZget_attributes_for_oidZNameOIDZ COMMON_NAME�valuer3 Zwarning)r� r� r� rw r� Ztop_certZ
top_issuer_cnr? r? r@ �find_chain_with_issuerk s
�r� )r" r# r$ T)FT)r[ r" N)F)i�__doc__Zdatetimer� Zlogging�re�typingr r r r r r r Z cryptographyr Zcryptography.exceptionsr
r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr
Z)cryptography.hazmat.primitives.asymmetricr Z-cryptography.hazmat.primitives.asymmetric.dsar Z,cryptography.hazmat.primitives.asymmetric.ecr r Z1cryptography.hazmat.primitives.asymmetric.paddingr Z-cryptography.hazmat.primitives.asymmetric.rsar Z,cryptography.hazmat.primitives.serializationr r r ZjosepyZOpenSSLr r r� Zacmer rF Zcertbotr r r Zcertbot.compatr Z/cryptography.hazmat.primitives.asymmetric.ed448r Z1cryptography.hazmat.primitives.asymmetric.ed25519r Z.cryptography.hazmat.primitives.asymmetric.x448r Z0cryptography.hazmat.primitives.asymmetric.x25519r! Z getLogger�__name__r3 �intr6 �boolr< rA rG rH �bytesrO rQ rZ r1 rd Z
RenewableCertrj rf Z
HashAlgorithmrr rh rg r� r� rK ZX509Reqr� r� r� r� rW r� r� ZComparableX509r� r� r� r� r� �compile�DOTALLr� r� r� r� r? r? r? r@ �<module> s�
� � 2 � � %" �� 0�� �� ��� �� �
��
� � �
�