import argparse, subprocess, json, os, urllib2, sys, base64, binascii, ssl, \ hashlib, tempfile, re, time def sign_csr(csr): """Use the ACME protocol to get an ssl certificate signed by a certificate authority. :param string csr: Path to the certificate signing request. :returns: Signed Certificate (PEM format) :rtype: string """ CA = "https://letsencrypt-demo.org/" #CA = "http://localhost:8888/" def _b64(b): "Shortcut function to go from bytes to jwt base64 string" return base64.urlsafe_b64encode(b).replace("=", "") def _a64(a): "Shortcut function to go from jwt base64 string to bytes" return base64.urlsafe_b64decode(str(a + ("=" * (len(a) % 4)))) #Step 1: Get the domain name to be certified sys.stderr.write("Reading csr file...\n") proc = subprocess.Popen(["openssl", "req", "-in", csr, "-noout", "-text"], stdout=subprocess.PIPE, stderr=subprocess.PIPE) out, err = proc.communicate() domain, pub_hex, pub_exp = re.search("\ Subject:.+? CN=([^\s,;/]+).+?\ Modulus\:\s+00:([a-f0-9\:\s]+?)\ Exponent\: ([0-9]+)\ ", out, re.MULTILINE|re.DOTALL).groups() pub_mod = binascii.unhexlify(re.sub("(\s|:)", "", pub_hex)) pub_mod64 = _b64(pub_mod) pub_exp = int(pub_exp) pub_exp = "{0:x}".format(pub_exp) pub_exp = "0{}".format(pub_exp) if len(pub_exp) % 2 else pub_exp pub_exp = binascii.unhexlify(pub_exp) pub_exp64 = _b64(pub_exp) sys.stderr.write("Found domain '{}'\n".format(domain)) #Step 2: Get challenges from the CA sys.stderr.write("Requesting challenges...") data = json.dumps({ "type": "challengeRequest", "identifier": domain, }) resp = urllib2.urlopen(CA, data) result = resp.read() resp_json = json.loads(result) sessionID = resp_json['sessionID'] nonce64 = resp_json['nonce'] nonce = _a64(nonce64) challenges = resp_json['challenges'] sys.stderr.write("Challenges received!\n") #Step 3: Get the dvsni challenge sys.stderr.write("Parsing dvsni challenge...\n") challenge = [c for c in challenges if c['type'] == "dvsni"][0] dvsni_nonce = binascii.unhexlify(challenge['nonce']) dvsni_r = _a64(challenge['r']) #Step 4: Calculate the sni code client_code = os.urandom(32) sni_code = hashlib.sha256(dvsni_r + client_code).hexdigest() sni = sni_code + ".acme.invalid" #Step 5: Generate the OpenSSL configuration for the SNI challenge sys.stderr.write("Generating test configuation...\n") proc = subprocess.Popen(["openssl", "version", "-d"], stdout=subprocess.PIPE, stderr=subprocess.PIPE) out, err = proc.communicate() openssl_dir = re.search("OPENSSLDIR: \"([^\"]+)\"", out).group(1) openssl_cnf = open(os.path.join(openssl_dir, "openssl.cnf")).read() test_conf = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".cnf") test_conf.write(openssl_cnf) test_conf.write("\n\n[ alt_names ]\nsubjectAltName = DNS:" + sni + "\n") test_conf.flush() #Step 6: Generate a self-signed ssl cert with the sni altname sys.stderr.write("Generating test key for dvsni challenge...\n") test_crt = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".crt") test_crt_name = os.path.basename(test_crt.name) test_pem = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".pem") test_pem_name = os.path.basename(test_pem.name) proc = subprocess.Popen( ["openssl", "req", "-new", "-newkey", "rsa:4096", "-days", "365", "-nodes", "-x509", "-sha256", "-subj", "/C=AA/ST=A/L=A/O=A/CN={}".format(domain), "-config", test_conf.name, "-extensions", "alt_names", "-keyout", test_pem.name, "-out", test_crt.name], stdout=subprocess.PIPE, stderr=subprocess.PIPE) proc.wait() sys.stderr.write("Test key generated!\n") #Step 7: Get ready to sign the challenge response msgsig_nonce = os.urandom(16) msgsig_nonce64 = _b64(msgsig_nonce) msg = msgsig_nonce + domain + nonce msg_file = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".msg") msg_file_name = os.path.basename(msg_file.name) msg_file.write(msg) msg_file.flush() msgsig_file = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".msgsig") msgsig_file_name = os.path.basename(msgsig_file.name) #Step 8: Get ready to sign the certificate request response dersig_nonce = os.urandom(16) dersig_nonce64 = _b64(dersig_nonce) proc = subprocess.Popen(["openssl", "req", "-in", csr, "-outform", "DER"], stdout=subprocess.PIPE, stderr=subprocess.PIPE) der_raw, err = proc.communicate() der = dersig_nonce + der_raw der_file = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".der") der_file_name = os.path.basename(der_file.name) der_file.write(der) der_file.flush() dersig_file = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".dersig") dersig_file_name = os.path.basename(dersig_file.name) #Step 9: Get the user to sign the request and start the https server sys.stderr.write(""" ==================================================== ================USER ACTION REQUIRED================ ==================================================== Since we don't ask for your private key or sudo access, you will need to do some manual commands in order to get a signed certificate. Here's what you need to do: 1. Sign some files requested by the certificate authority. 2. Copy a test key and certificate to your server. 3. Run an https server with the test key and certificate. We've listed the commands you need to do this below. You should be able to copy and paste them into a new terminal window. (NOTE: Replace 'priv.key' below with your private key, if different) (NOTE: Replace 'ubuntu' below with your sudo user, if different) COMMANDS: -------------------------- #Step 1: Sign the needed files openssl dgst -sha256 -sign priv.key -out {} {} openssl dgst -sha256 -sign priv.key -out {} {} #Step 2: Copy the test key and certificate to your server scp {} ubuntu@{}:{} scp {} ubuntu@{}:{} #Step 3: Run an https server with the test key and certificate ssh -t ubuntu@{} "sudo python -c \\"import BaseHTTPServer, ssl; \\ httpd = BaseHTTPServer.HTTPServer(('0.0.0.0', 443), BaseHTTPServer.BaseHTTPRequestHandler); \\ httpd.socket = ssl.wrap_socket(httpd.socket, keyfile='{}', certfile='{}'); \\ httpd.serve_forever()\\"" -------------------------- ==================================================== ==================================================== ==================================================== """.format( msgsig_file_name, msg_file_name, dersig_file_name, der_file_name, test_pem_name, domain, test_pem_name, test_crt_name, domain, test_crt_name, domain, test_pem_name, test_crt_name)) stdout = sys.stdout sys.stdout = sys.stderr raw_input("Press Enter when you've run the above commands in a new terminal window...") sys.stdout = stdout #Step 10: Let the CA know you are ready for the challenge msgsig_file.seek(0) msgsig_in = msgsig_file.read() msgsig64 = _b64(msgsig_in) sys.stderr.write("Sending challenge response...\n") data = json.dumps({ "type": "authorizationRequest", "sessionID": sessionID, "nonce": nonce64, "signature": { "nonce": msgsig_nonce64, "alg": "RS256", "jwk": { "kty": "RSA", "e": pub_exp64, "n": pub_mod64 }, "sig": msgsig64 }, "responses": [ { "type": "dvsni", "s": _b64(client_code) } ] }) resp = urllib2.urlopen(CA, data) result = json.loads(resp.read()) #Step 11: Wait for the response giving authorization is_done = False while not is_done: if result['type'] == "defer": sys.stderr.write("Deferred...\n") time.sleep(result.get("interval", 3)) data = json.dumps({ "type": "statusRequest", "token": result['token'] }) resp = urllib2.urlopen(CA, data) result = json.loads(resp.read()) else: sys.stderr.write("Sending certificate request...\n") is_done = True #Step 12: Request the signed certificate proc = subprocess.Popen(["openssl", "req", "-in", csr, "-outform", "DER"], stdout=subprocess.PIPE, stderr=subprocess.PIPE) csr_der, err = proc.communicate() csr_der64 = _b64(csr_der) dersig_file.seek(0) dersig = dersig_file.read() dersig64 = _b64(dersig) data = json.dumps({ "type": "certificateRequest", "csr": csr_der64, "signature": { "alg": "RS256", "nonce": dersig_nonce64, "sig": dersig64, "jwk": { "kty": "RSA", "e": pub_exp64, "n": pub_mod64 } } }) resp = urllib2.urlopen(CA, data) result = json.loads(resp.read()) sys.stderr.write("Exporting signed certificate...\n") #Step 13: Parse the signed certificate crt_start = "-----BEGIN CERTIFICATE-----\n" crt_end = "\n-----END CERTIFICATE-----\n" crt64 = result['certificate'] crt_pem = base64.b64encode(_a64(crt64)) crt_pem = "\n".join(crt_pem[i:i+64] for i in xrange(0, len(crt_pem), 64)) crt_pem = crt_start + crt_pem + crt_end #Step 14: Parse any chained certificates for chain64 in result.get("chains", []): chain_pem = base64.b64encode(_a64(chain64)) chain_pem = "\n".join(chain_pem[i:i+64] for i in xrange(0, len(chain_pem), 64)) chain_pem = crt_start + chain_pem + crt_end crt_pem += chain_pem sys.stderr.write("Done! Your certificate is signed by the certificate authority!\n") #Step 15: Output the chained, signed certificate! return crt_pem if __name__ == "__main__": parser = argparse.ArgumentParser( formatter_class=argparse.RawDescriptionHelpFormatter, description="""\ Get a SSL certificate signed by a Let's Encrypt (ACME) certificate authority and output that signed certificate. You do NOT need to run this script on your server and this script does not ask for your private key. It will print out commands that you need to run with your private key or on your server as root, which gives you a chance to review the commands instead of trusting this script. Prerequisites: * openssl * python Example: Generate a key, create a csr, and have it signed. -------------- $ openssl genrsa -out priv.key 4096 $ openssl req -new -sha256 -key priv.key -out cert.csr $ python sign_csr.py cert.csr > signed.crt -------------- """) parser.add_argument("csr_path", help="path to certificate signing request") args = parser.parse_args() signed_crt = sign_csr(args.csr_path) sys.stdout.write(signed_crt)