path: root/sign_csr.py

import argparse, subprocess, json, os, urllib2, sys, base64, binascii, ssl, \
    hashlib, tempfile, re, time

def sign_csr(csr):
    """Use the ACME protocol to get an ssl certificate signed by a
    certificate authority.

    :param string csr: Path to the certificate signing request.

    :returns: Signed Certificate (PEM format)
    :rtype: string

    """
    CA = "https://letsencrypt-demo.org/"
    #CA = "http://localhost:8888/"

    def _b64(b):
        "Shortcut function to go from bytes to jwt base64 string"
        return base64.urlsafe_b64encode(b).replace("=", "")

    def _a64(a):
        "Shortcut function to go from jwt base64 string to bytes"
        return base64.urlsafe_b64decode(str(a + ("=" * (len(a) % 4))))

    #Step 1: Get the domain name to be certified
    sys.stderr.write("Reading csr file...\n")
    proc = subprocess.Popen(["openssl", "req", "-in", csr, "-noout", "-text"],
        stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    out, err = proc.communicate()
    domain, pub_hex, pub_exp = re.search("\
Subject:.+? CN=([^\s,;/]+).+?\
Modulus\:\s+00:([a-f0-9\:\s]+?)\
Exponent\: ([0-9]+)\
", out, re.MULTILINE|re.DOTALL).groups()
    pub_mod = binascii.unhexlify(re.sub("(\s|:)", "", pub_hex))
    pub_mod64 = _b64(pub_mod)
    pub_exp = int(pub_exp)
    pub_exp = "{0:x}".format(pub_exp)
    pub_exp = "0{}".format(pub_exp) if len(pub_exp) % 2 else pub_exp
    pub_exp = binascii.unhexlify(pub_exp)
    pub_exp64 = _b64(pub_exp)
    sys.stderr.write("Found domain '{}'\n".format(domain))

    #Step 2: Get challenges from the CA
    sys.stderr.write("Requesting challenges...")
    data = json.dumps({
        "type": "challengeRequest",
        "identifier": domain,
    })
    resp = urllib2.urlopen(CA, data)
    result = resp.read()
    resp_json = json.loads(result)
    sessionID = resp_json['sessionID']
    nonce64 = resp_json['nonce']
    nonce = _a64(nonce64)
    challenges = resp_json['challenges']
    sys.stderr.write("Challenges received!\n")

    #Step 3: Get the dvsni challenge
    sys.stderr.write("Parsing dvsni challenge...\n")
    challenge = [c for c in challenges if c['type'] == "dvsni"][0]
    dvsni_nonce = binascii.unhexlify(challenge['nonce'])
    dvsni_r = _a64(challenge['r'])

    #Step 4: Calculate the sni code
    client_code = os.urandom(32)
    sni_code = hashlib.sha256(dvsni_r + client_code).hexdigest()
    sni = sni_code + ".acme.invalid"

    #Step 5: Generate the OpenSSL configuration for the SNI challenge
    sys.stderr.write("Generating test configuation...\n")
    proc = subprocess.Popen(["openssl", "version", "-d"],
        stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    out, err = proc.communicate()
    openssl_dir = re.search("OPENSSLDIR: \"([^\"]+)\"", out).group(1)
    openssl_cnf = open(os.path.join(openssl_dir, "openssl.cnf")).read()
    test_conf = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".cnf")
    test_conf.write(openssl_cnf)
    test_conf.write("\n\n[ alt_names ]\nsubjectAltName = DNS:" + sni + "\n")
    test_conf.flush()

    #Step 5: Generate a self-signed ssl cert with the sni altname
    sys.stderr.write("Generating test key for dvsni challenge...\n")
    test_crt = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".crt")
    test_crt_name = os.path.basename(test_crt.name)
    test_pem = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".pem")
    test_pem_name = os.path.basename(test_pem.name)
    proc = subprocess.Popen(
        ["openssl", "req", "-new", "-newkey", "rsa:4096",
        "-days", "365", "-nodes", "-x509", "-sha256",
        "-subj", "/C=AA/ST=A/L=A/O=A/CN={}".format(domain),
        "-config", test_conf.name, "-extensions", "alt_names",
        "-keyout", test_pem.name, "-out", test_crt.name],
        stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    proc.wait()
    sys.stderr.write("Test key generated!\n")

    #Step 6: Get ready to sign the challenge response
    msgsig_nonce = os.urandom(16)
    msgsig_nonce64 = _b64(msgsig_nonce)
    msg = msgsig_nonce + domain + nonce
    msg_file = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".msg")
    msg_file_name = os.path.basename(msg_file.name)
    msg_file.write(msg)
    msg_file.flush()
    msgsig_file = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".msgsig")
    msgsig_file_name = os.path.basename(msgsig_file.name)

    #Step 7: Get ready to sign the certificate request response
    dersig_nonce = os.urandom(16)
    dersig_nonce64 = _b64(dersig_nonce)
    proc = subprocess.Popen(["openssl", "req", "-in", csr, "-outform", "DER"],
        stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    der_raw, err = proc.communicate()
    der = dersig_nonce + der_raw
    der_file = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".der")
    der_file_name = os.path.basename(der_file.name)
    der_file.write(der)
    der_file.flush()
    dersig_file = tempfile.NamedTemporaryFile(dir=".", prefix="test_", suffix=".dersig")
    dersig_file_name = os.path.basename(dersig_file.name)

    #Step 8: Get the user to sign the request and start the https server
    sys.stderr.write("""
====================================================
================USER ACTION REQUIRED================
====================================================

Since we don't ask for your private key or sudo access, you will need
to do some manual commands in order to get a signed certificate. Here's
what you need to do:

1. Sign some files requested by the certificate authority.
2. Copy a test key and certificate to your server.
3. Run an https server with the test key and certificate.

We've listed the commands you need to do this below. You should be able
to copy and paste them into a new terminal window.

(NOTE: Replace 'priv.key' below with your private key, if different)
(NOTE: Replace 'ubuntu' below with your sudo user, if different)

COMMANDS:
--------------------------
#Step 1: Sign the needed files
openssl dgst -sha256 -sign priv.key -out {} {}
openssl dgst -sha256 -sign priv.key -out {} {}

#Step 2: Copy the test key and certificate to your server
scp {} ubuntu@{}:{}
scp {} ubuntu@{}:{}

#Step 3: Run an https server with the test key and certificate
ssh -t ubuntu@{} "sudo python -c \\"import BaseHTTPServer, ssl; \\
  httpd = BaseHTTPServer.HTTPServer(('0.0.0.0', 443), BaseHTTPServer.BaseHTTPRequestHandler); \\
  httpd.socket = ssl.wrap_socket(httpd.socket, keyfile='{}', certfile='{}'); \\
  httpd.serve_forever()\\""
--------------------------

====================================================
====================================================
====================================================

""".format(
    msgsig_file_name, msg_file_name,
    dersig_file_name, der_file_name,
    test_pem_name, domain, test_pem_name,
    test_crt_name, domain, test_crt_name,
    domain, test_pem_name, test_crt_name))

    stdout = sys.stdout
    sys.stdout = sys.stderr
    raw_input("Press Enter when you've run the above commands in a new terminal window...")
    sys.stdout = stdout

    #Step 9: Let the CA know you are ready for the challenge
    msgsig_file.seek(0)
    msgsig_in = msgsig_file.read()
    f = open("test.sig", "wb")
    f.write(msgsig_in)
    f.close()
    msgsig64 = _b64(msgsig_in)
    sys.stderr.write("Sending challenge response...\n")
    data = json.dumps({
        "type": "authorizationRequest",
        "sessionID": sessionID,
        "nonce": nonce64,
        "signature": {
            "nonce": msgsig_nonce64,
            "alg": "RS256",
            "jwk": {
                "kty": "RSA",
                "e": pub_exp64,
                "n": pub_mod64
            },
            "sig": msgsig64
        },
        "responses": [
            {
                "type": "dvsni",
                "s": _b64(client_code)
            }
        ]
    })
    resp = urllib2.urlopen(CA, data)
    result = json.loads(resp.read())

    #Step 10: Wait for the response giving authorization
    is_done = False
    while not is_done:
        if result['type'] == "defer":
            sys.stderr.write("Deferred...\n")
            time.sleep(result.get("interval", 3))
            data = json.dumps({
                "type": "statusRequest",
                "token": result['token']
            })
            resp = urllib2.urlopen(CA, data)
            result = json.loads(resp.read())
        else:
            sys.stderr.write("Sending certificate request...\n")
            is_done = True

    #Step 11: Request the signed certificate
    proc = subprocess.Popen(["openssl", "req", "-in", csr, "-outform", "DER"],
        stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    csr_der, err = proc.communicate()
    csr_der64 = _b64(csr_der)
    dersig_file.seek(0)
    dersig = dersig_file.read()
    dersig64 = _b64(dersig)
    data = json.dumps({
        "type": "certificateRequest",
        "csr": csr_der64,
        "signature": {
            "alg": "RS256",
            "nonce": dersig_nonce64,
            "sig": dersig64,
            "jwk": {
                "kty": "RSA",
                "e": pub_exp64,
                "n": pub_mod64
            }
        }
    })
    resp = urllib2.urlopen(CA, data)
    result = json.loads(resp.read())
    sys.stderr.write("Exporting signed certificate...\n")

    #Step 12: Parse and output the signed certificate!
    crt_start = "-----BEGIN CERTIFICATE-----\n"
    crt_end = "\n-----END CERTIFICATE-----\n"
    crt64 = result['certificate']
    crt_pem = base64.b64encode(_a64(crt64))
    crt_pem = "\n".join(crt_pem[i:i+64] for i in xrange(0, len(crt_pem), 64))
    crt_pem = crt_start + crt_pem + crt_end
    for chain64 in result.get("chains", []):
        chain_pem = base64.b64encode(_a64(chain64))
        chain_pem = "\n".join(chain_pem[i:i+64] for i in xrange(0, len(chain_pem), 64))
        chain_pem = crt_start + chain_pem + crt_end
        crt_pem += chain_pem
    sys.stderr.write("Done! Your certificate is signed by the certificate authority!\n")
    return crt_pem


if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        formatter_class=argparse.RawDescriptionHelpFormatter,
        description="""\
Get a SSL certificate signed by a Let's Encrypt (ACME) certificate authority and
output that signed certificate. You do NOT need to run this script on your
server and this script does not ask for your private key. It will print out
commands that you need to run with your private key or on your server as root,
which gives you a chance to review the commands instead of trusting this script.

Prerequisites:
* openssl
* python

Example: Generate a key, create a csr, and have it signed.
--------------
$ openssl genrsa -out priv.key 4096
$ openssl req -new -sha256 -key priv.key -out cert.csr
$ python sign_csr.py cert.csr > signed.crt
--------------

""")
    parser.add_argument("csr_path", help="path to certificate signing request")

    args = parser.parse_args()
    signed_crt = sign_csr(args.csr_path)
    sys.stdout.write(signed_crt)