Skip to main content

Utility to create and sign CAs and certificates

Project description

Certipy

A simple python tool for creating certificate authorities and certificates on the fly.

Introduction

Certipy was made to simplify the certificate creation process. To that end, Certipy exposes methods for creating and managing certificate authorities, certificates, signing and building trust bundles. Behind the scenes Certipy:

  • Manages records of all certificates it creates
    • External certs can be imported and managed by Certipy
    • Maintains signing hierarchy
  • Persists certificates to files with appropriate permissions

Usage

Command line

Creating a certificate authority:

Certipy defaults to writing certs and certipy.json into a folder called out in your current directory.

$ certipy foo
FILES {'ca': '', 'cert': 'out/foo/foo.crt', 'key': 'out/foo/foo.key'}
IS_CA True
SERIAL 0
SIGNEES None
PARENT_CA

Creating and signing a key-cert pair:

$ certipy bar --ca-name foo
FILES {'ca': 'out/foo/foo.crt', 'key': 'out/bar/bar.key', 'cert': 'out/bar/bar.crt'}
IS_CA False
SERIAL 0
SIGNEES None
PARENT_CA foo

Removal:

certipy --rm bar
Deleted:
FILES {'ca': 'out/foo/foo.crt', 'key': 'out/bar/bar.key', 'cert': 'out/bar/bar.crt'}
IS_CA False
SERIAL 0
SIGNEES None
PARENT_CA foo

Code

Creating a certificate authority:

from certipy import Certipy

certipy = Certipy(store_dir='/tmp')
certipy.create_ca('foo')
record = certipy.store.get_record('foo')

Creating and signing a key-cert pair:

certipy.create_signed_pair('bar', 'foo')
record = certipy.store.get_record('bar')

Creating trust:

certipy.create_ca_bundle('ca-bundle.crt')

# or to trust specific certs only:
certipy.create_ca_bundle_for_names('ca-bundle.crt', ['bar'])

Removal:

record = certipy.remove_files('bar')

Records are dicts with the following structure:

{
  'serial': 0,
  'is_ca': true,
  'parent_ca': 'ca_name',
  'signees': {
    'signee_name': 1
  },
  'files': {
    'key': 'path/to/key.key',
    'cert': 'path/to/cert.crt',
    'ca': 'path/to/ca.crt',
  }
}

The signees will be empty for non-CA certificates. The signees field is stored as a python Counter. These relationships are used to build trust bundles.

Information in Certipy is generally passed around as records which point to actual files. For most _record methods, there are generally equivalent _file methods that operate on files themselves. The former will only affect records in Certipy's store and the latter will affect both (something happens to the file, the record for it should change, too).

Release

Certipy is released under BSD license. For more details see the LICENSE file.

LLNL-CODE-754897

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

certipy-0.2.2.tar.gz (20.6 kB view details)

Uploaded Source

Built Distribution

certipy-0.2.2-py3-none-any.whl (19.9 kB view details)

Uploaded Python 3

File details

Details for the file certipy-0.2.2.tar.gz.

File metadata

  • Download URL: certipy-0.2.2.tar.gz
  • Upload date:
  • Size: 20.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.12.9

File hashes

Hashes for certipy-0.2.2.tar.gz
Algorithm Hash digest
SHA256 fef1f3d8819ee29c4c67719171c988302823dfe0b6cfbb47d249f374809ba05e
MD5 09ab4d33f76c18cc2ce693af81b81f90
BLAKE2b-256 8d8c04b8edd906f298d4c23c0db8394784073aedced8559cd55d2de8480774af

See more details on using hashes here.

Provenance

The following attestation bundles were made for certipy-0.2.2.tar.gz:

Publisher: release.yml on LLNL/certipy

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file certipy-0.2.2-py3-none-any.whl.

File metadata

  • Download URL: certipy-0.2.2-py3-none-any.whl
  • Upload date:
  • Size: 19.9 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.12.9

File hashes

Hashes for certipy-0.2.2-py3-none-any.whl
Algorithm Hash digest
SHA256 48189761633f9b101570163c511e4080da5070a1fec2a0758313d2c46b094bfa
MD5 a6d98a88e0e252cd834d1cb21a79f4ae
BLAKE2b-256 7ed5d8074ee8f7b7dc6d3677f83a815b3500a8460885e6e5a8783d8fea4ebd15

See more details on using hashes here.

Provenance

The following attestation bundles were made for certipy-0.2.2-py3-none-any.whl:

Publisher: release.yml on LLNL/certipy

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page