pico-acme 0.0.3

Pico ACME: tiny ACMEv2 client

pico acme

The tiniest python package to get ACMEv2 certs from Let's Encrypt.

Supports only single domains and DNS challenge. Currently implements AWS Route 53 but you can trivially implement your own provider.

Licensed under Apache 2.0 as this reuses some code from certbot.

quick start

Note that you need to install boto3 separately to use route53.

Create the following files in a folder:

new.py:

ROUTE53_HOSTED_ZONE_ID = "..."
ACCOUNT_EMAIL = "[e-mail]"
DOMAIN = "example.com"

# create account, get cert, and save details
import pico_acme
from pico_acme import route53

# register an acme account
acme_client = pico_acme.register_account(ACCOUNT_EMAIL, agree_tos=True)

# create a private key and certificate signing request
key_pem = pico_acme.make_key()
csr_pem = pico_acme.make_csr(key_pem, [DOMAIN])

# get functions for upserting and cleaning up DNS records in AWS Route 53
upsert, clean = route53.route53_upsert_cleanup(ROUTE53_HOSTED_ZONE_ID)

# perform DNS-01 challenge to get the full chain as PEM
fullchain_pem = pico_acme.perform_dns01(acme_client, DOMAIN, csr_pem, upsert, clean)

# save account for later
with open("pico_acme_account.json", "w") as f:
    f.write(pico_acme.serialize_account(acme_client))

# save private key for later
with open("key.pem", "wb") as f:
    f.write(key_pem)

# save the cert for later
with open("fullchain.pem", "w") as f:
    f.write(fullchain_pem)

renew.py:

ROUTE53_HOSTED_ZONE_ID = "..."
DOMAIN = "example.com"

# later, load account, private key, and renew cert
import pico_acme
from pico_acme import route53

# load account
with open("pico_acme_account.json") as f:
    acme_client = pico_acme.deserialize_account(f.read())

# load private key
with open("key.pem", "rb") as f:
    key_pem = f.read()

# make a new certificate signing request
csr_pem = pico_acme.make_csr(key_pem, [DOMAIN])

# get functions for upserting and cleaning up DNS records in AWS Route 53
upsert, clean = route53.route53_upsert_cleanup(ROUTE53_HOSTED_ZONE_ID)

# perform DNS-01 challenge to get the full chain as PEM
fullchain_pem = pico_acme.perform_dns01(acme_client, DOMAIN, csr_pem, upsert, clean)

# save the cert for later
with open("fullchain.pem", "w") as f:
    f.write(fullchain_pem)

architecture & features

The perform_dns01 takes two callables, upsert(record, value) which should set the value value (the verification string) in record record (e.g. _acme-challenge.example.com), and clean(record, value) which should clean these up. See the route53.py implementation for details.