Swarmauri Remote CA Cert Service

A certificate enrollment bridge implementing the ICertService interface and forwarding CSRs to a remote Certificate Authority.

Features

• Posts CSRs to a remote endpoint and returns issued certificates.
• Minimal parsing helpers for certificate snippets.
• Designed around X.509 as defined in RFC 5280 and Enrollment over Secure Transport (EST) in RFC 7030.

Installation

Install the package with your preferred Python packaging tool:

pip install swarmauri_certs_remote_ca

poetry add swarmauri_certs_remote_ca

uv pip install swarmauri_certs_remote_ca

Configuration

RemoteCaCertService accepts the following arguments:

• endpoint ? Base URL of the remote CA sign endpoint.
• auth ? Optional mapping of HTTP headers or an httpx.Auth instance for authentication.
• timeout_s ? HTTP timeout in seconds (default 10).
• ca_chain ? Optional sequence of cached trust anchors exposed during verification and parsing.

Entry Point

The service registers under the swarmauri.certs entry point as RemoteCaCertService.

Usage

The service is asynchronous and expects an existing CSR (certificate signing request) in PEM or DER form. Configure the remote CA endpoint and submit the CSR to receive the issued certificate:

import asyncio
import base64
import json

import httpx

from swarmauri_certs_remote_ca import RemoteCaCertService

csr = b"example-csr"
cert_bytes = b"example-cert"


async def main() -> None:
    async def handler(request: httpx.Request) -> httpx.Response:
        data = json.loads(request.content)
        assert base64.b64decode(data["csr"]) == csr
        return httpx.Response(
            200,
            json={"cert": base64.b64encode(cert_bytes).decode("ascii")},
        )

    svc = RemoteCaCertService("https://ca.example/sign")

    async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as client:
        svc._client = client  # Inject mock transport for the example.
        certificate = await svc.sign_cert(csr, {"kind": "dummy"})
        print(certificate)


asyncio.run(main())

The example above mocks a CA using httpx.MockTransport. In real scenarios RemoteCaCertService posts the CSR to the configured endpoint and returns the certificate bytes supplied by the remote CA.

When used against a real service, provide any required authentication headers through the auth argument and override request or response formats via the opts parameter of sign_cert.

Want to help?

If you want to contribute to swarmauri-sdk, read up on our guidelines for contributing that will help you get started.