theca-sdk-python

Run your own private CA at devnull.cn: the service signs a per-account root CA and SAN certificates, and this package writes the PEM files to ~/.devnull/certs/.

Requires theid>=2 (theid 2.0 credentials; the service only accepts EdDSA access tokens).

Usage

# Credentials come from ~/.devnull/credentials (shared with devnull-cli) or env
export THEID_ACCESS_KEY=DK...
export THEID_SECRET_KEY=...

python3 - <<'EOF'
from theca import create_cert
print(create_cert())
EOF

ls -lt ~/.devnull/certs/
# key.pem  crt.pem  fullchain.pem  ca.pem  system_id  subject_alternative_names  properties

create_cert() creates the account's root CA on first use, then issues a certificate for the host's system_id plus its private/public thedns names, and writes the chain next to it. The returned ca_url (https://devnull.cn/getca/<orgid>) downloads the CA certificate.

Point at another environment with DEVNULL_THECA_URL (default https://devnull.cn/theca). The identity service is resolved by theid (DEVNULL_BASE_URL / THEID_ISSUER).

What the service stores

Per account: one RSA-4096 root CA (10 years) and up to 11 RSA-2048 certificates (1 year, SANs from the requested names). All material is stored in Postgres as base64 PEM; create_cert() is idempotent per common name.