theca-sdk-python

Run your own private CA at devnull.cn: every account gets its own self-signed root CA (no shared devnull root, no cross-account trust), and this package writes the PEM files to ~/.devnull/certs/.

Requires theid>=2 (theid 2.0 credentials; the service only accepts EdDSA access tokens).

Usage

# Credentials come from ~/.devnull/credentials (shared with devnull-cli) or env
export THEID_ACCESS_KEY=DK...
export THEID_SECRET_KEY=...

python3 - <<'EOF'
from theca import create_cert
print(create_cert())
EOF

ls -lt ~/.devnull/certs/
# key.pem  crt.pem  fullchain.pem  ca.pem  system_id  subject_alternative_names  properties

create_cert() creates the account's root CA on first use, then issues a certificate for the host's system_id plus its private/public thedns names, and writes the chain next to it. The returned ca_url (https://devnull.cn/getca/<account_id>) downloads the CA certificate.

Point at another environment with DEVNULL_PCA_URL (default https://devnull.cn/pca; the 3.0.1 name DEVNULL_THECA_URL is still read). The identity service is resolved by theid (DEVNULL_BASE_URL / THEID_ISSUER).

Revocation

from theca import revoke_cert, crl

revoke_cert('api.example.com')     # idempotent; it stays in the CRL
open('ca.crl.pem', 'w').write(crl())

New certificates carry a CRL distribution point (https://devnull.cn/pca/crl/<account_id>); verify with openssl verify -crl_check -CRLfile ca.crl.pem -CAfile ca.pem crt.pem.

What the service stores

Per account: one RSA-4096 root CA (10 years) and up to 11 RSA-2048 certificates (1 year, SANs from the requested names). All material is stored in Postgres as base64 PEM; create_cert() is idempotent per common name.