1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
# Certipy
A simple python tool for creating certificate authorities and certificates on
the fly.
## Introduction
Certipy was made to simplify the certificate creation process. To that end,
Certipy exposes methods for creating and managing certificate authorities,
certificates, signing and building trust bundles. Behind the scenes Certipy:
* Manages records of all certificates it creates
* External certs can be imported and managed by Certipy
* Maintains signing hierarchy
* Persists certificates to files with appropriate permissions
## Usage
### Command line
Creating a certificate authority:
Certipy defaults to writing certs and certipy.json into a folder called `out`
in your current directory.
```
$ certipy foo
FILES {'ca': '', 'cert': 'out/foo/foo.crt', 'key': 'out/foo/foo.key'}
IS_CA True
SERIAL 0
SIGNEES None
PARENT_CA
```
Creating and signing a key-cert pair:
```
$ certipy bar --ca-name foo
FILES {'ca': 'out/foo/foo.crt', 'key': 'out/bar/bar.key', 'cert': 'out/bar/bar.crt'}
IS_CA False
SERIAL 0
SIGNEES None
PARENT_CA foo
```
Removal:
```
certipy --rm bar
Deleted:
FILES {'ca': 'out/foo/foo.crt', 'key': 'out/bar/bar.key', 'cert': 'out/bar/bar.crt'}
IS_CA False
SERIAL 0
SIGNEES None
PARENT_CA foo
```
### Code
Creating a certificate authority:
```
from certipy import Certipy
certipy = Certipy(store_dir='/tmp')
certipy.create_ca('foo')
record = certipy.store.get_record('foo')
```
Creating and signing a key-cert pair:
```
certipy.create_signed_pair('bar', 'foo')
record = certipy.store.get_record('bar')
```
Creating trust:
```
certipy.create_ca_bundle('ca-bundle.crt')
# or to trust specific certs only:
certipy.create_ca_bundle_for_names('ca-bundle.crt', ['bar'])
```
Removal:
```
record = certipy.remove_files('bar')
```
Records are dicts with the following structure:
```
{
'serial': 0,
'is_ca': true,
'parent_ca': 'ca_name',
'signees': {
'signee_name': 1
},
'files': {
'key': 'path/to/key.key',
'cert': 'path/to/cert.crt',
'ca': 'path/to/ca.crt',
}
}
```
The `signees` will be empty for non-CA certificates. The `signees` field
is stored as a python `Counter`. These relationships are used to build trust
bundles.
Information in Certipy is generally passed around as records which point to
actual files. For most `_record` methods, there are generally equivalent
`_file` methods that operate on files themselves. The former will only affect
records in Certipy's store and the latter will affect both (something happens
to the file, the record for it should change, too).
### Release
Certipy is released under BSD license. For more details see the LICENSE file.
LLNL-CODE-754897
|
