Challenges¶
ACME Identifier Validation Challenges.
-
class
acme.challenges.Challenge(**kwargs)[source]¶ Bases:
josepy.json_util.TypedJSONObjectWithFieldsACME challenge.
-
class
acme.challenges.ChallengeResponse(**kwargs)[source]¶ Bases:
josepy.json_util.TypedJSONObjectWithFieldsACME challenge response.
-
class
acme.challenges.UnrecognizedChallenge(jobj)[source]¶ Bases:
acme.challenges.ChallengeUnrecognized challenge.
ACME specification defines a generic framework for challenges and defines some standard challenges that are implemented in this module. However, other implementations (including peers) might define additional challenge types, which should be ignored if unrecognized.
Variables: jobj – Original JSON decoded object.
-
class
acme.challenges._TokenChallenge(**kwargs)[source]¶ Bases:
acme.challenges.ChallengeChallenge with token.
Variables: token (bytes) – -
TOKEN_SIZE= 16.0¶ Minimum size of the
tokenin bytes.
-
good_token¶ Is
tokengood?Todo
acme-spec wants “It MUST NOT contain any non-ASCII characters”, but it should also warrant that it doesn’t contain “..” or “/”…
-
-
class
acme.challenges.KeyAuthorizationChallengeResponse(*args, **kwargs)[source]¶ Bases:
acme.challenges.ChallengeResponseResponse to Challenges based on Key Authorization.
Parameters: key_authorization (unicode) – -
verify(chall, account_public_key)[source]¶ Verify the key authorization.
Parameters: - chall (KeyAuthorization) – Challenge that corresponds to this response.
- account_public_key (JWK) –
Returns: Trueiff verification of the key authorization was successful.Return type: bool
Set if keyAuthorization is dumped in the JSON representation of this ChallengeResponse. NB: This method is declared as private because it will eventually be removed. :param bool dump: True to dump the keyAuthorization, False otherwise
-
-
class
acme.challenges.KeyAuthorizationChallenge(**kwargs)[source]¶ Bases:
acme.challenges._TokenChallengeChallenge based on Key Authorization.
Parameters: - response_cls – Subclass of
KeyAuthorizationChallengeResponsethat will be used to generateresponse. - typ (str) – type of the challenge
Generate Key Authorization.
Parameters: account_key (JWK) – Rtype unicode:
-
response(account_key)[source]¶ Generate response to the challenge.
Parameters: account_key (JWK) – Returns: Response (initialized response_cls) to the challenge.Return type: KeyAuthorizationChallengeResponse
-
validation(account_key, **kwargs)[source]¶ Generate validation for the challenge.
Subclasses must implement this method, but they are likely to return completely different data structures, depending on what’s necessary to complete the challenge. Interpretation of that return value must be known to the caller.
Parameters: account_key (JWK) – Returns: Challenge-specific validation.
-
response_and_validation(account_key, *args, **kwargs)[source]¶ Generate response and validation.
Convenience function that return results of
responseandvalidation.Parameters: account_key (JWK) – Return type: tuple
- response_cls – Subclass of
-
class
acme.challenges.DNS01Response(*args, **kwargs)[source]¶ Bases:
acme.challenges.KeyAuthorizationChallengeResponseACME dns-01 challenge response.
-
simple_verify(chall, domain, account_public_key)[source]¶ Simple verify.
This method no longer checks DNS records and is a simple wrapper around
KeyAuthorizationChallengeResponse.verify.Parameters: - chall (challenges.DNS01) – Corresponding challenge.
- domain (unicode) – Domain name being verified.
- account_public_key (JWK) – Public key for the key pair being authorized.
Returns: Trueiff verification of the key authorization was successful.Return type: bool
-
-
class
acme.challenges.DNS01(**kwargs)[source]¶ Bases:
acme.challenges.KeyAuthorizationChallengeACME dns-01 challenge.
-
response_cls¶ alias of
DNS01Response
-
LABEL= '_acme-challenge'¶ Label clients prepend to the domain name being validated.
-
-
class
acme.challenges.HTTP01Response(*args, **kwargs)[source]¶ Bases:
acme.challenges.KeyAuthorizationChallengeResponseACME http-01 challenge response.
-
PORT= 80¶ Verification port as defined by the protocol.
You can override it (e.g. for testing) by passing
porttosimple_verify.
-
WHITESPACE_CUTSET= '\n\r\t '¶ Whitespace characters which should be ignored at the end of the body.
-
simple_verify(chall, domain, account_public_key, port=None)[source]¶ Simple verify.
Parameters: - chall (challenges.SimpleHTTP) – Corresponding challenge.
- domain (unicode) – Domain name being verified.
- account_public_key (JWK) – Public key for the key pair being authorized.
- port (int) – Port used in the validation.
Returns: Trueiff validation with the files currently served by the HTTP server is successful.Return type: bool
-
-
class
acme.challenges.HTTP01(**kwargs)[source]¶ Bases:
acme.challenges.KeyAuthorizationChallengeACME http-01 challenge.
-
response_cls¶ alias of
HTTP01Response
-
URI_ROOT_PATH= '.well-known/acme-challenge'¶ URI root path for the server provisioned resource.
-
path¶ Path (starting with ‘/’) for provisioned resource.
Return type: string
-
-
class
acme.challenges.TLSSNI01Response(*args, **kwargs)[source]¶ Bases:
acme.challenges.KeyAuthorizationChallengeResponseACME tls-sni-01 challenge response.
-
DOMAIN_SUFFIX= b'.acme.invalid'¶ Domain name suffix.
-
PORT= 443¶ Verification port as defined by the protocol.
You can override it (e.g. for testing) by passing
porttosimple_verify.
-
z¶ zvalue used for verification.Rtype bytes:
-
gen_cert(key=None, bits=2048)[source]¶ Generate tls-sni-01 certificate.
Parameters: - key (OpenSSL.crypto.PKey) – Optional private key used in
certificate generation. If not provided (
None), then fresh key will be generated. - bits (int) – Number of bits for newly generated key.
Return type: tupleofOpenSSL.crypto.X509andOpenSSL.crypto.PKey- key (OpenSSL.crypto.PKey) – Optional private key used in
certificate generation. If not provided (
-
probe_cert(domain, **kwargs)[source]¶ Probe tls-sni-01 challenge certificate.
Parameters: domain (unicode) –
-
verify_cert(cert)[source]¶ Verify tls-sni-01 challenge certificate.
Parameters: cert (OpensSSL.crypto.X509) – Challenge certificate. Returns: Whether the certificate was successfully verified. Return type: bool
-
simple_verify(chall, domain, account_public_key, cert=None, **kwargs)[source]¶ Simple verify.
Verify
validationusingaccount_public_key, optionally probe tls-sni-01 certificate and check usingverify_cert.Parameters: - chall (challenges.TLSSNI01) – Corresponding challenge.
- domain (str) – Domain name being validated.
- account_public_key (JWK) –
- cert (OpenSSL.crypto.X509) – Optional certificate. If not
provided (
None) certificate will be retrieved usingprobe_cert. - port (int) – Port used to probe the certificate.
Returns: Trueiff client’s control of the domain has been verified.Return type: bool
-
-
class
acme.challenges.TLSSNI01(*args, **kwargs)[source]¶ Bases:
acme.challenges.KeyAuthorizationChallengeACME tls-sni-01 challenge.
-
response_cls¶ alias of
TLSSNI01Response
-
validation(account_key, **kwargs)[source]¶ Generate validation.
Parameters: - account_key (JWK) –
- cert_key (OpenSSL.crypto.PKey) – Optional private key used
in certificate generation. If not provided (
None), then fresh key will be generated.
Return type: tupleofOpenSSL.crypto.X509andOpenSSL.crypto.PKey
-
-
class
acme.challenges.TLSALPN01Response(*args, **kwargs)[source]¶ Bases:
acme.challenges.KeyAuthorizationChallengeResponseACME TLS-ALPN-01 challenge response.
This class only allows initiating a TLS-ALPN-01 challenge returned from the CA. Full support for responding to TLS-ALPN-01 challenges by generating and serving the expected response certificate is not currently provided.
-
class
acme.challenges.TLSALPN01(**kwargs)[source]¶ Bases:
acme.challenges.KeyAuthorizationChallengeACME tls-alpn-01 challenge.
This class simply allows parsing the TLS-ALPN-01 challenge returned from the CA. Full TLS-ALPN-01 support is not currently provided.
-
response_cls¶ alias of
TLSALPN01Response
-
-
class
acme.challenges.DNS(**kwargs)[source]¶ Bases:
acme.challenges._TokenChallengeACME “dns” challenge.
-
LABEL= '_acme-challenge'¶ Label clients prepend to the domain name being validated.
-
gen_validation(account_key, alg=RS256, **kwargs)[source]¶ Generate validation.
Parameters: - account_key (JWK) – Private account key.
- alg (JWA) –
Returns: This challenge wrapped in
JWSReturn type: JWS
-
check_validation(validation, account_public_key)[source]¶ Check validation.
Parameters: - validation (JWS) –
- account_public_key (JWK) –
Return type: bool
-
-
class
acme.challenges.DNSResponse(**kwargs)[source]¶ Bases:
acme.challenges.ChallengeResponseACME “dns” challenge response.
Parameters: validation (JWS) – -
check_validation(chall, account_public_key)[source]¶ Check validation.
Parameters: - chall (challenges.DNS) –
- account_public_key (JWK) –
Return type: bool
-