Challenges¶
ACME Identifier Validation Challenges.
- class acme.challenges.UnrecognizedChallenge(jobj: Mapping[str, Any])[source]¶
Unrecognized challenge.
ACME specification defines a generic framework for challenges and defines some standard challenges that are implemented in this module. However, other implementations (including peers) might define additional challenge types, which should be ignored if unrecognized.
- Variables
jobj – Original JSON decoded object.
- class acme.challenges.KeyAuthorizationChallengeResponse(**kwargs: Any)[source]¶
Response to Challenges based on Key Authorization.
- Parameters
key_authorization (unicode) –
- verify(chall: acme.challenges.KeyAuthorizationChallenge, account_public_key: josepy.jwk.JWK) bool [source]¶
Verify the key authorization.
- Parameters
chall (KeyAuthorization) – Challenge that corresponds to this response.
account_public_key (JWK) –
- Returns
True
iff verification of the key authorization was successful.- Return type
bool
- class acme.challenges.KeyAuthorizationChallenge(**kwargs: Any)[source]¶
Challenge based on Key Authorization.
- Parameters
response_cls – Subclass of
KeyAuthorizationChallengeResponse
that will be used to generateresponse
.typ (str) – type of the challenge
- key_authorization(account_key: josepy.jwk.JWK) str [source]¶
Generate Key Authorization.
- Parameters
account_key (JWK) –
- Rtype unicode
- response(account_key: josepy.jwk.JWK) acme.challenges.KeyAuthorizationChallengeResponse [source]¶
Generate response to the challenge.
- Parameters
account_key (JWK) –
- Returns
Response (initialized
response_cls
) to the challenge.- Return type
- abstract validation(account_key: josepy.jwk.JWK, **kwargs: Any) Any [source]¶
Generate validation for the challenge.
Subclasses must implement this method, but they are likely to return completely different data structures, depending on what’s necessary to complete the challenge. Interpretation of that return value must be known to the caller.
- Parameters
account_key (JWK) –
- Returns
Challenge-specific validation.
- response_and_validation(account_key: josepy.jwk.JWK, *args: Any, **kwargs: Any) Tuple[acme.challenges.KeyAuthorizationChallengeResponse, Any] [source]¶
Generate response and validation.
Convenience function that return results of
response
andvalidation
.- Parameters
account_key (JWK) –
- Return type
tuple
- class acme.challenges.DNS01Response(**kwargs: Any)[source]¶
ACME dns-01 challenge response.
- simple_verify(chall: acme.challenges.DNS01, domain: str, account_public_key: josepy.jwk.JWK) bool [source]¶
Simple verify.
This method no longer checks DNS records and is a simple wrapper around
KeyAuthorizationChallengeResponse.verify
.- Parameters
chall (challenges.DNS01) – Corresponding challenge.
domain (unicode) – Domain name being verified.
account_public_key (JWK) – Public key for the key pair being authorized.
- Returns
True
iff verification of the key authorization was successful.- Return type
bool
- class acme.challenges.DNS01(**kwargs: Any)[source]¶
ACME dns-01 challenge.
- response_cls¶
alias of
acme.challenges.DNS01Response
- LABEL = '_acme-challenge'¶
Label clients prepend to the domain name being validated.
- class acme.challenges.HTTP01Response(**kwargs: Any)[source]¶
ACME http-01 challenge response.
- PORT = 80¶
Verification port as defined by the protocol.
You can override it (e.g. for testing) by passing
port
tosimple_verify
.
- WHITESPACE_CUTSET = '\n\r\t '¶
Whitespace characters which should be ignored at the end of the body.
- simple_verify(chall: acme.challenges.HTTP01, domain: str, account_public_key: josepy.jwk.JWK, port: Optional[int] = None) bool [source]¶
Simple verify.
- Parameters
chall (challenges.SimpleHTTP) – Corresponding challenge.
domain (unicode) – Domain name being verified.
account_public_key (JWK) – Public key for the key pair being authorized.
port (int) – Port used in the validation.
- Returns
True
iff validation with the files currently served by the HTTP server is successful.- Return type
bool
- class acme.challenges.HTTP01(**kwargs: Any)[source]¶
ACME http-01 challenge.
- response_cls¶
alias of
acme.challenges.HTTP01Response
- URI_ROOT_PATH = '.well-known/acme-challenge'¶
URI root path for the server provisioned resource.
- property path: str¶
Path (starting with ‘/’) for provisioned resource.
- Return type
string
- class acme.challenges.TLSALPN01Response(**kwargs: Any)[source]¶
ACME tls-alpn-01 challenge response.
- PORT = 443¶
Verification port as defined by the protocol.
You can override it (e.g. for testing) by passing
port
tosimple_verify
.
- property h: bytes¶
Hash value stored in challenge certificate
- gen_cert(domain: str, key: Optional[OpenSSL.crypto.PKey] = None, bits: int = 2048) Tuple[OpenSSL.crypto.X509, OpenSSL.crypto.PKey] [source]¶
Generate tls-alpn-01 certificate.
- Parameters
domain (unicode) – Domain verified by the challenge.
key (OpenSSL.crypto.PKey) – Optional private key used in certificate generation. If not provided (
None
), then fresh key will be generated.bits (int) – Number of bits for newly generated key.
- Return type
tuple
ofOpenSSL.crypto.X509
andOpenSSL.crypto.PKey
- probe_cert(domain: str, host: Optional[str] = None, port: Optional[int] = None) OpenSSL.crypto.X509 [source]¶
Probe tls-alpn-01 challenge certificate.
- Parameters
domain (unicode) – domain being validated, required.
host (string) – IP address used to probe the certificate.
port (int) – Port used to probe the certificate.
- verify_cert(domain: str, cert: OpenSSL.crypto.X509) bool [source]¶
Verify tls-alpn-01 challenge certificate.
- Parameters
domain (unicode) – Domain name being validated.
cert (OpensSSL.crypto.X509) – Challenge certificate.
- Returns
Whether the certificate was successfully verified.
- Return type
bool
- simple_verify(chall: acme.challenges.TLSALPN01, domain: str, account_public_key: josepy.jwk.JWK, cert: Optional[OpenSSL.crypto.X509] = None, host: Optional[str] = None, port: Optional[int] = None) bool [source]¶
Simple verify.
Verify
validation
usingaccount_public_key
, optionally probe tls-alpn-01 certificate and check usingverify_cert
.- Parameters
chall (challenges.TLSALPN01) – Corresponding challenge.
domain (str) – Domain name being validated.
account_public_key (JWK) –
cert (OpenSSL.crypto.X509) – Optional certificate. If not provided (
None
) certificate will be retrieved usingprobe_cert
.host (string) – IP address used to probe the certificate.
port (int) – Port used to probe the certificate.
- Returns
True
if and only if client’s control of the domain has been verified.- Return type
bool
- class acme.challenges.TLSALPN01(**kwargs: Any)[source]¶
ACME tls-alpn-01 challenge.
- response_cls¶
alias of
acme.challenges.TLSALPN01Response
- validation(account_key: josepy.jwk.JWK, **kwargs: Any) Tuple[OpenSSL.crypto.X509, OpenSSL.crypto.PKey] [source]¶
Generate validation.
- Parameters
account_key (JWK) –
domain (unicode) – Domain verified by the challenge.
cert_key (OpenSSL.crypto.PKey) – Optional private key used in certificate generation. If not provided (
None
), then fresh key will be generated.
- Return type
tuple
ofOpenSSL.crypto.X509
andOpenSSL.crypto.PKey
- static is_supported() bool [source]¶
Check if TLS-ALPN-01 challenge is supported on this machine. This implies that a recent version of OpenSSL is installed (>= 1.0.2), or a recent cryptography version shipped with the OpenSSL library is installed.
- Returns
True
if TLS-ALPN-01 is supported on this machine,False
otherwise.- Return type
bool
- class acme.challenges.DNS(**kwargs: Any)[source]¶
ACME “dns” challenge.
- LABEL = '_acme-challenge'¶
Label clients prepend to the domain name being validated.
- gen_validation(account_key: josepy.jwk.JWK, alg: josepy.jwa.JWASignature = RS256, **kwargs: Any) josepy.jws.JWS [source]¶
Generate validation.
- Parameters
account_key (JWK) – Private account key.
alg (JWA) –
- Returns
This challenge wrapped in
JWS
- Return type
JWS
- check_validation(validation: josepy.jws.JWS, account_public_key: josepy.jwk.JWK) bool [source]¶
Check validation.
- Parameters
validation (JWS) –
account_public_key (JWK) –
- Return type
bool
- gen_response(account_key: josepy.jwk.JWK, **kwargs: Any) acme.challenges.DNSResponse [source]¶
Generate response.
- Parameters
account_key (JWK) – Private account key.
alg (JWA) –
- Return type
- class acme.challenges.DNSResponse(**kwargs: Any)[source]¶
ACME “dns” challenge response.
- Parameters
validation (JWS) –
- check_validation(chall: acme.challenges.DNS, account_public_key: josepy.jwk.JWK) bool [source]¶
Check validation.
- Parameters
chall (challenges.DNS) –
account_public_key (JWK) –
- Return type
bool