I have learned quite a bit about ACME, but still need some help. I have successfully implemented an ACME account registration, and requesting a certificate with EAB and "no-challenge" all using Ansible.
Now, b/c I have a whole slew of Python scripts and tools that are also used in certificate renewal automation, I need to figure out how to try to do this in Python. If it is done in Ansible.. and Ansible is mostly Python... ..and I have scanned this GitHub - ansible-collections/community.crypto: The community.crypto collection for Ansible..
So, I was able to find the section where this is happening, and can follow along, but unfortunately .. there is SO MUCH code supporting Ansible and inclusion of other files, it is really hard to follow and on top of that.. trying to figure out exactly what python modules I need to have in my script.
So looking for some help. Have no reason to re-invent the wheel, but I also do not want a bunch of code around that I would never use. My goals in my Python script are:
- Register a private key with EAB and my CA (Sectigo/InCommon) using the "no challenge" challenge.
- Use that registration to submit a CSR for a certificate.
- Fetch the certificate.
- Put the newly generated certificate and private-key in the appropriate location or save locally to the same path as the script.
The documentation for the acme module (Python)[Welcome to acme-python’s documentation! — acme-python 0 documentation] is truly technical, with very few if any examples of using the calls, so I am lost there.
I have reviewed code for numerous other clients on this page: ACME Client Implementations - Let's Encrypt and a bit further down: ACME Client Implementations - Let's Encrypt
In Ansible .. it is written as:
- name: "Register private key with Sectigo EAB credentials, get acct URI."
community.crypto.acme_account:
account_key_content: "{{ acct_privatekey }}"
acme_directory: "{{ acme_url }}"
state: present
terms_agreed: true
acme_version: "{{ acme_version }}"
contact:
- "mailto:{{ cert_group_email }}"
external_account_binding:
alg: HS256
key: "{{ acme_hmac_key }}"
kid: "{{ acme_account_id }}"
register: acct_key_registration
- name: "Perform a 'no challenge' request w/ account private key"
community.crypto.acme_certificate:
account_key_content: "{{ acct_privatekey }}"
csr_content: "{{ cert_csr }}"
account_email: "{{ acme_account_email }}"
acme_version: "{{ acme_version }}"
account_uri: "{{ acct_key_registration.account_uri }}"
acme_directory: "{{ acme_url }}"
remaining_days: "{{ cert_term_length }}"
dest: "/var/tmp/{{ cert_filename }}"
terms_agreed: true
validate_certs: true
challenge: no challenge
register: acme_no_challenge
no_log: false
- name: Resubmit the request with the challenge result
community.crypto.acme_certificate:
account_key_content: "{{ acct_privatekey }}"
csr_content: "{{ cert_csr }}"
account_email: "{{ acme_account_email }}"
acme_version: "{{ acme_version }}"
challenge: no challenge
data: "{{ acme_no_challenge }}"
account_uri: "{{ acct_key_registration.account_uri }}"
acme_directory: "{{ acme_url }}"
remaining_days: "{{ cert_term_length }}"
dest: "/var/tmp/{{ cert_filename }}"
chain_dest: "/var/tmp/{{ chain_filename }}"
fullchain_dest: "/var/tmp/{{ full_chain_filename }}"
when: acme_no_challenge is changed
no_log: false
This works!
So, I already have all the supporting code for gathering certificate info (CN, SANs, org, state, country, etc..), generating a private key (for the account) and a private key for the certificate, generate a signed CSR, and supporting parameter CLI, and other stuff.. now I just need to get the above steps in Python.
So can anyone help me figure where I can find good example code .. for starters registering a private key using EAB and my CA. If not the "acme" module, what other would you recommend? If acme module, what imports do I need?
Thank you!