acme_letsencrypt_certificate_request_with_http01_challenge.py

1import josepy as jose
2from cryptography.hazmat.primitives import serialization
3from cryptography.hazmat.primitives.asymmetric import rsa
4
5from acme import challenges
6from acme import client
7from acme import messages
8from acme import crypto_util
9
10# Configuration
11DIRECTORY_URL = 'https://acme-staging-v02.api.letsencrypt.org/directory'
12USER_AGENT = 'python-acme-example'
13ACCOUNT_KEY_SIZE = 2048
14DOMAIN = 'example.com'
15
16# 1. Generate account key
17acc_key = jose.JWKRSA(key=rsa.generate_private_key(
18    public_exponent=65537,
19    key_size=ACCOUNT_KEY_SIZE,
20))
21
22# 2. Initialize Client
23net = client.ClientNetwork(acc_key, user_agent=USER_AGENT)
24directory = messages.Directory.from_json(net.get(DIRECTORY_URL).json())
25client_acme = client.ClientV2(directory, net)
26
27# 3. Register Account
28regr = client_acme.new_account(
29    messages.NewRegistration.from_data(email='admin@example.com', terms_of_service_agreed=True)
30)
31print(f"Registered: {regr.uri}")
32
33# 4. Create Order
34order = client_acme.new_order(messages.NewOrder(identifiers=[
35    messages.Identifier(type=messages.IdentifierType.DNS, value=DOMAIN)
36]))
37
38# 5. Select and Answer Challenge (Example uses HTTP-01)
39authz = order.authorizations[0]
40challb = [c for c in authz.body.challenges if isinstance(c.chall, challenges.HTTP01)][0]
41
42# Generate the response to the challenge
43response, validation = challb.response_and_validation(acc_key)
44
45# Here you would typically perform the validation setup (e.g., placing the file on a web server)
46# ...
47
48# 6. Notify Server and Poll for status
49client_acme.answer_challenge(challb, response)
50
51# 7. Finalize Order (After validation success)
52# Generate CSR
53domain_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
54csr_pem = crypto_util.make_csr(domain_key.private_bytes(
55    encoding=serialization.Encoding.PEM,
56    format=serialization.PrivateFormat.TraditionalOpenSSL,
57    encryption_algorithm=serialization.NoEncryption()
58), [DOMAIN])
59
60# Finalize
61finalized_order = client_acme.finalize_order(order, csr_pem)
62print(f"Certificate URL: {finalized_order.certificate}")