Coding Like a Certificate Authority

from public import PublicKey

class CSR(PublicKey):
    @classmethod
    def load(cls,filename):
    public_key = PublicKey()  <<<--- This guy not being ref. by import.
    with open(filename, "rb") as keyfile:
    data=keyfile.read()
    public_key = x509.load_pem_x509_csr(data, default_backend())

    return public_key

from public import PublicKey

class SignedKey(PublicKey):
    @classmethod
    def generate(cls,csr,ca_public_key,ca_private_key):
        signed_key = SignedKey()
        builder = make_builder(
            csr.key.subject,
            issuer = ca_public_key.key.subject
            ).public_key(csr.key.public_key()) <<<---This Line for Error

     for extension in csr.key.extensions:
         builder = builder.add_extension(extension.value, extension.critical)

from public import PublicKey

csr = CSR.generate(server_private_key, alt_names, name_dict)
csr.save(SERVER_CSR_FILENAME)  <<<--- Either this guy, or

signed_key=SignedKey.generate(csr, ca_public_key, ca_private_key) <-this guy. 
signed_key.save(SERVER_PUBLIC_KEY_FILENAME)

class CSR(PublicKey):
    @classmethod
    def generate(cls, private_key, alt_hosts, name_dict):
        subject = make_x509_name(**name_dict)

        # Generate alternative DNS names
        hosts = []
        for host in alt_hosts:
            hosts.append( x509.DNSName(host) )

        subject_alt_names = x509.SubjectAlternativeName(hosts)

        builder = (
            x509.CertificateSigningRequestBuilder()
            .subject_name(subject)
            .add_extension(subject_alt_names, critical=False)
        )

        csr = CSR()

        # KEY ASSIGNMENT IS DONE HERE
        csr.key = builder.sign(private_key.key, hashes.SHA256(),
            default_backend())
        return csr

# certauth.csr.py

from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes

from public import PublicKey
from util import make_x_509_name

class CSR(PublicKey):
    '''
     Generate alternative DNS names
        Has to be signed against a list of host names it's valid for,
        so the CSR has obtain the list of host names for the
        CA to be approved.
    '''
    @classmethod
    def generate(cls, private_key, alt_hosts, name_dict):
        subject = make_x_509_name(**name_dict)

        hosts = []
        for host in alt_hosts:
            hosts.append(x509.DNSName(host))

        subject_alt_names = x509.SubjectAlternativeName(hosts)

        builder = (
            x509.CertificateSigningRequestBuilder()
            .subject_name(subject)
            .add_extension(subject_alt_names, critical=False)
        )

        # An empty CSR Object is create,
        # Builder-Factory is used to sign CSR using the private_key passed in,
        # and that is attatched to the key attribute and attached to CSR.
        csr = CSR()
        csr.key = builder.sign(private_key.key, hashes.SHA256(),
            default_backend())
        return csr

    @classmethod
    def load(cls,filename):
        public_key = PublicKey()
        with open(filename, "rb") as keyfile:
            data = keyfile.read()
            public_key = x509.load_pem_x509_csr(data, default_backend())

        return public_key

#certauth.sign.py
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes

from public import PublicKey  
from util import make_builder
import logging

class SignedKey(PublicKey):
    '''
    SignedKey(PuclicKey) is used as a key-generation factory.
    ''' 
    @classmethod
    def generate(cls, csr, ca_public_key, ca_private_key):
        '''
        Generate a signed key using the provided CSR, CA public key, and 
        CA private key.

        Parameters:
        csr: The certificate signing request containing the public key.
        ca_public_key: The public key of the certificate authority.
        ca_private_key: The private key of the certificate authority.

        Returns:
        A SignedKey instance with the generated key.
        '''  
        signed_key = SignedKey()
        builder = make_builder(
            csr.key.subject,
            issuer = ca_public_key.key.subject
            ).public_key(csr.key.public_key())

        for extension in csr.key.extensions:
            builder = builder.add_extension(extension.value, extension.critical)

        try:    
            signed_key.key = builder.sign(
                private_key = ca_private_key.key, algorithm = hashes.SHA256(),
                backend=default_backend()
        )
        except Exception as e:
            """
            Handle exceptions that may occur during signing.
            """
            logging.error(f"An Error occured during the signing process: {e}")
            return None

        return signed_key

# certauth.generate_keys.py

from private import PrivateKey
from public import PublicKey
from csr import CSR
from sign import SignedKey

from cryptography.hazmat.primitives import serialization
import logging


# Constants
CA_PRIVATE_KEY_FILENAME = "ca-private-key.pem"
SERVER_PRIVATE_KEY_FILENAME = "server-private-key.pem"
SERVER_CSR_FILENAME = "server-csr.pem"
SERVER_PUBLIC_KEY_FILENAME = "server-public-key.pem"
CA_PUBLIC_KEY_FILENAME = "ca-public-key.pem"
CA_PASSWORD = "PrivateP@ssw0rd"
SERVER_PASSWORD = "ServerP@ssw0rd"

'''
# Private keys are always encoded in a pem file
# To use the key at a later time, the below will save the password.
'''
def save_private_key(private_key, filename, password):
    """Save a private key to a file with encryption."""
    utf8_password = password.encode("utf-8")
    algorithm = serialization.BestAvailableEncryption(utf8_password)

    try:
        with open(filename, "wb") as keyfile:
            key_bytes = private_key.private_bytes(
                encoding=serialization.Encoding.PEM,
                format=serialization.PrivateFormat.TraditionalOpenSSL,
                encryption_algorithm=algorithm
            )
            keyfile.write(key_bytes)
    except IOError as e:
        logging.error(f"Error saving private key to {filename}: {e}")


if __name__ == "__main__":
    # Generate CA's Private Key
    ca_private_key = PrivateKey.generate()
    save_private_key(ca_private_key.key, CA_PRIVATE_KEY_FILENAME, CA_PASSWORD)


    # Generate CA's Public Key:
    name_dict = {
        "country":"US",
        "state":"Texas",
        "locality":"Austin",
        "org":"3-P Oracle Certificate of Authority",
        "hostname":"3-P_CA.example.com",
    }

    ca_public_key = PublicKey.generate(ca_private_key, name_dict, is_ca=True)
    ca_public_key.save(CA_PUBLIC_KEY_FILENAME)

    # Generate private key for the server
    server_private_key = PrivateKey.generate()
    save_private_key(server_private_key.key, SERVER_PRIVATE_KEY_FILENAME, SERVER_PASSWORD)

    name_dict = {
        "country":"US",
        "state":"Ohio",
        "locality":"Cincinatti",
        "org":"Alphafox28 Co.",
        "hostname":"Alphafox28.future-website.com",
    }    

    alt_names = ['localhost', 'Alphafox28.future-website.com', ]

    csr = CSR.generate(server_private_key, alt_names, name_dict)
    csr.save(SERVER_CSR_FILENAME)

    # CA signs CSR, creating server's certificate / public key
    signed_key = SignedKey.generate(csr, ca_public_key, ca_private_key)
    signed_key.save(SERVER_PUBLIC_KEY_FILENAME)

    builder = (
        x509.CertificateBuilder()
        .subject_name(subject)
        .issuer_name(issuer)
        .serial_number(x509.random_serial_number())
        .not_valid_before(valid_from)
        .not_valid_after(valid_to)
    )