1import ssl
 2
 3from cryptography import x509
 4from cryptography.hazmat.backends import default_backend
 5from OpenSSL import crypto
 6
 7
 8def get_cert_SANs(cert: bytes):
 9    cert = x509.load_pem_x509_certificate(cert, default_backend())
10    san_list = []
11    for extension in cert.extensions:
12        if isinstance(extension.value, x509.SubjectAlternativeName):
13            san = extension.value
14            for name in san:
15                san_list.append(name.value)
16    return san_list
17
18
19def generate_certificate():
20    k = crypto.PKey()
21    k.generate_key(crypto.TYPE_RSA, 4096)
22    cert = crypto.X509()
23    cert.get_subject().CN = "Gozargah"
24    cert.gmtime_adj_notBefore(0)
25    cert.gmtime_adj_notAfter(100*365*24*60*60)
26    cert.set_issuer(cert.get_subject())
27    cert.set_pubkey(k)
28    cert.sign(k, 'sha512')
29    cert_pem = crypto.dump_certificate(crypto.FILETYPE_PEM, cert).decode("utf-8")
30    key_pem = crypto.dump_privatekey(crypto.FILETYPE_PEM, k).decode("utf-8")
31
32    return {
33        "cert": cert_pem,
34        "key": key_pem
35    }
36
37
38def create_secure_context(
39    client_cert: str, client_key: str, trusted: str,
40) -> ssl.SSLContext:
41    ctx = ssl.create_default_context(cafile=trusted)
42    ctx.load_cert_chain(client_cert, client_key)
43    ctx.set_ciphers('ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20')
44    ctx.set_alpn_protocols(['h2'])
45    ctx.check_hostname = False
46    ctx.verify_mode = ssl.CERT_NONE
47    return ctx