1import ssl
 2
 3from cryptography import x509
 4from cryptography.hazmat.backends import default_backend
 5from OpenSSL import crypto
 6
 7
 8def get_cert_SANs(cert: bytes):
 9    cert = x509.load_pem_x509_certificate(cert, default_backend())
10    san_list = []
11    for extension in cert.extensions:
12        if isinstance(extension.value, x509.SubjectAlternativeName):
13            san = extension.value
14            for name in san:
15                san_list.append(name.value)
16    return san_list
17
18
19def generate_certificate():
20    k = crypto.PKey()
21    k.generate_key(crypto.TYPE_RSA, 4096)
22    cert = crypto.X509()
23    cert.get_subject().CN = "Gozargah"
24    cert.gmtime_adj_notBefore(0)
25    cert.gmtime_adj_notAfter(100 * 365 * 24 * 60 * 60)
26    cert.set_issuer(cert.get_subject())
27    cert.set_pubkey(k)
28    cert.sign(k, "sha512")
29    cert_pem = crypto.dump_certificate(crypto.FILETYPE_PEM, cert).decode("utf-8")
30    key_pem = crypto.dump_privatekey(crypto.FILETYPE_PEM, k).decode("utf-8")
31
32    return {"cert": cert_pem, "key": key_pem}
33
34
35def create_secure_context(
36    client_cert: str,
37    client_key: str,
38    trusted: str,
39) -> ssl.SSLContext:
40    ctx = ssl.create_default_context(cafile=trusted)
41    ctx.load_cert_chain(client_cert, client_key)
42    ctx.set_ciphers("ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20")
43    ctx.set_alpn_protocols(["h2"])
44    ctx.check_hostname = False
45    ctx.verify_mode = ssl.CERT_NONE
46    return ctx