1import ssl
 2
 3from cryptography import x509
 4from cryptography.hazmat.backends import default_backend
 5from OpenSSL import crypto
 6
 7
 8def get_cert_SANs(cert: bytes):
 9    cert = x509.load_pem_x509_certificate(cert, default_backend())
10    san_list = []
11    for extension in cert.extensions:
12        if isinstance(extension.value, x509.SubjectAlternativeName):
13            san = extension.value
14            for name in san:
15                san_list.append(name.value)
16    return san_list
17
18
19def generate_certificate():
20    k = crypto.PKey()
21    k.generate_key(crypto.TYPE_RSA, 4096)
22    cert = crypto.X509()
23    cert.get_subject().CN = "Gozargah"
24    cert.gmtime_adj_notBefore(0)
25    cert.gmtime_adj_notAfter(100 * 365 * 24 * 60 * 60)
26    cert.set_issuer(cert.get_subject())
27    cert.set_pubkey(k)
28    cert.sign(k, "sha512")
29    cert_pem = crypto.dump_certificate(crypto.FILETYPE_PEM, cert).decode(
30        "utf-8"
31    )
32    key_pem = crypto.dump_privatekey(crypto.FILETYPE_PEM, k).decode("utf-8")
33
34    return {"cert": cert_pem, "key": key_pem}
35
36
37def create_secure_context(
38    client_cert: str,
39    client_key: str,
40    trusted: str,
41) -> ssl.SSLContext:
42    ctx = ssl.create_default_context(cafile=trusted)
43    ctx.load_cert_chain(client_cert, client_key)
44    ctx.set_ciphers("ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20")
45    ctx.set_alpn_protocols(["h2"])
46    ctx.check_hostname = False
47    ctx.verify_mode = ssl.CERT_NONE
48    return ctx