Metadata-Version: 2.4
Name: theca
Version: 3.0.4
Summary: Python library to run your own private CA (devnull.cn/theca).
Home-page: https://devnull.cn
Author: Xizhen Du
Author-email: xizhendu@gmail.com
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: requests~=2.31.0
Requires-Dist: theid>=2
Dynamic: author
Dynamic: author-email
Dynamic: description
Dynamic: description-content-type
Dynamic: home-page
Dynamic: license-file
Dynamic: requires-dist
Dynamic: summary

# theca-sdk-python

Run your own private CA at [devnull.cn](https://devnull.cn/pca): every account
gets its own self-signed root CA (no shared devnull root, no cross-account
trust), and this package writes the PEM files to `~/.devnull/certs/`.

Requires `theid>=2` (theid 2.0 credentials; the service only accepts EdDSA
access tokens).

## Usage

```bash
# Credentials come from ~/.devnull/credentials (shared with devnull-cli) or env
export THEID_ACCESS_KEY=DK...
export THEID_SECRET_KEY=...

python3 - <<'EOF'
from theca import create_cert
print(create_cert())
EOF

ls -lt ~/.devnull/certs/
# key.pem  crt.pem  fullchain.pem  ca.pem  system_id  subject_alternative_names  properties
```

`create_cert()` creates the account's root CA on first use, then issues a
certificate for the host's `system_id` plus its `private`/`public` thedns
names, and writes the chain next to it. The returned `ca_url`
(`https://devnull.cn/getca/<orgid>`) downloads the CA certificate.

Point at another environment with `DEVNULL_PCA_URL`
(default `https://devnull.cn/pca`; the 3.0.1 name `DEVNULL_THECA_URL` is still read). The identity service is resolved by
`theid` (`DEVNULL_BASE_URL` / `THEID_ISSUER`).

## Revocation

```python
from theca import revoke_cert, crl

revoke_cert('api.example.com')     # idempotent; it stays in the CRL
open('ca.crl.pem', 'w').write(crl())
```

New certificates carry a CRL distribution point
(`https://devnull.cn/getcrl/<orgid>`); verify with
`openssl verify -crl_check -CRLfile ca.crl.pem -CAfile ca.pem crt.pem`.

## What the service stores

Per account: one RSA-4096 root CA (10 years) and up to 11 RSA-2048
certificates (1 year, SANs from the requested names). All material is stored
in Postgres as base64 PEM; `create_cert()` is idempotent per common name.
