1
+ import datetime
2
+ import os
3
+
1
4
from cryptography import x509
2
- from cryptography .x509 .oid import NameOID , ExtendedKeyUsageOID
3
5
from cryptography .hazmat .primitives import hashes , serialization
4
6
from cryptography .hazmat .primitives .asymmetric import rsa
5
- import datetime
6
- import os
7
+ from cryptography . x509 . oid import ExtendedKeyUsageOID , NameOID
8
+
7
9
8
10
def generate_certificates (cert_dir = "certs" ):
9
11
"""Generate self-signed certificates with proper extensions for HTTPS proxy"""
@@ -22,12 +24,14 @@ def generate_certificates(cert_dir="certs"):
22
24
ca_public_key = ca_private_key .public_key ()
23
25
24
26
# CA BEGIN
25
- name = x509 .Name ([
26
- x509 .NameAttribute (NameOID .COMMON_NAME , "Proxy Pilot CA" ),
27
- x509 .NameAttribute (NameOID .ORGANIZATION_NAME , "Proxy Pilot" ),
28
- x509 .NameAttribute (NameOID .ORGANIZATIONAL_UNIT_NAME , "Development" ),
29
- x509 .NameAttribute (NameOID .COUNTRY_NAME , "UK" ),
30
- ])
27
+ name = x509 .Name (
28
+ [
29
+ x509 .NameAttribute (NameOID .COMMON_NAME , "Proxy Pilot CA" ),
30
+ x509 .NameAttribute (NameOID .ORGANIZATION_NAME , "Proxy Pilot" ),
31
+ x509 .NameAttribute (NameOID .ORGANIZATIONAL_UNIT_NAME , "Development" ),
32
+ x509 .NameAttribute (NameOID .COUNTRY_NAME , "UK" ),
33
+ ]
34
+ )
31
35
32
36
builder = x509 .CertificateBuilder ()
33
37
builder = builder .subject_name (name )
@@ -54,11 +58,11 @@ def generate_certificates(cert_dir="certs"):
54
58
key_cert_sign = True , # This is a CA
55
59
crl_sign = True ,
56
60
encipher_only = False ,
57
- decipher_only = False
61
+ decipher_only = False ,
58
62
),
59
63
critical = True ,
60
64
)
61
-
65
+
62
66
ca_cert = builder .sign (
63
67
private_key = ca_private_key ,
64
68
algorithm = hashes .SHA256 (),
@@ -67,51 +71,55 @@ def generate_certificates(cert_dir="certs"):
67
71
# Save CA certificate and key
68
72
69
73
with open ("certs/ca.crt" , "wb" ) as f :
70
- f .write (ca_cert .public_bytes (serialization .Encoding .PEM ))
74
+ f .write (ca_cert .public_bytes (serialization .Encoding .PEM ))
71
75
72
76
with open ("certs/ca.key" , "wb" ) as f :
73
- f .write (ca_private_key .private_bytes (
74
- encoding = serialization .Encoding .PEM ,
75
- format = serialization .PrivateFormat .PKCS8 ,
76
- encryption_algorithm = serialization .NoEncryption ()
77
- ))
77
+ f .write (
78
+ ca_private_key .private_bytes (
79
+ encoding = serialization .Encoding .PEM ,
80
+ format = serialization .PrivateFormat .PKCS8 ,
81
+ encryption_algorithm = serialization .NoEncryption (),
82
+ )
83
+ )
78
84
# CA END
79
85
80
86
# SERVER BEGIN
81
87
82
- ## Generate new certificate for domain
88
+ # Generate new certificate for domain
83
89
server_key = rsa .generate_private_key (
84
90
public_exponent = 65537 ,
85
91
key_size = 2048 , # 2048 bits is sufficient for domain certs
86
92
)
87
93
88
- name = x509 .Name ([
89
- x509 .NameAttribute (NameOID .COMMON_NAME , "Proxy Pilot CA" ),
90
- x509 .NameAttribute (NameOID .ORGANIZATION_NAME , "Proxy Pilot Generated" ),
91
- ])
94
+ name = x509 .Name (
95
+ [
96
+ x509 .NameAttribute (NameOID .COMMON_NAME , "Proxy Pilot CA" ),
97
+ x509 .NameAttribute (NameOID .ORGANIZATION_NAME , "Proxy Pilot Generated" ),
98
+ ]
99
+ )
92
100
93
101
builder = x509 .CertificateBuilder ()
94
102
builder = builder .subject_name (name )
95
103
builder = builder .issuer_name (ca_cert .subject )
96
104
builder = builder .public_key (server_key .public_key ())
97
105
builder = builder .serial_number (x509 .random_serial_number ())
98
106
builder = builder .not_valid_before (datetime .datetime .utcnow ())
99
- builder = builder .not_valid_after (
100
- datetime .datetime .utcnow () + datetime .timedelta (days = 365 )
101
- )
107
+ builder = builder .not_valid_after (datetime .datetime .utcnow () + datetime .timedelta (days = 365 ))
102
108
103
- # Add domain to SAN
109
+ # Add domain to SAN
104
110
builder = builder .add_extension (
105
111
x509 .SubjectAlternativeName ([x509 .DNSName ("localhost" )]),
106
112
critical = False ,
107
113
)
108
114
109
115
# Add extended key usage
110
116
builder = builder .add_extension (
111
- x509 .ExtendedKeyUsage ([
112
- ExtendedKeyUsageOID .SERVER_AUTH ,
113
- ExtendedKeyUsageOID .CLIENT_AUTH ,
114
- ]),
117
+ x509 .ExtendedKeyUsage (
118
+ [
119
+ ExtendedKeyUsageOID .SERVER_AUTH ,
120
+ ExtendedKeyUsageOID .CLIENT_AUTH ,
121
+ ]
122
+ ),
115
123
critical = False ,
116
124
)
117
125
@@ -130,31 +138,41 @@ def generate_certificates(cert_dir="certs"):
130
138
f .write (certificate .public_bytes (serialization .Encoding .PEM ))
131
139
132
140
with open ("certs/server.key" , "wb" ) as f :
133
- f .write (server_key .private_bytes (
134
- encoding = serialization .Encoding .PEM ,
135
- format = serialization .PrivateFormat .PKCS8 ,
136
- encryption_algorithm = serialization .NoEncryption ()
137
- ))
138
-
141
+ f .write (
142
+ server_key .private_bytes (
143
+ encoding = serialization .Encoding .PEM ,
144
+ format = serialization .PrivateFormat .PKCS8 ,
145
+ encryption_algorithm = serialization .NoEncryption (),
146
+ )
147
+ )
139
148
140
149
print ("Certificates generated successfully in the 'certs' directory" )
141
150
print ("\n To trust these certificates:" )
142
151
print ("\n On macOS:" )
143
- print ("sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain certs/server.crt" )
152
+ print (
153
+ "sudo security add-trusted-cert -d -r trustRoot "
154
+ "-k /Library/Keychains/System.keychain certs/server.crt"
155
+ )
144
156
print ("\n On Windows (PowerShell as Admin):" )
145
- print ("Import-Certificate -FilePath \" certs\\ server.crt\" -CertStoreLocation Cert:\\ LocalMachine\\ Root" )
157
+ print (
158
+ 'Import-Certificate -FilePath "certs\\ server.crt" '
159
+ '-CertStoreLocation Cert:\\ LocalMachine\\ Root'
160
+ )
146
161
print ("\n On Linux:" )
147
162
print ("sudo cp certs/server.crt /usr/local/share/ca-certificates/proxy-pilot.crt" )
148
163
print ("sudo update-ca-certificates" )
149
164
print ("\n For VSCode, add to settings.json:" )
150
- print ('''{
165
+ print (
166
+ """{
151
167
"http.proxy": "https://localhost:8989",
152
168
"http.proxySupport": "on",
153
169
"github.copilot.advanced": {
154
170
"debug.testOverrideProxyUrl": "https://localhost:8989",
155
171
"debug.overrideProxyUrl": "https://localhost:8989"
156
172
}
157
- }''' )
173
+ }"""
174
+ )
175
+
158
176
159
177
if __name__ == "__main__" :
160
178
generate_certificates ()
0 commit comments