�
E��cg_ � �< � d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm Z ddlm
Z
ddlmZ dd lmZ dd
l
mZ ddlmZ ddlmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl!m"Z" ddl!m#Z# ddl!m$Z$ ddl%Z%ddl&m'Z' ddl&m(Z( ddl)Z)ddl*m+Z, ddl-m.Z. ddl-m/Z/ ddl-m0Z0 ddl1m2Z2 erddl3m4Z4 dd l5m6Z6 ej7 e8� � Z9 djd%e:d&e;d'e;d(e;d)e;d*e<d+e0j= fd,�Z> dkd.e0j= d/eee; e e; f d0e;d1e<d*e<d+e0j? fd2�Z@d3eAd+e<fd4�ZBd3eAd.eAd+e<fd5�ZCd6e;d7eAd+e
e:e0j? ee; f fd8�ZD dld:e:d'e;d(ee; d+eAfd;�ZEd.e;d+e<fd<�ZFd=e/jG d+dfd>�ZHd=e/jG d+dfd?�ZId@eedAdBee f dCeAdDeAdEejJ d+df
dF�ZKdGe;dHe;d+dfdI�ZLd=e/jG d+dfdJ�ZMd7eAd+e
e'jN e:f fdK�ZOe'jP fdLeAdMee:eAgee'jN e'jQ f f dNe:d+ee'jN e'jQ f fdO�ZRe'jP fdLeAdMee:eAgee'jN e'jQ f f dNe:d+ee; fdP�ZSe'jP fdQeAdNe:d+ee; fdR�ZTdSeAdMee:eAgee'jN e'jQ f f dNe:d+ee; fdT�ZUdUee'jN e'jQ f d+ee; fdV�ZVe'jP fdQeAdNe:d+ee; fdW�ZWe'jP fd3eAdNe:d+ee; fdX�ZXe'jP fdYeee'jN ee%jY f dZe:d+eAfd[�ZZdGe;d+ej fd\�Z[dGe;d+ej fd]�Z\dGe;d^ee'jN geeA f d+ej fd_�Z]d`e;d+e;fda�Z^ ej_ dbej` � � Zadce;d+e
e;e;f fdd�ZbdGe;d+e:fde�Zc dmdfee; dge;dhe<d+e;fdi�ZddS )nz�Certbot client crypto utility functions.
.. todo:: Make the transition to use PSS rather than PKCS1_v1_5 when the server
is capable of handling the signatures.
� N)�Callable)�List)�Optional)�Set)�Tuple)�
TYPE_CHECKING)�Union)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)�ec)�DSAPublicKey)�ECDSA)�EllipticCurvePublicKey)�PKCS1v15)�RSAPublicKey)�Encoding)�NoEncryption)�
PrivateFormat)�crypto)�SSL)�crypto_util)�errors)�
interfaces)�util)�os)�Ed448PublicKey)�Ed25519PublicKey�rsa� secp256r1�key-certbot.pemT�key_size�key_dir�key_type�elliptic_curve�keyname�strict_permissions�returnc �~ � t | |pd|�� � }nX# t $ rK}t � dd�� � t � dt |� � � � |�d}~ww xY wt
j |d|� � t
j t j
� ||� � d d
� � \ }} |5 |� |� � ddd� � n# 1 swxY w Y |dk rt � d| | � � nt � d
| | � � t
j
| |� � S )a Initializes and saves a privkey.
Inits key and saves it in PEM format on the filesystem.
.. note:: keyname is the attempted filename, it may be different if a file
already exists at the path.
:param int key_size: key size in bits if key size is rsa.
:param str key_dir: Key save directory.
:param str key_type: Key Type [rsa, ecdsa]
:param str elliptic_curve: Name of the elliptic curve if key type is ecdsa.
:param str keyname: Filename of key
:param bool strict_permissions: If true and key_dir exists, an exception is raised if
the directory doesn't have 0700 permissions or isn't owned by the current user.
:returns: Key
:rtype: :class:`certbot.util.Key`
:raises ValueError: If unable to generate the key given key_size.
r" |