...
Requesting signature...
Error: csr_data:
POST https://acme-v01.api.letsencrypt.org/acme/new-cert
{
    "header": {
        "alg": "RS256", 
        "jwk": {
            "e": "AQAB", 
            "kty": "RSA", 
            "n": "SNIP"
        }
    }, 
    "payload": "SNIP", 
    "protected": "SNIP", 
    "signature": "SNIP"
}
{"type":"urn:acme:error:malformed","detail":"Error unmarshaling certificate request","status":400}
Traceback (most recent call last):
  File "./sign_csr.py", line 441, in <module>
    signed_crt = sign_csr(args.public_key, args.csr_path, email=args.email, file_based=args.file_based)
  File "./sign_csr.py", line 386, in sign_csr
    resp = urllib2.urlopen(csr_url, csr_data)
  File "/usr/lib/python2.7/urllib2.py", line 127, in urlopen
    return _opener.open(url, data, timeout)
  File "/usr/lib/python2.7/urllib2.py", line 410, in open
    response = meth(req, response)
  File "/usr/lib/python2.7/urllib2.py", line 523, in http_response
    'http', request, response, code, msg, hdrs)
  File "/usr/lib/python2.7/urllib2.py", line 448, in error
    return self._call_chain(*args)
  File "/usr/lib/python2.7/urllib2.py", line 382, in _call_chain
    result = func(*args)
  File "/usr/lib/python2.7/urllib2.py", line 531, in http_error_default
    raise HTTPError(req.get_full_url(), code, msg, hdrs, fp)
urllib2.HTTPError: HTTP Error 400: Bad Request

cat domain.key signed.crt lets-encryt-x1-cross-signed.pem > letsencrypt_hiawatha.crt

Reading pubkey file...
Traceback (most recent call last):
  File "sign_csr.py", line 429, in <module>
    signed_crt = sign_csr(args.public_key, args.csr_path, email=args.email)
  File "sign_csr.py", line 39, in sign_csr
    pub_hex, pub_exp = re.search("Modulus\:\s+00:([a-f0-9\:\s]+?)Exponent\: ([0-9]+)", out, re.MULTILINE|re.DOTALL).groups()
AttributeError: 'NoneType' object has no attribute 'groups'

echo -n "{\"header\": {\"alg\": \"RS256\"},...}" > /var/www/.well-known/acme-challenge/qlWnoQpvBvNvOyZlAGLvsD

Press Enter when you've got the python command running on your server...
Requesting verification for my.totallyawesomesite.com...
Error: test_data:
POST https://acme-v01.api.letsencrypt.org/acme/challenge/nnnnnnnnnnnnnnnnnnnnnnnnn…
{
    "header": {
        "alg": "RS256",
        "jwk": {
            "e": "nnnn",
            "kty": "RSA",
            "n": "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn…"
        }
    },
    "payload": "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn…",
    "protected": "nnnnnnnnnnnnnnnnnnnnnnnnnnnnn…",
    "signature": ""
}
{"type":"urn:acme:error:malformed","detail":"Unable to read/verify body :: JWS verification error","status":400}
Traceback (most recent call last):
  File "sign_csr.py", line 441, in <module>
    signed_crt = sign_csr(args.public_key, args.csr_path, email=args.email, file_based=args.file_based)
  File "sign_csr.py", line 341, in sign_csr
    resp = urllib2.urlopen(test_url, test_data)
  File "/usr/lib64/python2.6/urllib2.py", line 126, in urlopen
    return _opener.open(url, data, timeout)
  File "/usr/lib64/python2.6/urllib2.py", line 397, in open
    response = meth(req, response)
  File "/usr/lib64/python2.6/urllib2.py", line 510, in http_response
    'http', request, response, code, msg, hdrs)
  File "/usr/lib64/python2.6/urllib2.py", line 435, in error
    return self._call_chain(*args)
  File "/usr/lib64/python2.6/urllib2.py", line 369, in _call_chain
    result = func(*args)
  File "/usr/lib64/python2.6/urllib2.py", line 518, in http_error_default
    raise HTTPError(req.get_full_url(), code, msg, hdrs, fp)
urllib2.HTTPError: HTTP Error 400: Bad Request

<IfModule mod_rewrite.c>

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

</IfModule>

nines9@magnesium:~/letsencrypt-nosudo$ ls -lha
total 92K
drwxr-xr-x 3 nines9 users 4.0K Nov 19 19:57 .
drwx---r-x 9 nines9 users 4.0K Nov 19 19:57 ..
drwxr-xr-x 8 nines9 users 4.0K Nov 19 19:57 .git
-rw-r--r-- 1 nines9 users  675 Nov 19 19:57 .gitignore
-rw-r--r-- 1 nines9 users  34K Nov 19 19:57 LICENSE
-rw-r--r-- 1 nines9 users  17K Nov 19 19:57 README.md
-rw-r--r-- 1 nines9 users  17K Nov 19 19:57 sign_csr.py

nines9@magnesium:~/letsencrypt-nosudo$ openssl genrsa 4096 > user.key
Generating RSA private key, 4096 bit long modulus
.................................++
.................................................................................................................................................................++
e is 65537 (0x10001)

nines9@magnesium:~/letsencrypt-nosudo$ openssl rsa -in user.key -pubout > user.pub
writing RSA key

nines9@magnesium:~/letsencrypt-nosudo$ #Alternatively, I want both 9nines.net and www.9nines.net
nines9@magnesium:~/letsencrypt-nosudo$ openssl genrsa 4096 > domain.key
Generating RSA private key, 4096 bit long modulus
.......................................................................................................................................................................................++
.............................................................................++
e is 65537 (0x10001)
nines9@magnesium:~/letsencrypt-nosudo$ openssl req -new -sha256 -key domain.key -subj "/" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:9nines.net,DNS:www.9nines.net")) > domain.csr

nines9@magnesium:~/letsencrypt-nosudo$ python sign_csr.py --public-key user.pub domain.csr > signed.crt
Reading pubkey file...
Found public key!
Reading csr file...
Found domains www.9nines.net, 9nines.net
STEP 1: What is your contact email? ([email protected])     
Building request payloads...
Building request for www.9nines.net...
Building request for 9nines.net...
Building request for CSR...
STEP 2: You need to sign some files (replace 'user.key' with your user private key).

openssl dgst -sha256 -sign user.key -out register_gxKP4_.sig register_fFw75_.json
openssl dgst -sha256 -sign user.key -out domain_l3TNrL.sig domain_b0O1LU.json
openssl dgst -sha256 -sign user.key -out domain_VCB1zQ.sig domain_mjx5UI.json
openssl dgst -sha256 -sign user.key -out cert_J4eZU3.sig cert_WrHIam.json

Press Enter when you've run the above commands in a new terminal window...

nines9@magnesium:~/letsencrypt-nosudo$ openssl dgst -sha256 -sign user.key -out register_gxKP4_.sig register_fFw75_.json

nines9@magnesium:~/letsencrypt-nosudo$ openssl dgst -sha256 -sign user.key -out domain_l3TNrL.sig domain_b0O1LU.json

nines9@magnesium:~/letsencrypt-nosudo$ openssl dgst -sha256 -sign user.key -out domain_VCB1zQ.sig domain_mjx5UI.json

nines9@magnesium:~/letsencrypt-nosudo$ openssl dgst -sha256 -sign user.key -out cert_J4eZU3.sig cert_WrHIam.json

Registering [email protected]...
Requesting challenges for www.9nines.net...
Building challenge responses for www.9nines.net...
Requesting challenges for 9nines.net...
Building challenge responses for 9nines.net...
STEP 3: You need to sign some more files (replace 'user.key' with your user private key).

openssl dgst -sha256 -sign user.key -out challenge_fzPMHb.sig challenge_9hvDtS.json
openssl dgst -sha256 -sign user.key -out challenge_ahkiEM.sig challenge_tN2nj0.json

Press Enter when you've run the above commands in a new terminal window...

nines9@magnesium:~/letsencrypt-nosudo$ openssl dgst -sha256 -sign user.key -out challenge_fzPMHb.sig challenge_9hvDtS.json

nines9@magnesium:~/letsencrypt-nosudo$ openssl dgst -sha256 -sign user.key -out challenge_ahkiEM.sig challenge_tN2nj0.json

STEP 4: You need to run this command on www.9nines.net (don't stop the python command until the next step).

sudo python -c "import BaseHTTPServer; \
    h = BaseHTTPServer.BaseHTTPRequestHandler; \
    h.do_GET = lambda r: r.send_response(200) or r.end_headers() or r.wfile.write('vcDQcSgQoxUI8ZBMkpZzAwnaNefIEQp5grxEtd-O-no.OFd93iap7pzVH0u9CGS6BL7qGaCscvDcA3uyxt-WO7M'); \
    s = BaseHTTPServer.HTTPServer(('0.0.0.0', 80), h); \
    s.serve_forever()"

Press Enter when you've got the python command running on your server...

Requesting verification for www.9nines.net...
Waiting for www.9nines.net challenge to pass...
Traceback (most recent call last):
  File "sign_csr.py", line 415, in <module>
    signed_crt = sign_csr(args.public_key, args.csr_path, email=args.email)
  File "sign_csr.py", line 347, in sign_csr
    raise KeyError("'{}' challenge did not pass: {}".format(i['domain'], challenge_status))
KeyError: "'www.9nines.net' challenge did not pass: {u'status': u'invalid', u'validationRecord': [{u'url': u'http://www.9nines.net/.well-known/acme-challenge/vcDQcSgQoxUI8ZBMkpZzAwnaNefIEQp5grxEtd-O-no', u'hostname': u'www.9nines.net', u'addressUsed': u'64.62.186.8', u'port': u'80', u'addressesResolved': [u'64.62.186.8']}, {u'url': u'https://www.9nines.net/.well-known/acme-challenge/vcDQcSgQoxUI8ZBMkpZzAwnaNefIEQp5grxEtd-O-no', u'hostname': u'www.9nines.net', u'addressUsed': u'64.62.186.8', u'port': u'443', u'addressesResolved': [u'64.62.186.8']}], u'keyAuthorization': u'vcDQcSgQoxUI8ZBMkpZzAwnaNefIEQp5grxEtd-O-no.OFd93iap7pzVH0u9CGS6BL7qGaCscvDcA3uyxt-WO7M', u'uri': u'https://acme-v01.api.letsencrypt.org/acme/challenge/ex_fOS2M1_l-3RY5-kZHgnKd6ZxBaXaHW5HcLkJX7XE/435535', u'token': u'vcDQcSgQoxUI8ZBMkpZzAwnaNefIEQp5grxEtd-O-no', u'error': {u'type': u'urn:acme:error:unauthorized', u'detail': u'Invalid response from http://www.9nines.net/.well-known/acme-challenge/vcDQcSgQoxUI8ZBMkpZzAwnaNefIEQp5grxEtd-O-no [64.62.186.8]: 404'}, u'type': u'http-01'}"

nines9@magnesium:~/letsencrypt-nosudo$ ls -lha
total 108K
drwxr-xr-x 3 nines9 users 4.0K Nov 19 20:31 .
drwx---r-x 9 nines9 users 4.0K Nov 19 19:57 ..
-rw-r--r-- 1 nines9 users 1.6K Nov 19 20:10 domain.csr
-rw-r--r-- 1 nines9 users 3.2K Nov 19 20:09 domain.key
drwxr-xr-x 8 nines9 users 4.0K Nov 19 19:57 .git
-rw-r--r-- 1 nines9 users  675 Nov 19 19:57 .gitignore
-rw-r--r-- 1 nines9 users  34K Nov 19 19:57 LICENSE
-rw-r--r-- 1 nines9 users  17K Nov 19 19:57 README.md
-rw-r--r-- 1 nines9 users  17K Nov 19 19:57 sign_csr.py
-rw-r--r-- 1 nines9 users    0 Nov 19 20:31 signed.crt
-rw-r--r-- 1 nines9 users 3.2K Nov 19 20:02 user.key
-rw-r--r-- 1 nines9 users  800 Nov 19 20:02 user.pub

Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/lib/python2.7/SocketServer.py", line 419, in __init__
    self.server_bind()
  File "/usr/lib/python2.7/BaseHTTPServer.py", line 108, in server_bind
    SocketServer.TCPServer.server_bind(self)
  File "/usr/lib/python2.7/SocketServer.py", line 430, in server_bind
    self.socket.bind(self.server_address)
  File "/usr/lib/python2.7/socket.py", line 224, in meth
    return getattr(self._sock,name)(*args)
socket.error: [Errno 98] Address already in use

$ python revoke_crt.py --public-key user.pub domain.crt'
Reading pubkey file...
Found public key!
...
Traceback (most recent call last):
  File "revoke_crt.py", line 136, in <module>
    revoke_crt(args.public_key, args.crt_path)
  File "revoke_crt.py", line 97, in revoke_crt
    resp = urllib2.urlopen("{0}/acme/revoke-cert".format(CA), crt_data)
  File "/usr/lib/python2.7/urllib2.py", line 127, in urlopen
    return _opener.open(url, data, timeout)
  File "/usr/lib/python2.7/urllib2.py", line 410, in open
    response = meth(req, response)
  File "/usr/lib/python2.7/urllib2.py", line 523, in http_response
    'http', request, response, code, msg, hdrs)
  File "/usr/lib/python2.7/urllib2.py", line 448, in error
    return self._call_chain(*args)
  File "/usr/lib/python2.7/urllib2.py", line 382, in _call_chain
    result = func(*args)
  File "/usr/lib/python2.7/urllib2.py", line 531, in http_error_default
    raise HTTPError(req.get_full_url(), code, msg, hdrs, fp)
urllib2.HTTPError: HTTP Error 400: Bad Request

:param string domain_to_crt: Domain to certificate.
:param string email: user account contact email
:param string ssl_directory: path to write keys and certificates
:param string server_path: Public path to write challenge files
:param bool gen_keys: Boolean True to generate User and domain keys
    if not generating names must be user.key, user.pub, domain.key, domain.csr
    in ssl_directory 
:returns: Signed Certificate (PEM format)
:rtype: string

"""
#CA = "https://acme-staging.api.letsencrypt.org"
CA = "https://acme-v01.api.letsencrypt.org"
TERMS = "https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf"
nonce_req = urllib2.Request("{0}/directory".format(CA))
nonce_req.get_method = lambda : 'HEAD'

#cert info modify to match your domain specs
# for '/CN=domain.com/O=orga LTD/C=ES/'
my_domain_CN = domain_to_crt
my_domain_C  = "XX" # country XX 
my_domain_O  = "My Company" 
my_domain_ST = "province"
my_domain_L  = "Locality"
my_subj = "/CN={0}/O={1}/C={2}/ST={3}/L={4}".format(my_domain_CN,my_domain_O,my_domain_C,my_domain_ST,my_domain_L)

#user keys names 
user_priv = "user.key"
user_pub = "user.pub"
user_priv = "{0}/{1}".format(ssl_directory, user_priv)
user_pub =  "{0}/{1}".format(ssl_directory, user_pub)

#domain keys
domain_priv = "domain.key"
domain_csr = "domain.csr"
domain_priv = "{0}/{1}".format(ssl_directory, domain_priv)
domain_csr = "{0}/{1}".format(ssl_directory, domain_csr)


#report
report_file="report.log" 


def _execute_command(command_line):
    sys.stderr.write("Executing {0}\n".format(command_line))
    args = shlex.split(command_line)  
    proc = subprocess.Popen(args, stdout=subprocess.PIPE,
                            stderr=subprocess.PIPE);
    out, err = proc.communicate()
    if proc.returncode != 0:
        _to_report("Error in {0} command".format(command_line))
        raise IOError("Error executing #{0}# \n".format(command_line))
    else:
        _to_report("Command #{0}# OK!".format(command_line))
    return 0

def _make_sure_path_exists(path):
    try:
        os.makedirs(path)
    except OSError as exception:
        if exception.errno != errno.EEXIST:
            raise  IOError("Error during path generation ERROR:{0} \n".format(exception.errno))

def _init_directorys_and_files():
    #ssl dir
    _make_sure_path_exists(ssl_directory)
    #report file
    target = open("{0}/{1}".format(ssl_directory,report_file), 'a+')
    target.write("Init Dirs and files: ok \n")
    target.close()
    return 0

def _to_report(text):
    target = open("{0}/{1}".format(ssl_directory,report_file), 'a+')
    target.write(text)
    target.write("\n")
    target.close()
    return 0

def _user_keys(user_priv, user_pub):
    "Initial User Keys with open ssl"
    sys.stderr.write("User keys generation \n")
    command_line = "openssl genrsa -out {0} 4096".format(user_priv)
    args = shlex.split(command_line)  
    proc = subprocess.Popen(args, stdout=subprocess.PIPE,
                            stderr=subprocess.PIPE);
    out, err = proc.communicate()

    if proc.returncode != 0:
        _to_report("Error in private key generation")
        raise IOError("Error generating private key {0} \n".format(user_priv))
    else:
        _to_report("Generation of user  private key -{0}- OK!".format(user_priv))

    command_line = "openssl rsa -out {0} -in {1} -pubout".format(user_pub, user_priv)
    args = shlex.split(command_line)  
    proc = subprocess.Popen(args, stdout=subprocess.PIPE,
                            stderr=subprocess.PIPE);
    out, err = proc.communicate()

    if proc.returncode != 0:
        _to_report("Error in public key generation")
        raise IOError("Error generating public key {0} \n".format(user_pub))
    else:
        _to_report("Generation of user public key -{0}- OK!".format(user_pub))

    return 0

def _domain_keys(domain_priv, domain_csr):
    "Initial Domain Private Key with open ssl"
    sys.stderr.write("Domain keys generation \n")
    command_line = "openssl genrsa -out {0} 4096".format(domain_priv)
    args = shlex.split(command_line)  
    proc = subprocess.Popen(args, stdout=subprocess.PIPE,
                            stderr=subprocess.PIPE);
    out, err = proc.communicate()

    if proc.returncode != 0:
        _to_report("Error in private key generation")
        raise IOError("Error generating private key {0} \n".format(domain_priv))
    else:
        _to_report("Generation of user private key -{0}- OK!".format(domain_priv))

    command_line = ("openssl req -new -sha256 -key {0} -out {1} "
                    "-subj '{2}'").format(domain_priv, domain_csr,my_subj)
    args = shlex.split(command_line)
    proc = subprocess.Popen(args, stdout=subprocess.PIPE,
                            stderr=subprocess.PIPE);
    out, err = proc.communicate()

    if proc.returncode != 0:
        _to_report("Error in domain CSR generation")
        raise IOError("Error generating domain CSR {0} \n".format(domain_csr))
    else:
        _to_report("Generation of domain CSR -{0}- OK!".format(domain_csr))

    return 0


def _b64(b):
    "Shortcut function to go from bytes to jwt base64 string"
    return base64.urlsafe_b64encode(b).replace("=", "")

if gen_keys:
    # Step 0: gen keys 
    _init_directorys_and_files()
    _user_keys(user_priv, user_pub)
    _domain_keys(domain_priv, domain_csr)
    sys.stderr.write("CHECK ? \n")
else:
    sys.stderr.write("NOT YET \n")
    raise 

# Step 1: Get account public key
sys.stderr.write("Reading User public Key file...\n")
proc = subprocess.Popen(["openssl", "rsa", "-pubin", "-in", user_pub, "-noout", "-text"],
    stdout=subprocess.PIPE, stderr=subprocess.PIPE)
out, err = proc.communicate()
if proc.returncode != 0:
    raise IOError("Error loading {0}".format(user_pub))
pub_hex, pub_exp = re.search(
    "Modulus(?: \((?:2048|4096) bit\)|)\:\s+00:([a-f0-9\:\s]+?)Exponent\: ([0-9]+)",
    out, re.MULTILINE|re.DOTALL).groups()
pub_mod = binascii.unhexlify(re.sub("(\s|:)", "", pub_hex))
pub_mod64 = _b64(pub_mod)
pub_exp = int(pub_exp)
pub_exp = "{0:x}".format(pub_exp)
pub_exp = "0{0}".format(pub_exp) if len(pub_exp) % 2 else pub_exp
pub_exp = binascii.unhexlify(pub_exp)
pub_exp64 = _b64(pub_exp)
header = {
    "alg": "RS256",
    "jwk": {
        "e": pub_exp64,
        "kty": "RSA",
        "n": pub_mod64,
    },
}
accountkey_json = json.dumps(header['jwk'], sort_keys=True, separators=(',', ':'))
thumbprint = _b64(hashlib.sha256(accountkey_json).digest())
sys.stderr.write("Found public key!\n")

# Step 2: Get the domain names to be certified
sys.stderr.write("Reading csr file...\n")
proc = subprocess.Popen(["openssl", "req", "-in", domain_csr, "-noout", "-text"],
    stdout=subprocess.PIPE, stderr=subprocess.PIPE)
out, err = proc.communicate()
if proc.returncode != 0:
    raise IOError("Error loading {0}".format(domain_csr))
domains = set([])
common_name = re.search("Subject:.*? CN=([^\s,;/]+)", out)
if common_name is not None:
    domains.add(common_name.group(1))
subject_alt_names = re.search("X509v3 Subject Alternative Name: \n +([^\n]+)\n", out, re.MULTILINE|re.DOTALL)
if subject_alt_names is not None:
    for san in subject_alt_names.group(1).split(", "):
        if san.startswith("DNS:"):
            domains.add(san[4:])
sys.stderr.write("Found domains {0}\n".format(", ".join(domains)))

# Step 3: contact email
# nothing just from cli 

# Step 4: Generate the payloads that need to be signed
# registration
sys.stderr.write("Building request payloads...\n")
reg_nonce = urllib2.urlopen(nonce_req).headers['Replay-Nonce']
reg_raw = json.dumps({
    "resource": "new-reg",
    "contact": ["mailto:{0}".format(email)],
    "agreement": TERMS,
}, sort_keys=True, indent=4)
reg_b64 = _b64(reg_raw)
reg_protected = copy.deepcopy(header)
reg_protected.update({"nonce": reg_nonce})
reg_protected64 = _b64(json.dumps(reg_protected, sort_keys=True, indent=4))
reg_file = tempfile.NamedTemporaryFile(dir=".", prefix="register_", suffix=".json")
reg_file.write("{0}.{1}".format(reg_protected64, reg_b64))
reg_file.flush()
reg_file_name = os.path.basename(reg_file.name)
reg_file_sig = tempfile.NamedTemporaryFile(dir=".", prefix="register_", suffix=".sig")
reg_file_sig_name = os.path.basename(reg_file_sig.name)

# need signature for each domain identifiers
ids = []
for domain in domains:
    sys.stderr.write("Building request for {0}...\n".format(domain))
    id_nonce = urllib2.urlopen(nonce_req).headers['Replay-Nonce']
    id_raw = json.dumps({
        "resource": "new-authz",
        "identifier": {
            "type": "dns",
            "value": domain,
        },
    }, sort_keys=True)
    id_b64 = _b64(id_raw)
    id_protected = copy.deepcopy(header)
    id_protected.update({"nonce": id_nonce})
    id_protected64 = _b64(json.dumps(id_protected, sort_keys=True, indent=4))
    id_file = tempfile.NamedTemporaryFile(dir=".", prefix="domain_", suffix=".json")
    id_file.write("{0}.{1}".format(id_protected64, id_b64))
    id_file.flush()
    id_file_name = os.path.basename(id_file.name)
    id_file_sig = tempfile.NamedTemporaryFile(dir=".", prefix="domain_", suffix=".sig")
    id_file_sig_name = os.path.basename(id_file_sig.name)
    ids.append({
        "domain": domain,
        "protected64": id_protected64,
        "data64": id_b64,
        "file": id_file,
        "file_name": id_file_name,
        "sig": id_file_sig,
        "sig_name": id_file_sig_name,
    })

# need signature for the final certificate issuance
sys.stderr.write("Building request for CSR...\n")
proc = subprocess.Popen(["openssl", "req", "-in", domain_csr, "-outform", "DER"],
    stdout=subprocess.PIPE, stderr=subprocess.PIPE)
csr_der, err = proc.communicate()
csr_der64 = _b64(csr_der)
csr_nonce = urllib2.urlopen(nonce_req).headers['Replay-Nonce']
csr_raw = json.dumps({
    "resource": "new-cert",
    "csr": csr_der64,
}, sort_keys=True, indent=4)
csr_b64 = _b64(csr_raw)
csr_protected = copy.deepcopy(header)
csr_protected.update({"nonce": csr_nonce})
csr_protected64 = _b64(json.dumps(csr_protected, sort_keys=True, indent=4))
csr_file = tempfile.NamedTemporaryFile(dir=".", prefix="cert_", suffix=".json")
csr_file.write("{0}.{1}".format(csr_protected64, csr_b64))
csr_file.flush()
csr_file_name = os.path.basename(csr_file.name)
csr_file_sig = tempfile.NamedTemporaryFile(dir=".", prefix="cert_", suffix=".sig")
csr_file_sig_name = os.path.basename(csr_file_sig.name)

# Step 5: Ask the user to sign the registration and requests

## MOD Esteban automatic generattion 
_execute_command("openssl dgst -sha256 -sign {0} -out {1} {2}".format(user_priv, reg_file_sig_name, reg_file_name))
for i in ids:
    _execute_command( "openssl dgst -sha256 -sign {0} -out {1} {2}".format( user_priv, i['sig_name'], i['file_name']))

_execute_command("openssl dgst -sha256 -sign {0} -out {1} {2}".format(user_priv, csr_file_sig_name, csr_file_name))
## MOD Esteban 

# Step 6: Load the signatures
reg_file_sig.seek(0)
reg_sig64 = _b64(reg_file_sig.read())
for n, i in enumerate(ids):
    i['sig'].seek(0)
    i['sig64'] = _b64(i['sig'].read())

# Step 7: Register the user
sys.stderr.write("Registering {0}...\n".format(email))
reg_data = json.dumps({
    "header": header,
    "protected": reg_protected64,
    "payload": reg_b64,
    "signature": reg_sig64,
}, sort_keys=True, indent=4)
reg_url = "{0}/acme/new-reg".format(CA)
try:
    resp = urllib2.urlopen(reg_url, reg_data)
    result = json.loads(resp.read())
except urllib2.HTTPError as e:
    err = e.read()
    # skip already registered accounts
    if "Registration key is already in use" in err:
        sys.stderr.write("Already registered. Skipping...\n")
    else:
        sys.stderr.write("Error: reg_data:\n")
        sys.stderr.write("POST {0}\n".format(reg_url))
        sys.stderr.write(reg_data)
        sys.stderr.write("\n")
        sys.stderr.write(err)
        sys.stderr.write("\n")
        raise

# Step 8: Request challenges for each domain
responses = []
tests = []
for n, i in enumerate(ids):
    sys.stderr.write("Requesting challenges for {0}...\n".format(i['domain']))
    id_data = json.dumps({
        "header": header,
        "protected": i['protected64'],
        "payload": i['data64'],
        "signature": i['sig64'],
    }, sort_keys=True, indent=4)
    id_url = "{0}/acme/new-authz".format(CA)
    try:
        resp = urllib2.urlopen(id_url, id_data)
        result = json.loads(resp.read())
    except urllib2.HTTPError as e:
        sys.stderr.write("Error: id_data:\n")
        sys.stderr.write("POST {0}\n".format(id_url))
        sys.stderr.write(id_data)
        sys.stderr.write("\n")
        sys.stderr.write(e.read())
        sys.stderr.write("\n")
        raise
    challenge = [c for c in result['challenges'] if c['type'] == "http-01"][0]
    keyauthorization = "{0}.{1}".format(challenge['token'], thumbprint)

    # challenge request
    sys.stderr.write("Building challenge responses for {0}...\n".format(i['domain']))
    test_nonce = urllib2.urlopen(nonce_req).headers['Replay-Nonce']
    test_raw = json.dumps({
        "resource": "challenge",
        "keyAuthorization": keyauthorization,
    }, sort_keys=True, indent=4)
    test_b64 = _b64(test_raw)
    test_protected = copy.deepcopy(header)
    test_protected.update({"nonce": test_nonce})
    test_protected64 = _b64(json.dumps(test_protected, sort_keys=True, indent=4))
    test_file = tempfile.NamedTemporaryFile(dir=".", prefix="challenge_", suffix=".json")
    test_file.write("{0}.{1}".format(test_protected64, test_b64))
    test_file.flush()
    test_file_name = os.path.basename(test_file.name)
    test_file_sig = tempfile.NamedTemporaryFile(dir=".", prefix="challenge_", suffix=".sig")
    test_file_sig_name = os.path.basename(test_file_sig.name)
    tests.append({
        "uri": challenge['uri'],
        "protected64": test_protected64,
        "data64": test_b64,
        "file": test_file,
        "file_name": test_file_name,
        "sig": test_file_sig,
        "sig_name": test_file_sig_name,
    })

    # challenge response for server
    responses.append({
        "uri": ".well-known/acme-challenge/{0}".format(challenge['token']),
        "data": keyauthorization,
    })

# Step 9: Ask the user to sign the challenge responses

## MOD Esteban automate this
for i in tests:
    _execute_command("openssl dgst -sha256 -sign {0} -out {1} {2}".format(user_priv, i['sig_name'], i['file_name']))

## MOD Esteban 

# Step 10: Load the response signatures
for n, i in enumerate(ids):
    tests[n]['sig'].seek(0)
    tests[n]['sig64'] = _b64(tests[n]['sig'].read())

# Step 11: Ask the user to host the token on their server
for n, i in enumerate(ids):

    ## MOD Esteban only file based write files 
    requested_URL = "http://{0}/{1}".format( i['domain'], responses[n]['uri'])
    sys.stderr.write(requested_URL)

    subdomain = i['domain'].split('.')[0]
    if subdomain not in ["www" , domain_to_crt]: 
        requested_dir = "{0}/{1}".format( server_path, subdomain)
        _to_report("Checking directory: {0}".format(requested_dir))
        if not os.path.isdir(requested_dir):
            _to_report("FAIL \n")
            raise IOError("subdomain not in server path: {0}".format(requested_dir))
    else:
        requested_dir = server_path
        if not os.path.isdir(requested_dir):
            _to_report("FAIL \n")
            raise IOError("domain not in server path: {0}".format(requested_dir))

    _make_sure_path_exists("{0}/.well-known".format(requested_dir))
    _make_sure_path_exists("{0}/.well-known/acme-challenge".format(requested_dir))
    requested_file = "{0}/{1}".format(requested_dir, responses[n]['uri'])
    content_data = "{0}".format(responses[n]['data'])

    #write file to server
    target = open(requested_file, 'w+')
    target.write(content_data)
    target.close()

    ## MOD Esteban 

    # Step 12: Let the CA know you're ready for the challenge
    sys.stderr.write("Requesting verification for {0}...\n".format(i['domain']))
    test_data = json.dumps({
        "header": header,
        "protected": tests[n]['protected64'],
        "payload": tests[n]['data64'],
        "signature": tests[n]['sig64'],
    }, sort_keys=True, indent=4)
    test_url = tests[n]['uri']
    try:
        resp = urllib2.urlopen(test_url, test_data)
        test_result = json.loads(resp.read())
    except urllib2.HTTPError as e:
        sys.stderr.write("Error: test_data:\n")
        sys.stderr.write("POST {0}\n".format(test_url))
        sys.stderr.write(test_data)
        sys.stderr.write("\n")
        sys.stderr.write(e.read())
        sys.stderr.write("\n")
        raise

    # Step 13: Wait for CA to mark test as valid
    sys.stderr.write("Waiting for {0} challenge to pass...\n".format(i['domain']))
    while True:
        try:
            resp = urllib2.urlopen(test_url)
            challenge_status = json.loads(resp.read())
        except urllib2.HTTPError as e:
            sys.stderr.write("Error: test_data:\n")
            sys.stderr.write("GET {0}\n".format(test_url))
            sys.stderr.write(test_data)
            sys.stderr.write("\n")
            sys.stderr.write(e.read())
            sys.stderr.write("\n")
            raise
        if challenge_status['status'] == "pending":
            time.sleep(2)
        elif challenge_status['status'] == "valid":
            sys.stderr.write("Passed {0} challenge!\n".format(i['domain']))
            break
        else:
            raise KeyError("'{0}' challenge did not pass: {1}".format(i['domain'], challenge_status))

# Step 14: Get the certificate signed
sys.stderr.write("Requesting signature...\n")
csr_file_sig.seek(0)
csr_sig64 = _b64(csr_file_sig.read())
csr_data = json.dumps({
    "header": header,
    "protected": csr_protected64,
    "payload": csr_b64,
    "signature": csr_sig64,
}, sort_keys=True, indent=4)
csr_url = "{0}/acme/new-cert".format(CA)
try:
    resp = urllib2.urlopen(csr_url, csr_data)
    signed_der = resp.read()
except urllib2.HTTPError as e:
    sys.stderr.write("Error: csr_data:\n")
    sys.stderr.write("POST {0}\n".format(csr_url))
    sys.stderr.write(csr_data)
    sys.stderr.write("\n")
    sys.stderr.write(e.read())
    sys.stderr.write("\n")
    raise

# Step 15: Convert the signed cert from DER to PEM
sys.stderr.write("Certificate signed!\n")
signed_der64 = base64.b64encode(signed_der)
signed_pem = """\

return signed_pem

args = parser.parse_args()
signed_crt = sign_csr(args.domain_to_crt, args.email, "{0}_{1}".format(args.ssl_directory,args.domain_to_crt), args.server_path, args.gen_keys)
#signed_crt = sign_csr(args.public_key, args.csr_path, email=args.email, file_based=args.file_based, ssl_directory=args.ssl_directory)
sys.stdout.write(signed_crt)
signed_crt_file = open("{0}/{1}".format("{0}_{1}".format(args.ssl_directory,args.domain_to_crt),"signed.crt"), 'w+')
signed_crt_file.write(signed_crt)
signed_crt_file.close()

letsencrypt-nosudo --port=27318 <csr details>

paul@ubuntu:~/letsencrypt$ python sign_csr.py user.pub filethatdoesntexist.csr > signed.crt
Reading pubkey file...
Found public key!
Reading csr file...
Traceback (most recent call last):
  File "sign_csr.py", line 331, in <module>
    signed_crt = sign_csr(args.pubkey_path, args.csr_path)
  File "sign_csr.py", line 60, in sign_csr
    domain = re.search("Subject:.*? CN=([^\s,;/]+).*?", out, re.MULTILINE|re.DOTALL).groups()[0]
AttributeError: 'NoneType' object has no attribute 'groups'