(CkPython) Renew a DigiCert Certificate from an EST-enabled profile

Demonstrates how to renew a certificate from an EST-enabled profile in DigiCert​​®​​ Trust Lifecycle Manager. (The certificate must be within the renewal window configured in the certificate profile. The CSR must have same Subject DN values as the original certificate.)

Note: This example requires Chilkat v11.0.0 or greater.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux

import sys
import chilkat

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# The example below duplicates the following OpenSSL commands:
# 
# # Name of certificate as argument 1
# 
# # Make new key
# openssl ecparam -name prime256v1 -genkey -noout -out ${1}.key.pem
# 
# # Make csr
# openssl req -new -sha256 -key ${1}.key.pem -out ${1}.p10.csr -subj "/CN=${1}"
# 
# # Request new cert
# curl -v --cacert data/ca.pem --cert data/${1}.pem --key data/${1}.key.pem 
#     --data-binary @${1}.p10.csr -o ${1}.p7.b64 -H "Content-Type: application/pkcs10" https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll
# 
# # Convert to PEM
# openssl base64 -d -in ${1}.p7.b64 | openssl pkcs7 -inform DER -outform PEM -print_certs -out ${1}.pem

# ------------------------------------------------------------------------------------------------------------------

# Create a Fortuna PRNG and seed it with system entropy.
# This will be our source of random data for generating the ECC private key.
fortuna = chilkat.CkPrng()
entropy = fortuna.getEntropy(32,"base64")
success = fortuna.AddEntropy(entropy,"base64")

ec = chilkat.CkEcc()

# Generate a random EC private key on the prime256v1 curve.
privKey = chilkat.CkPrivateKey()
success = ec.GenKey("prime256v1",fortuna,privKey)
if (success != True):
    print(ec.lastErrorText())
    sys.exit()

# Create the CSR object and set properties.
csr = chilkat.CkCsr()

# Specify your CN
csr.put_CommonName("mysubdomain.mydomain.com")

# Create the CSR using the private key.
bdCsr = chilkat.CkBinData()
success = csr.GenCsrBd(privKey,bdCsr)
if (success == False):
    print(csr.lastErrorText())
    sys.exit()

# Save the private key and CSR to files.
privKey.SavePkcs8EncryptedPemFile("password","c:/temp/qa_output/ec_privkey.pem")

bdCsr.WriteFile("c:/temp/qa_output/csr.pem")

# ----------------------------------------------------------------------
# Now do the CURL request to POST the CSR and get the new certificate.

http = chilkat.CkHttp()

tlsClientCert = chilkat.CkCert()
success = tlsClientCert.LoadFromFile("data/myTlsClientCert.pem")
if (success == False):
    print(tlsClientCert.lastErrorText())
    sys.exit()

bdTlsClientCertPrivKey = chilkat.CkBinData()
success = bdTlsClientCertPrivKey.LoadFile("data/myTlsClientCert.key.pem")
if (success == False):
    print("Failed to load data/myTlsClientCert.key.pem")
    sys.exit()

tlsClientCertPrivKey = chilkat.CkPrivateKey()
success = tlsClientCertPrivKey.LoadAnyFormat(bdTlsClientCertPrivKey,"")
if (success == False):
    print(tlsClientCertPrivKey.lastErrorText())
    sys.exit()

success = tlsClientCert.SetPrivateKey(tlsClientCertPrivKey)
if (success == False):
    print(tlsClientCert.lastErrorText())
    sys.exit()

http.SetSslClientCert(tlsClientCert)

http.put_RequireSslCertVerify(True)

# The body of the HTTP request contains the binary CSR.
resp = chilkat.CkHttpResponse()
url = "https://clientauth.demo.one.digicert.com/.well-known/est/IOT/simplereenroll"
success = http.HttpBd("POST",url,bdCsr,"application/pkcs10",resp)
if (success == False):
    print(http.lastErrorText())
    sys.exit()

if (resp.get_StatusCode() != 200):
    print("response status code = " + str(resp.get_StatusCode()))
    print(resp.bodyStr())
    print("Failed")
    sys.exit()

# The response is the Base64 DER of the new certificate.
myNewCert = chilkat.CkCert()
success = myNewCert.LoadFromBase64(resp.bodyStr())
if (success == False):
    print(myNewCert.lastErrorText())
    print("Cert data = " + resp.bodyStr())
    print("Failed.")
    sys.exit()

success = myNewCert.SaveToFile("c:/temp/qa_output/myNewCert.cer")
if (success == False):
    print(myNewCert.lastErrorText())
    print("Failed.")
    sys.exit()

print("Success.")