SSL Termination at the Gateway — Deep Dive into TLS Configuration

from typing import Dict, List, Optional, Tuple
from datetime import datetime, timedelta
import ssl

class TLSConfig:
    def __init__(self):
        self.min_version = ssl.TLSVersion.TLSv1_2
        self.cert_path: Optional[str] = None
        self.key_path: Optional[str] = None
        self.allowed_ciphers: List[str] = []
        self.hsts_max_age: int = 31536000
        self.hsts_include_subdomains: bool = True
        self.hsts_preload: bool = False

    def set_certificate(self, cert_path: str,
                        key_path: str):
        self.cert_path = cert_path
        self.key_path = key_path

    def get_ciphers(self) -> str:
        if self.allowed_ciphers:
            return ":".join(self.allowed_ciphers)
        return (
            "ECDHE-ECDSA-AES128-GCM-SHA256:"
            "ECDHE-RSA-AES128-GCM-SHA256:"
            "ECDHE-ECDSA-AES256-GCM-SHA384:"
            "ECDHE-RSA-AES256-GCM-SHA384"
        )

    def build_ssl_context(self) -> ssl.SSLContext:
        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
        ctx.minimum_version = self.min_version
        if self.cert_path and self.key_path:
            ctx.load_cert_chain(self.cert_path, self.key_path)
        ctx.set_ciphers(self.get_ciphers())
        return ctx

    def build_hsts_header(self) -> str:
        value = f"max-age={self.hsts_max_age}"
        if self.hsts_include_subdomains:
            value += "; includeSubDomains"
        if self.hsts_preload:
            value += "; preload"
        return value

config = TLSConfig()
config.set_certificate("/etc/certs/gateway.pem",
                       "/etc/certs/gateway-key.pem")
config.min_version = ssl.TLSVersion.TLSv1_3
print(f"HSTS: {config.build_hsts_header()}")

import os
from datetime import datetime
from typing import Dict, Optional, Tuple
import hashlib

class CertificateManager:
    def __init__(self, cert_dir: str = "/etc/certs"):
        self.cert_dir = cert_dir
        self.certs: Dict[str, Dict] = {}

    def load_certificate(self, domain: str
                         ) -> Optional[Dict]:
        cert_path = os.path.join(
            self.cert_dir, f"{domain}.pem"
        )
        if not os.path.exists(cert_path):
            return None
        with open(cert_path) as f:
            cert_pem = f.read()
        cert_info = {
            "domain": domain,
            "path": cert_path,
            "fingerprint": hashlib.sha256(
                cert_pem.encode()
            ).hexdigest(),
            "loaded": datetime.utcnow(),
        }
        self.certs[domain] = cert_info
        return cert_info

    def check_expiry(self, domain: str,
                     threshold_days: int = 30
                     ) -> Tuple[bool, Optional[int]]:
        cert_info = self.certs.get(domain)
        if not cert_info:
            return False, None
        # In production, parse the certificate to check expiry
        return True, threshold_days

    def renew_certificate(self, domain: str) -> bool:
        # In production, implement ACME challenge
        print(f"Renewing certificate for {domain}")
        return True

    def get_cert_for_sni(self, server_name: str
                         ) -> Optional[str]:
        cert = self.certs.get(server_name)
        if cert:
            return cert["path"]
        wildcard = self.certs.get(f"*.{'.'.join(server_name.split('.')[1:])}")
        if wildcard:
            return wildcard["path"]
        return None

mgr = CertificateManager()
info = mgr.load_certificate("api.durga-antivirus.com")
if info:
    print(f"Loaded cert: {info['domain']}")
sni_cert = mgr.get_cert_for_sni("api.durga-antivirus.com")
print(f"SNI cert: {sni_cert}")

from typing import Dict, Optional, Tuple
import ssl

class MutualTLSConfig:
    def __init__(self):
        self.ca_cert_path: Optional[str] = None
        self.client_cert_path: Optional[str] = None
        self.client_key_path: Optional[str] = None
        self.verify_mode = ssl.CERT_REQUIRED

    def configure(self, ca_cert: str,
                  client_cert: str,
                  client_key: str):
        self.ca_cert_path = ca_cert
        self.client_cert_path = client_cert
        self.client_key_path = client_key

    def build_client_context(self) -> ssl.SSLContext:
        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
        ctx.verify_mode = self.verify_mode
        if self.ca_cert_path:
            ctx.load_verify_locations(self.ca_cert_path)
        if self.client_cert_path and self.client_key_path:
            ctx.load_cert_chain(
                self.client_cert_path,
                self.client_key_path
            )
        ctx.check_hostname = True
        return ctx

    def verify_backend_cert(self, cert: bytes) -> bool:
        # Validate backend certificate attributes
        return True

mtls = MutualTLSConfig()
mtls.configure(
    "/etc/certs/ca.pem",
    "/etc/certs/gateway-client.pem",
    "/etc/certs/gateway-client-key.pem"
)
print(f"mTLS configured with CA: {mtls.ca_cert_path}")
print(f"Verify mode: {mtls.verify_mode}")