gen_cert.py

"""내부망 HTTPS 테스트용 자체 서명 인증서 생성.

마이크 녹음(getUserMedia)은 보안 컨텍스트(HTTPS/localhost)에서만 동작하므로,
LAN IP 로 접속하는 태블릿/모바일에서 녹음하려면 HTTPS 가 필요하다.

사용: python gen_cert.py [IP]   (기본 IP 는 아래 DEFAULT_IP)
출력: cert.pem, key.pem (uvicorn --ssl-certfile/--ssl-keyfile 에 사용)
"""
import datetime
import ipaddress
import sys
from pathlib import Path

from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa

OUT = Path(__file__).parent
DEFAULT_IP = "10.100.100.239"
ip = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_IP

key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "gscribe-local")])
san = x509.SubjectAlternativeName([
    x509.DNSName("localhost"),
    x509.IPAddress(ipaddress.ip_address("127.0.0.1")),
    x509.IPAddress(ipaddress.ip_address(ip)),
])
now = datetime.datetime.utcnow()
cert = (
    x509.CertificateBuilder()
    .subject_name(name)
    .issuer_name(name)
    .public_key(key.public_key())
    .serial_number(x509.random_serial_number())
    .not_valid_before(now - datetime.timedelta(days=1))
    .not_valid_after(now + datetime.timedelta(days=825))
    .add_extension(san, critical=False)
    .add_extension(x509.BasicConstraints(ca=False, path_length=None), critical=True)
    .sign(key, hashes.SHA256())
)
(OUT / "key.pem").write_bytes(
    key.private_bytes(
        serialization.Encoding.PEM,
        serialization.PrivateFormat.TraditionalOpenSSL,
        serialization.NoEncryption(),
    )
)
(OUT / "cert.pem").write_bytes(cert.public_bytes(serialization.Encoding.PEM))
print(f"cert.pem / key.pem written (SAN: localhost, 127.0.0.1, {ip})")