--- title: Charmhub | Deploy TLS Certificates Interface using Charmhub - The Open Operator Collection description: Deploy the latest version of TLS Certificates Interface as a Kubernetes Operator on any cloud. url: https://charmhub.io/tls-certificates-interface/libraries/tls_certificates --- # TLS Certificates Interface [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco") * [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco") Platform: edge 277 ``` juju deploy tls-certificates-interface --channel edge ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) [Toggle side navigation](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#drawer) ## charms.tls\_certificates\_interface.v4.tls\_certificates * [*Docstrings*Docstrings](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates) [*Code*Source code](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates/source-code) * + Download Fetch library ``` charmcraft fetch-lib charms.tls_certificates_interface.v4.tls_certificates ``` [Download tls\_certificates.py](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates/download) + *Last updated* 04 Jun 2026 + *Revision* Library version 4.30 Legacy Charmhub-hosted lib, deprecated in favour of `charmlibs.interfaces.tls_certificates`. WARNING: This library is deprecated. It will not receive feature updates or bugfixes. `charmlibs.interfaces.tls_certificates` 1.0 is a bug-for-bug compatible migration of this library. To migrate: 1. Add 'charmlibs-interfaces-tls-certificates~=1.0' to your charm's dependencies, and remove this Charmhub-hosted library from your charm. 2. You can also remove any dependencies added to your charm only because of this library. 3. Replace `from charms.tls_certificates_interface.v4 import tls_certificates` with `from charmlibs.interfaces import tls_certificates`. Read more: * https://documentation.ubuntu.com/charmlibs * https://pypi.org/project/charmlibs-interfaces-tls-certificates --- Charm library for managing TLS certificates (V4). This library contains the Requires and Provides classes for handling the tls-certificates interface. Pre-requisites: * Juju >= 3.0 * cryptography >= 43.0.0 * pydantic >= 1.0 Learn more on how-to use the TLS Certificates interface library by reading the documentation: * https://charmhub.io/tls-certificates-interface/ --- Index * [class TLSCertificatesError](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificateserror) * [class DataValidationError](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#datavalidationerror) * [class Mode](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#mode) * [class PrivateKey](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#privatekey) * + [def \_\_init\_\_( self, raw, x509\_object)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#privatekey-__init__) * + [def raw( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#privatekey-raw) * + [def \_\_str\_\_( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#privatekey-__str__) * + [def \_\_hash\_\_( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#privatekey-__hash__) * + [def from\_string( cls, private\_key)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#privatekey-from_string) * + [def is\_valid( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#privatekey-is_valid) * + [def generate( cls, key\_size, public\_exponent)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#privatekey-generate) * + [def \_\_eq\_\_( self, other)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#privatekey-__eq__) * [class Certificate](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate) * + [def \_\_init\_\_( self, raw, common\_name, expiry\_time, validity\_start\_time, is\_ca, sans\_dns, sans\_ip, sans\_oid, email\_address, organization, organizational\_unit, country\_name, state\_or\_province\_name, locality\_name, x509\_object)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-__init__) * + [def raw( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-raw) * + [def common\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-common_name) * + [def expiry\_time( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-expiry_time) * + [def validity\_start\_time( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-validity_start_time) * + [def is\_ca( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-is_ca) * + [def sans\_dns( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-sans_dns) * + [def sans\_ip( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-sans_ip) * + [def sans\_oid( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-sans_oid) * + [def email\_address( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-email_address) * + [def organization( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-organization) * + [def organizational\_unit( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-organizational_unit) * + [def country\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-country_name) * + [def state\_or\_province\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-state_or_province_name) * + [def locality\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-locality_name) * + [def \_\_str\_\_( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-__str__) * + [def \_\_eq\_\_( self, other)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-__eq__) * + [def from\_string( cls, certificate)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-from_string) * + [def matches\_private\_key( self, private\_key)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-matches_private_key) * + [def generate( cls, csr, ca, ca\_private\_key, validity, is\_ca)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-generate) * + [def generate\_self\_signed\_ca( cls, attributes, private\_key, validity)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-generate_self_signed_ca) * + [def \_\_hash\_\_( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificate-__hash__) * [class CertificateSigningRequest](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest) * + [def \_\_init\_\_( self, raw, common\_name, sans\_dns, sans\_ip, sans\_oid, email\_address, organization, organizational\_unit, country\_name, state\_or\_province\_name, locality\_name, has\_unique\_identifier, x509\_object)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-__init__) * + [def common\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-common_name) * + [def sans\_dns( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-sans_dns) * + [def sans\_ip( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-sans_ip) * + [def sans\_oid( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-sans_oid) * + [def email\_address( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-email_address) * + [def organization( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-organization) * + [def organizational\_unit( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-organizational_unit) * + [def country\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-country_name) * + [def state\_or\_province\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-state_or_province_name) * + [def locality\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-locality_name) * + [def has\_unique\_identifier( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-has_unique_identifier) * + [def raw( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-raw) * + [def \_\_str\_\_( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-__str__) * + [def additional\_critical\_extensions( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-additional_critical_extensions) * + [def from\_string( cls, csr)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-from_string) * + [def from\_csr( cls, csr)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-from_csr) * + [def \_\_eq\_\_( self, other)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-__eq__) * + [def \_\_hash\_\_( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-__hash__) * + [def matches\_certificate( self, certificate)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-matches_certificate) * + [def matches\_private\_key( self, key)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-matches_private_key) * + [def get\_sha256\_hex( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-get_sha256_hex) * + [def sign( self, ca, ca\_private\_key, validity, is\_ca)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-sign) * + [def generate( cls, attributes, private\_key)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesigningrequest-generate) * [class CertificateRequestAttributes](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes) * + [def \_\_init\_\_( self, common\_name, sans\_dns, sans\_ip, sans\_oid, email\_address, organization, organizational\_unit, country\_name, state\_or\_province\_name, locality\_name, is\_ca, add\_unique\_id\_to\_subject\_name, additional\_critical\_extensions)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-__init__) * + [def common\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-common_name) * + [def sans\_dns( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-sans_dns) * + [def sans\_ip( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-sans_ip) * + [def sans\_oid( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-sans_oid) * + [def email\_address( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-email_address) * + [def organization( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-organization) * + [def organizational\_unit( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-organizational_unit) * + [def country\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-country_name) * + [def state\_or\_province\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-state_or_province_name) * + [def locality\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-locality_name) * + [def is\_ca( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-is_ca) * + [def add\_unique\_id\_to\_subject\_name( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-add_unique_id_to_subject_name) * + [def additional\_critical\_extensions( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-additional_critical_extensions) * + [def from\_csr( cls, csr, is\_ca)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-from_csr) * + [def \_\_eq\_\_( self, other)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-__eq__) * + [def \_\_hash\_\_( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-__hash__) * + [def is\_valid( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-is_valid) * + [def generate\_csr( self, private\_key)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificaterequestattributes-generate_csr) * [class ProviderCertificate](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#providercertificate) * + [def to\_json( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#providercertificate-to_json) * [class RequirerCertificateRequest](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#requirercertificaterequest) * [class CertificateAvailableEvent](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificateavailableevent) * + [def \_\_init\_\_( self, handle, certificate, certificate\_signing\_request, ca, chain)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificateavailableevent-__init__) * + [def snapshot( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificateavailableevent-snapshot) * + [def restore( self, snapshot)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificateavailableevent-restore) * + [def chain\_as\_pem( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificateavailableevent-chain_as_pem) * [def generate\_private\_key( key\_size, public\_exponent )](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#generate_private_key) * [def calculate\_relative\_datetime( target\_time, fraction )](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#calculate_relative_datetime) * [def chain\_has\_valid\_order( chain )](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#chain_has_valid_order) * [def generate\_csr( private\_key, common\_name, sans\_dns, sans\_ip, sans\_oid, organization, organizational\_unit, email\_address, country\_name, locality\_name, state\_or\_province\_name, add\_unique\_id\_to\_subject\_name )](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#generate_csr) * [def generate\_ca( private\_key, validity, common\_name, sans\_dns, sans\_ip, sans\_oid, organization, organizational\_unit, email\_address, country\_name, state\_or\_province\_name, locality\_name )](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#generate_ca) * [def generate\_certificate( csr, ca, ca\_private\_key, validity, is\_ca )](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#generate_certificate) * [class CertificatesRequirerCharmEvents](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#certificatesrequirercharmevents) * [class TLSCertificatesRequiresV4](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesrequiresv4) * + [def \_\_init\_\_( self, charm, relationship\_name, certificate\_requests, mode, refresh\_events, private\_key, renewal\_relative\_time)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesrequiresv4-__init__) * + [def sync( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesrequiresv4-sync) * + [def renew\_certificate( self, certificate)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesrequiresv4-renew_certificate) * + [def private\_key( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesrequiresv4-private_key) * + [def regenerate\_private\_key( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesrequiresv4-regenerate_private_key) * + [def get\_csrs\_from\_requirer\_relation\_data( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesrequiresv4-get_csrs_from_requirer_relation_data) * + [def get\_provider\_certificates( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesrequiresv4-get_provider_certificates) * + [def get\_assigned\_certificate( self, certificate\_request)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesrequiresv4-get_assigned_certificate) * + [def get\_assigned\_certificates( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesrequiresv4-get_assigned_certificates) * [class TLSCertificatesProvidesV4](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesprovidesv4) * + [def \_\_init\_\_( self, charm, relationship\_name)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesprovidesv4-__init__) * + [def get\_certificate\_requests( self, relation\_id)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesprovidesv4-get_certificate_requests) * + [def revoke\_all\_certificates( self)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesprovidesv4-revoke_all_certificates) * + [def set\_relation\_certificate( self, provider\_certificate)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesprovidesv4-set_relation_certificate) * + [def get\_issued\_certificates( self, relation\_id)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesprovidesv4-get_issued_certificates) * + [def get\_provider\_certificates( self, relation\_id)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesprovidesv4-get_provider_certificates) * + [def get\_unsolicited\_certificates( self, relation\_id)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesprovidesv4-get_unsolicited_certificates) * + [def get\_outstanding\_certificate\_requests( self, relation\_id)](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates#tlscertificatesprovidesv4-get_outstanding_certificate_requests) #### class TLSCertificatesError Description Base class for custom errors raised by this library. None #### class DataValidationError Description Raised when data validation fails. None #### class Mode Enum representing the mode of the certificate request. Description UNIT (default): Request a certificate for the unit. Each unit will manage its private key, certificate signing request and certificate. APP: Request a certificate for the application. Only the leader unit will manage the private key, certificate signing request and certificate. #### class PrivateKey Description This class represents a private key. None Methods PrivateKey. \_\_init\_\_( *self* , raw , x509\_object ) Initialize the PrivateKey object. Description If both raw and x509\_object are provided, x509\_object takes precedence. PrivateKey. raw( *self* ) Description Return the PEM-formatted string representation of the private key. None PrivateKey. \_\_str\_\_( *self* ) Description Return the private key as a string in PEM format. None PrivateKey. \_\_hash\_\_( *self* ) Description Return the hash of the private key. None PrivateKey. from\_string( cls , private\_key: str ) Description Create a PrivateKey object from a private key. None PrivateKey. is\_valid( *self* ) Description Validate that the private key is PEM-formatted, RSA, and at least 2048 bits. None PrivateKey. generate( cls , key\_size: int , public\_exponent: int ) Generate a new RSA private key. Arguments key\_size The size of the key in bits. public\_exponent The public exponent of the key. Returns PrivateKey The generated private key. PrivateKey. \_\_eq\_\_( *self* , other: object ) Description Check if two PrivateKey objects are equal. None #### class Certificate Description This class represents a certificate. None Methods Certificate. \_\_init\_\_( *self* , raw , common\_name , expiry\_time , validity\_start\_time , is\_ca , sans\_dns , sans\_ip , sans\_oid , email\_address , organization , organizational\_unit , country\_name , state\_or\_province\_name , locality\_name , x509\_object ) Initialize the Certificate object. Description This initializer must maintain the old interface while also allowing instantiation from an existing x509\_object. It ignores all fields other than raw and x509\_object, preferring x509\_object. Certificate. raw( *self* ) Description Return the PEM-formatted string representation of the certificate. None Certificate. common\_name( *self* ) Description Return the common name of the certificate. None Certificate. expiry\_time( *self* ) Description Return the expiry time of the certificate. None Certificate. validity\_start\_time( *self* ) Description Return the validity start time of the certificate. None Certificate. is\_ca( *self* ) Description Return whether the certificate is a CA certificate. None Certificate. sans\_dns( *self* ) Description Return the DNS Subject Alternative Names of the certificate. None Certificate. sans\_ip( *self* ) Description Return the IP Subject Alternative Names of the certificate. None Certificate. sans\_oid( *self* ) Description Return the OID Subject Alternative Names of the certificate. None Certificate. email\_address( *self* ) Description Return the email address of the certificate. None Certificate. organization( *self* ) Description Return the organization name of the certificate. None Certificate. organizational\_unit( *self* ) Description Return the organizational unit name of the certificate. None Certificate. country\_name( *self* ) Description Return the country name of the certificate. None Certificate. state\_or\_province\_name( *self* ) Description Return the state or province name of the certificate. None Certificate. locality\_name( *self* ) Description Return the locality name of the certificate. None Certificate. \_\_str\_\_( *self* ) Description Return the certificate as a string. None Certificate. \_\_eq\_\_( *self* , other: object ) Description Check if two Certificate objects are equal. None Certificate. from\_string( cls , certificate: str ) Description Create a Certificate object from a certificate. None Certificate. matches\_private\_key( *self* , private\_key: PrivateKey ) Check if this certificate matches a given private key. Arguments private\_key (PrivateKey) The private key to validate against. Returns bool True if the certificate matches the private key, False otherwise. Certificate. generate( cls , csr , ca , ca\_private\_key , validity: timedelta , is\_ca: bool ) Generate a certificate from a CSR signed by the given CA and CA private key. Arguments csr The certificate signing request. ca The CA certificate. ca\_private\_key The CA private key. validity The validity period of the certificate. is\_ca Whether the generated certificate is a CA certificate. Returns Certificate The generated certificate. Certificate. generate\_self\_signed\_ca( cls , attributes , private\_key: PrivateKey , validity: timedelta ) Generate a self-signed CA certificate. Arguments attributes The certificate request attributes. private\_key The private key to sign the CA certificate. validity The validity period of the CA certificate. Returns Certificate The generated CA certificate. Certificate. \_\_hash\_\_( *self* ) Description Return the hash of the private key. None #### class CertificateSigningRequest Description A representation of the certificate signing request. None Methods CertificateSigningRequest. \_\_init\_\_( *self* , raw , common\_name , sans\_dns , sans\_ip , sans\_oid , email\_address , organization , organizational\_unit , country\_name , state\_or\_province\_name , locality\_name , has\_unique\_identifier , x509\_object ) Initialize the CertificateSigningRequest object. Description This initializer must maintain the old interface while also allowing instantiation from an existing x509\_object. It ignores all fields other than raw and x509\_object, preferring x509\_object. CertificateSigningRequest. common\_name( *self* ) Description Return the common name of the CSR. None CertificateSigningRequest. sans\_dns( *self* ) Description Return the DNS Subject Alternative Names of the CSR. None CertificateSigningRequest. sans\_ip( *self* ) Description Return the IP Subject Alternative Names of the CSR. None CertificateSigningRequest. sans\_oid( *self* ) Description Return the OID Subject Alternative Names of the CSR. None CertificateSigningRequest. email\_address( *self* ) Description Return the email address of the CSR. None CertificateSigningRequest. organization( *self* ) Description Return the organization name of the CSR. None CertificateSigningRequest. organizational\_unit( *self* ) Description Return the organizational unit name of the CSR. None CertificateSigningRequest. country\_name( *self* ) Description Return the country name of the CSR. None CertificateSigningRequest. state\_or\_province\_name( *self* ) Description Return the state or province name of the CSR. None CertificateSigningRequest. locality\_name( *self* ) Description Return the locality name of the CSR. None CertificateSigningRequest. has\_unique\_identifier( *self* ) Description Return whether the CSR has a unique identifier. None CertificateSigningRequest. raw( *self* ) Description Return the PEM-formatted string representation of the CSR. None CertificateSigningRequest. \_\_str\_\_( *self* ) Description Return the CSR as a string. None CertificateSigningRequest. additional\_critical\_extensions( *self* ) Description Return additional critical extensions present on the CSR (excluding SAN). None CertificateSigningRequest. from\_string( cls , csr: str ) Description Create a CertificateSigningRequest object from a CSR. None CertificateSigningRequest. from\_csr( cls , csr ) Description Create a CertificateSigningRequest object from a CSR. None CertificateSigningRequest. \_\_eq\_\_( *self* , other: object ) Description Check if two CertificateSigningRequest objects are equal. None CertificateSigningRequest. \_\_hash\_\_( *self* ) Description Return the hash of the private key. None CertificateSigningRequest. matches\_certificate( *self* , certificate: Certificate ) Check if this CSR matches a given certificate. Arguments certificate (Certificate) The certificate to validate against. Returns bool True if the CSR matches the certificate, False otherwise. CertificateSigningRequest. matches\_private\_key( *self* , key: PrivateKey ) Check if a CSR matches a private key. Arguments key (PrivateKey) Private key Returns bool True/False depending on whether the CSR matches the private key. Description This function only works with RSA keys. CertificateSigningRequest. get\_sha256\_hex( *self* ) Description Calculate the hash of the provided data and return the hexadecimal representation. None CertificateSigningRequest. sign( *self* , ca: Certificate , ca\_private\_key: PrivateKey , validity: timedelta , is\_ca: bool ) Sign this CSR with the given CA and CA private key. Arguments ca The CA certificate. ca\_private\_key The CA private key. validity The validity period of the certificate. is\_ca Whether the generated certificate is a CA certificate. Returns Certificate The signed certificate. CertificateSigningRequest. generate( cls , attributes , private\_key: PrivateKey ) Generate a CSR using the supplied attributes and private key. Arguments attributes (CertificateRequestAttributes) Certificate request attributes private\_key (PrivateKey) Private key Returns CertificateSigningRequest CSR #### class CertificateRequestAttributes Description A representation of the certificate request attributes. None Methods CertificateRequestAttributes. \_\_init\_\_( *self* , common\_name , sans\_dns , sans\_ip , sans\_oid , email\_address , organization , organizational\_unit , country\_name , state\_or\_province\_name , locality\_name , is\_ca: bool , add\_unique\_id\_to\_subject\_name: bool , additional\_critical\_extensions ) CertificateRequestAttributes. common\_name( *self* ) Description Return the common name. None CertificateRequestAttributes. sans\_dns( *self* ) Description Return the DNS Subject Alternative Names. None CertificateRequestAttributes. sans\_ip( *self* ) Description Return the IP Subject Alternative Names. None CertificateRequestAttributes. sans\_oid( *self* ) Description Return the OID Subject Alternative Names. None CertificateRequestAttributes. email\_address( *self* ) Description Return the email address. None CertificateRequestAttributes. organization( *self* ) Description Return the organization name. None CertificateRequestAttributes. organizational\_unit( *self* ) Description Return the organizational unit name. None CertificateRequestAttributes. country\_name( *self* ) Description Return the country name. None CertificateRequestAttributes. state\_or\_province\_name( *self* ) Description Return the state or province name. None CertificateRequestAttributes. locality\_name( *self* ) Description Return the locality name. None CertificateRequestAttributes. is\_ca( *self* ) Description Return whether the certificate is a CA certificate. None CertificateRequestAttributes. add\_unique\_id\_to\_subject\_name( *self* ) Description Return whether to add a unique identifier to the subject name. None CertificateRequestAttributes. additional\_critical\_extensions( *self* ) Description Return additional critical extensions to be added to the CSR. None CertificateRequestAttributes. from\_csr( cls , csr: CertificateSigningRequest , is\_ca: bool ) Create CertificateRequestAttributes from a CertificateSigningRequest. Arguments csr The CSR to extract attributes from. is\_ca Whether a CA certificate is being requested. Returns CertificateRequestAttributes The extracted attributes. CertificateRequestAttributes. \_\_eq\_\_( *self* , other: object ) Description Check if two CertificateRequestAttributes objects are equal. None CertificateRequestAttributes. \_\_hash\_\_( *self* ) Description Return hash of the CertificateRequestAttributes object. None CertificateRequestAttributes. is\_valid( *self* ) Validate the attributes of the certificate request. Returns bool True if the attributes are valid, False otherwise. CertificateRequestAttributes. generate\_csr( *self* , private\_key: PrivateKey ) Generate a CSR using the current attributes and a private key. Arguments private\_key (PrivateKey) Private key to sign the CSR. Returns CertificateSigningRequest The generated CSR. #### class ProviderCertificate Description This class represents a certificate provided by the TLS provider. None Methods ProviderCertificate. to\_json( *self* ) Return the object as a JSON string. Returns str JSON representation of the object #### class RequirerCertificateRequest Description This class represents a certificate signing request requested by a specific TLS requirer. None #### class CertificateAvailableEvent Description Charm Event triggered when a TLS certificate is available. None Methods CertificateAvailableEvent. \_\_init\_\_( *self* , handle: Handle , certificate: Certificate , certificate\_signing\_request: CertificateSigningRequest , ca: Certificate , chain ) CertificateAvailableEvent. snapshot( *self* ) Description Return snapshot. None CertificateAvailableEvent. restore( *self* , snapshot: dict ) Description Restore snapshot. None CertificateAvailableEvent. chain\_as\_pem( *self* ) Description Return full certificate chain as a PEM string. None #### def generate\_private\_key(     key\_size: int,     public\_exponent: int ) Generate a private key with the RSA algorithm. Arguments key\_size (int) Key size in bits, must be at least 2048 bits public\_exponent Public exponent. Returns Private Key #### def calculate\_relative\_datetime(     target\_time: datetime,     fraction: float ) Calculate a datetime that is a given percentage from now to a target time. Arguments target\_time (datetime) The future datetime to interpolate towards. fraction (float) Fraction of the interval from now to target\_time (0.0-1.0). 1.0 means return target\_time, 0.9 means return the time after 90% of the interval has passed, and 0.0 means return now. #### def chain\_has\_valid\_order(chain) Check if the chain has a valid order. Arguments chain (List[str]) List of certificates in PEM format, ordered from leaf to root Returns True if the chain has a valid order, False otherwise. Description Validates that each certificate in the chain is properly signed by the next certificate. The chain should be ordered from leaf to root, where each certificate is signed by the next one in the chain. #### def generate\_csr(     private\_key: PrivateKey,     common\_name: str,     sans\_dns,     sans\_ip,     sans\_oid,     organization,     organizational\_unit,     email\_address,     country\_name,     locality\_name,     state\_or\_province\_name,     add\_unique\_id\_to\_subject\_name: bool ) Generate a CSR using private key and subject. Arguments private\_key (PrivateKey) Private key common\_name (str) Common name sans\_dns (FrozenSet[str]) DNS Subject Alternative Names sans\_ip (FrozenSet[str]) IP Subject Alternative Names sans\_oid (FrozenSet[str]) OID Subject Alternative Names organization (Optional[str]) Organization name organizational\_unit (Optional[str]) Organizational unit name email\_address (Optional[str]) Email address country\_name (Optional[str]) Country name state\_or\_province\_name (Optional[str]) State or province name locality\_name (Optional[str]) Locality name add\_unique\_id\_to\_subject\_name (bool) Whether a unique ID must be added to the CSR's subject name. Always leave to "True" when the CSR is used to request certificates using the tls-certificates relation. Returns CSR #### def generate\_ca(     private\_key: PrivateKey,     validity: timedelta,     common\_name: str,     sans\_dns,     sans\_ip,     sans\_oid,     organization,     organizational\_unit,     email\_address,     country\_name,     state\_or\_province\_name,     locality\_name ) Generate a self signed CA Certificate. Arguments private\_key Private key validity Certificate validity time common\_name Common Name that can be an IP or a Full Qualified Domain Name (FQDN). sans\_dns DNS Subject Alternative Names sans\_ip IP Subject Alternative Names sans\_oid OID Subject Alternative Names organization Organization name organizational\_unit Organizational unit name email\_address Email address country\_name Certificate Issuing country state\_or\_province\_name Certificate Issuing state or province locality\_name Certificate Issuing locality Returns CA Certificate. #### def generate\_certificate(     csr: CertificateSigningRequest,     ca: Certificate,     ca\_private\_key: PrivateKey,     validity: timedelta,     is\_ca: bool ) Generate a TLS certificate based on a CSR. Arguments csr (CertificateSigningRequest) CSR ca (Certificate) CA Certificate ca\_private\_key (PrivateKey) CA private key validity (timedelta) Certificate validity time is\_ca (bool) Whether the certificate is a CA certificate Returns Certificate #### class CertificatesRequirerCharmEvents Description List of events that the TLS Certificates requirer charm can leverage. None #### class TLSCertificatesRequiresV4 Description A class to manage the TLS certificates interface for a unit or app. None Methods TLSCertificatesRequiresV4. \_\_init\_\_( *self* , charm: CharmBase , relationship\_name: str , certificate\_requests , mode: Mode , refresh\_events , private\_key , renewal\_relative\_time: float ) Create a new instance of the TLSCertificatesRequiresV4 class. Arguments charm (CharmBase) The charm instance to relate to. relationship\_name (str) The name of the relation that provides the certificates. certificate\_requests (List[CertificateRequestAttributes]) A list with the attributes of the certificate requests. mode (Mode) Whether to use unit or app certificates mode. Default is Mode.UNIT. In UNIT mode the requirer will place the csr in the unit relation data. Each unit will manage its private key, certificate signing request and certificate. UNIT mode is for use cases where each unit has its own identity. If you don't know which mode to use, you likely need UNIT. In APP mode the leader unit will place the csr in the app relation databag. APP mode is for use cases where the underlying application needs the certificate for example using it as an intermediate CA to sign other certificates. The certificate can only be accessed by the leader unit. refresh\_events (List[BoundEvent]) A list of events to trigger a refresh of the certificates. private\_key (Optional[PrivateKey]) The private key to use for the certificates. If provided, it will be used instead of generating a new one. If the key is not valid an exception will be raised. Using this parameter is discouraged, having to pass around private keys manually can be a security concern. Allowing the library to generate and manage the key is the more secure approach. renewal\_relative\_time (float) The time to renew the certificate relative to its expiry. Default is 0.9, meaning 90% of the validity period. The minimum value is 0.5, meaning 50% of the validity period. If an invalid value is provided, an exception will be raised. TLSCertificatesRequiresV4. sync( *self* ) Sync TLS Certificates Relation Data. Description This method allows the requirer to sync the TLS certificates relation data without waiting for the refresh events to be triggered. TLSCertificatesRequiresV4. renew\_certificate( *self* , certificate: ProviderCertificate ) Description Request the renewal of the provided certificate. None TLSCertificatesRequiresV4. private\_key( *self* ) Description Return the private key. None TLSCertificatesRequiresV4. regenerate\_private\_key( *self* ) Regenerate the private key. Description Generate a new private key, remove old certificate requests and send new ones. TLSCertificatesRequiresV4. get\_csrs\_from\_requirer\_relation\_data( *self* ) Description Return list of requirer's CSRs from relation data. None TLSCertificatesRequiresV4. get\_provider\_certificates( *self* ) Description Return list of certificates from the provider's relation data. None TLSCertificatesRequiresV4. get\_assigned\_certificate( *self* , certificate\_request: CertificateRequestAttributes ) Description Get the certificate that was assigned to the given certificate request. None TLSCertificatesRequiresV4. get\_assigned\_certificates( *self* ) Description Get a list of certificates that were assigned to this or app. None #### class TLSCertificatesProvidesV4 Description TLS certificates provider class to be instantiated by TLS certificates providers. None Methods TLSCertificatesProvidesV4. \_\_init\_\_( *self* , charm: CharmBase , relationship\_name: str ) TLSCertificatesProvidesV4. get\_certificate\_requests( *self* , relation\_id ) Description Load certificate requests from the relation data. None TLSCertificatesProvidesV4. revoke\_all\_certificates( *self* ) Revoke all certificates of this provider. Description This method is meant to be used when the Root CA has changed. TLSCertificatesProvidesV4. set\_relation\_certificate( *self* , provider\_certificate: ProviderCertificate ) Add certificates to relation data. Arguments provider\_certificate (ProviderCertificate) ProviderCertificate object Returns None TLSCertificatesProvidesV4. get\_issued\_certificates( *self* , relation\_id ) Return a List of issued (non revoked) certificates. Returns List List of ProviderCertificate objects TLSCertificatesProvidesV4. get\_provider\_certificates( *self* , relation\_id ) Description Return a List of issued certificates. None TLSCertificatesProvidesV4. get\_unsolicited\_certificates( *self* , relation\_id ) Return provider certificates for which no certificate requests exists. Description Those certificates should be revoked. TLSCertificatesProvidesV4. get\_outstanding\_certificate\_requests( *self* , relation\_id ) Return CSR's for which no certificate has been issued. Arguments relation\_id (int) Relation id Returns list List of RequirerCertificateRequest objects.