Root CA (offline, air-gapped)
      ↓ signs
Intermediate CA (online)
      ↓ signs
End Entity Certificate → google.com, hdfcbank.com, yourname@aadhar.com

# mini_pki_lab.py  ← Run this in lab → impress everyone
from cryptography import x509
from cryptography.x509.oid import NameOID, ExtendedKeyUsageOID
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives.serialization import Encoding, PrivateFormat, NoEncryption
from datetime import datetime, timedelta

# Step 1: Create Root CA (offline, super secure)
root_key = rsa.generate_private_key(public_exponent=65537, key_size=4096)
root_subject = x509.Name([
    x509.NameAttribute(NameOID.COUNTRY_NAME, "IN"),
    x509.NameAttribute(NameOID.ORGANIZATION_NAME, "My University CA"),
    x509.NameAttribute(NameOID.COMMON_NAME, "MyUni Root CA 2025")
])

root_cert = x509.CertificateBuilder().subject_name(root_subject)\
    .issuer_name(root_subject)\
    .public_key(root_key.public_key())\
    .serial_number(x509.random_serial_number())\
    .not_valid_before(datetime.utcnow())\
    .not_valid_after(datetime.utcnow() + timedelta(days=3650))\
    .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)\
    .sign(root_key, hashes.SHA384())

# Save Root CA
with open("myuni-root-ca.crt", "wb") as f:
    f.write(root_cert.public_bytes(Encoding.PEM))
with open("myuni-root-ca.key", "wb") as f:
    f.write(root_key.private_bytes(Encoding.PEM, PrivateFormat.PKCS8, NoEncryption()))

print("Root CA Created!")

# Step 2: Issue Server Certificate (like for college website)
server_key = rsa.generate_private_key(65537, 2048)
server_csr = x509.CertificateSigningRequestBuilder().subject_name(x509.Name([
    x509.NameAttribute(NameOID.COMMON_NAME, "portal.myuni.ac.in")
])).add_extension(
    x509.SubjectAlternativeName([x509.DNSName("portal.myuni.ac.in")]),
    critical=False,
).sign(server_key, hashes.SHA256())

server_cert = x509.CertificateBuilder()\
    .subject_name(server_csr.subject)\
    .issuer_name(root_subject)\
    .public_key(server_csr.public_key())\
    .serial_number(x509.random_serial_number())\
    .not_valid_before(datetime.utcnow())\
    .not_valid_after(datetime.utcnow() + timedelta(days=365))\
    .add_extension(x509.SubjectAlternativeName([x509.DNSName("portal.myuni.ac.in")]), critical=False)\
    .add_extension(x509.KeyUsage(digital_signature=True, key_encipherment=True, ...), critical=True)\
    .add_extension(x509.ExtendedKeyUsage([ExtendedKeyUsageOID.SERVER_AUTH]), critical=True)\
    .sign(root_key, hashes.SHA384())

# Save certificates
with open("portal.myuni.ac.in.crt", "wb") as f:
    f.write(server_cert.public_bytes(Encoding.PEM))
with open("portal.myuni.ac.in.key", "wb") as f:
    f.write(server_key.private_bytes(Encoding.PEM, PrivateFormat.PKCS8, NoEncryption()))

print("Server Certificate Issued for portal.myuni.ac.in")

# check_ssl_live.py
import ssl, socket
from cryptography import x509
from cryptography.hazmat.backends import default_backend

hostname = "google.com"

cert = ssl.get_server_certificate((hostname, 443))
cert_pem = cert.encode()
cert = x509.load_pem_x509_certificate(cert_pem, default_backend())

print("Website      :", cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value)
print("Issued by    :", cert.issuer.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value)
print("Valid till   :", cert.not_valid_after)
print("SAN          :", [san.value for san in cert.extensions.get_extension_for_class(x509.SubjectAlternativeName).value.get_values_for_type(x509.DNSName)])