How to Mock an Ingress TLS Certificate Manager in Python

import ssl
import socket
from datetime import datetime, timedelta


class TLSCertManager:
    def __init__(self, hostname):
        self.hostname = hostname
        self.certificates = {}

    def request_certificate(self, domain, days_valid=90):
        """Mock a certificate issuance request that stores a cert with expiry."""
        expiry = datetime.now() + timedelta(days=days_valid)
        self.certificates[domain] = {
            "hostname": self.hostname,
            "issued_at": datetime.now().isoformat(),
            "expires_at": expiry.isoformat(),
            "status": "active"
        }
        return self.certificates[domain]

    def check_expiry(self, domain):
        """Check if cert expires within 30 days."""
        if domain not in self.certificates:
            return {"domain": domain, "warning": "No certificate found"}
        cert = self.certificates[domain]
        expiry = datetime.fromisoformat(cert["expires_at"])
        days_left = (expiry - datetime.now()).days
        return {
            "domain": domain,
            "days_until_expiry": days_left,
            "needs_renewal": days_left <= 30
        }

    def renew_certificate(self, domain, days_valid=90):
        """Simulate renewal by re-issuing with new expiry."""
        if domain in self.certificates:
            self.certificates[domain]["status"] = "renewed"
        return self.request_certificate(domain, days_valid)


if __name__ == "__main__":
    manager = TLSCertManager(hostname="ingress.example.com")
    cert = manager.request_certificate("api.example.com", days_valid=60)
    print("Issued cert:", cert)
    print("Expiry check:", manager.check_expiry("api.example.com"))
    renewed = manager.renew_certificate("api.example.com", days_valid=120)
    print("Renewed cert:", renewed)
    print("Final check:", manager.check_expiry("api.example.com"))