import certstream
import base64

NEEDLE = "paypal"

# Search for domains with a keyword in them and write the corresponding certificate to a file
def certstream_callback(message):
    if message['message_type'] == "certificate_update":
        all_domains = message['data']['leaf_cert']['all_domains']
        if NEEDLE.lower() in " ".join(all_domains).lower():
            cn = all_domains[0]
            filename = "/tmp/{}".format(cn)

            print("Found {} in cert for {}. Writing to {}.".format(NEEDLE, cn, filename))

            with open(filename, 'w') as f:
                f.write(base64.b64decode(message['data']['leaf_cert']['as_der']))

certstream.listen_for_events(certstream_callback)