如何在python中验证SSL证书? [英] How do I verify an SSL certificate in python?

问题描述

我需要验证证书是否由我的自定义CA签名.使用OpenSSL命令行实用程序很容易做到:

I need to verify that a certificate was signed by my custom CA. Using OpenSSL command-line utilities this is easy to do:

# Custom CA file: ca-cert.pem
# Cert signed by above CA: bob.cert
$ openssl verify -CAfile test-ca-cert.pem bob.cert
bob.cert: OK

但是我需要在Python中做同样的事情，而且我真的不想调出命令行实用程序.据我所知，M2Crypto是OpenSSL的最完整"的python包装器，但是我不知道如何完成命令行实用程序的工作！

But I need to do the same thing in Python, and I really don't want to call out to command-line utilities. As far as I'm aware, M2Crypto is the "most complete" python wrapper for OpenSSL, but I can't figure out how to accomplish what the command-line utility does!

有关如何在C代码中完成相同任务的问题，请参考此问题 ，我已经成功了一半. 我选择的变量名称与openssl verify命令行实用程序的源代码中使用的变量名称相同，请参见openssl-xxx/apps/verify.c.

Referencing this question for how to accomplish this same task in C code, I've been able to get about half-way. The variable names I chose are the same ones used in the source code for the openssl verify command-line utility, see openssl-xxx/apps/verify.c.

import M2Crypto as m2
# Load the certificates
cacert = m2.X509.load_cert('test-ca-cert.pem')   # Create cert object from CA cert file
bobcert = m2.X509.load_cert('bob.cert')     # Create cert object from Bob's cert file
cert_ctx = m2.X509.X509_Store()             # Step 1 from referenced C code steps
csc = m2.X509.X509_Store_Context(cert_ctx)  # Step 2 & 5
cert_ctx.add_cert(cacert)                   # Step 3
cert_ctx.add_cert(bobcert)                  # ditto
# Skip step 4 (no CRLs to add)
# Step 5 is combined with step 2...I think. (X509_STORE_CTX_init: Python creates and 
#   initialises an object in the same step)
# Skip step 6? (can't find anything corresponding to 
#   X509_STORE_CTX_set_purpose, not sure if we need to anyway???)
# 
# It all falls apart at this point, as steps 7 and 8 don't have any corresponding
# functions in M2Crypto -- I even grepped the entire source code of M2Crypto, and
# neither of the following functions are present in it:
# Step 7: X509_STORE_CTX_set_cert - Tell the context which certificate to validate.
# Step 8: X509_verify_cert - Finally, validate it

所以我已经到一半了，但是我似乎无法真正完成验证！我想念什么吗?我应该从M2Crypto使用其他功能吗?我是否应该寻找OpenSSL的完全不同的python包装器?我该如何在python中完成此任务！?！?

So I'm halfway there, but I can't seem to actually get the validation done! Am I missing something? Is there some other function I should be using from M2Crypto? Should I be looking for a completely different python wrapper of OpenSSL? How can I accomplish this task in python!?!?

请注意，我正在使用证书来加密/解密文件，因此，我对使用基于SSL连接的对等证书验证(具有

Note that I'm using certificates to encrypt/decrypt FILES, so I'm not interested in using the SSL-connection-based peer certificate verification (which has already been answered), because I don't have any SSL connections going.

推荐答案

您不能使用普通的M2Crypto进行此操作，因为它没有包装某些必需的功能.好消息是，如果您安装了SWIG，则可以自己包装它们并与M2Crypto代码一起使用.前一段时间，我为自己创建了一个带有一些额外功能的模块，并决定立即发布，因为它进行了这种验证.您可以在此处进行检查: https://github.com/abbot/m2ext .这是一个如何使用此模块验证证书的示例:

You can't do this with plain M2Crypto, since it does not wrap some of the required functions. Good news is if you have SWIG installed you can wrap those yourself and use with M2Crypto code. I've made a module with some extra functions for myself some time ago, and decided to publish it now, since it does this kind of validation. You can check it here: https://github.com/abbot/m2ext. This is an example how to validate a certificate using this module:

import sys
from m2ext import SSL
from M2Crypto import X509

print "Validating certificate %s using CApath %s" % (sys.argv[1], sys.argv[2])
cert = X509.load_cert(sys.argv[1])
ctx = SSL.Context()
ctx.load_verify_locations(capath=sys.argv[2])
if ctx.validate_certificate(cert):
    print "valid"
else:
    print "invalid"

不幸的是，M2Crypto的开发似乎停滞不前(在过去的两年中，错误跟踪器中没有封闭的问题)，维护人员忽略了带有这些补丁和其他补丁的我的错误和电子邮件...

Unfortunately M2Crypto development seems to be stagnant (no closed issues in bug tracker for the last two years) and the maintainer was ignoring my bugs and emails with these and some other patches...

这篇关于如何在python中验证SSL证书?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！