python openssl x509 CA

[Marcin Jurczuk]

Hello,
I'm fighting with Certificate Authority functionality with python
I stuck on following problem: How to sign CSR using CA key and write
resulted certificate.

You can do it using following openssl cmd:
openssl ca -cert CA/cert.pem -keyfile CA/private/cakey.pem -policy
policy_anything -out user_cert.pem -infiles userreq.pem

My try was:
import OpenSSL.crypto as pki
#load CA key:
ca_key=pki.load _privatekey(pki .FILETYPE_PEM,o pen('CA/private/
cakey.pem').rea d(),'haselko')
#load user's csr:
csr=pki.load_ce rtificate_reque st(pki.FILETYPE _PEM,open('user req.pem').read( ))
# sign csr
csr.sign(ca_key ,'sha1')
I don't get any erorrs however I dont' see any way to write or get
result from such operation
csr exports following methods:
csr.add_extensi ons csr.get_pubkey csr.get_subject
csr.set_pubkey csr.sign csr.verify

I want to create pure python implementation without use of openssl
wrapped with python code.

Regards,

[M.-A. Lemburg]

On 2008-10-31 11:10, Marcin Jurczuk wrote:

Hello,
I'm fighting with Certificate Authority functionality with python
I stuck on following problem: How to sign CSR using CA key and write
resulted certificate.

You can do it using following openssl cmd:
openssl ca -cert CA/cert.pem -keyfile CA/private/cakey.pem -policy
policy_anything -out user_cert.pem -infiles userreq.pem

My try was:
import OpenSSL.crypto as pki
#load CA key:
ca_key=pki.load _privatekey(pki .FILETYPE_PEM,o pen('CA/private/
cakey.pem').rea d(),'haselko')
#load user's csr:
csr=pki.load_ce rtificate_reque st(pki.FILETYPE _PEM,open('user req.pem').read( ))
# sign csr
csr.sign(ca_key ,'sha1')
I don't get any erorrs however I dont' see any way to write or get
result from such operation
csr exports following methods:
csr.add_extensi ons csr.get_pubkey csr.get_subject
csr.set_pubkey csr.sign csr.verify

You need to use crypto.dump_cer tificate() to dump and then
write the certificate back to disk.

BTW: There's a good example in the pyOpenSSL examples dir
for these things:

http://svn.dave.cridland.net/svn/pro...les/certgen.py
http://svn.dave.cridland.net/svn/pro...imple_certs.py

I want to create pure python implementation without use of openssl
wrapped with python code.

Good luck with that :-)

--
Marc-Andre Lemburg
eGenix.com

Professional Python Services directly from the Source (#1, Oct 31 2008)

>>Python/Zope Consulting and Support ... http://www.egenix.com/
mxODBC.Zope.D atabase.Adapter ... http://zope.egenix.com/
mxODBC, mxDateTime, mxTextTools ... http://python.egenix.com/

_______________ _______________ _______________ _______________ ____________

:::: Try mxODBC.Zope.DA for Windows,Linux,S olaris,MacOSX for free ! ::::
eGenix.com Software, Skills and Services GmbH Pastor-Loeh-Str.48
D-40764 Langenfeld, Germany. CEO Dipl.-Math. Marc-Andre Lemburg
Registered at Amtsgericht Duesseldorf: HRB 46611

[Paul Rubin]

Marcin Jurczuk <mj******@gmail .comwrites:

I want to create pure python implementation without use of openssl
wrapped with python code.

There was a CA written in Python quite a while back, http://pyca.de .
I don't know if it's maintained these days.

[=?ISO-8859-1?Q?Michael_Str=F6der?=]

Paul Rubin wrote:

Marcin Jurczuk <mj******@gmail .comwrites:

>I want to create pure python implementation without use of openssl
wrapped with python code.

There was a CA written in Python quite a while back, http://pyca.de .

That was the usual approach with invoking the openssl command-line tool
from Python. Today I'd do *everything* differently. Well, it was the
result of learning Python, PKI, LDAP and web programming all at once
back then.

I don't know if it's maintained these days.

No, it's not. Being the author I know this for sure. ;-)

Ciao, Michael.