SSL follow up

[Yogesh Chawla - PD]

Hi Paul and John,
Thanks for the SSL follow up messages.

I have 2 questions. 1) How do we get the Server cert
in python. John wrote: "Nor does there seem to be a
way to get at the certificate itself from within
Python." Perhaps pycurl will allow us to do this. Is
there another method to get the server cert?

2) I like the idea of calling openssl in a subprocess.
Do you have any of those openssl commands handy? If
not, I can look through the documentation tommorrow.

Thanks!

Yogesh

[Paul Rubin]

Yogesh Chawla - PD <pr***************@yahoo.comwrites:

2) I like the idea of calling openssl in a subprocess.
Do you have any of those openssl commands handy? If
not, I can look through the documentation tommorrow.

To dump out the certificate? Try:

openssl x509 -text -in filename.crt

if the cert is in a file. Omit that -in parameter if you want openssl
to read from stdin. Of course now you get this other text format
thing to parse, but it's not so bad.

[Heikki Toivonen]

Yogesh Chawla - PD wrote:

I have 2 questions. 1) How do we get the Server cert
in python. John wrote: "Nor does there seem to be a
way to get at the certificate itself from within
Python." Perhaps pycurl will allow us to do this. Is
there another method to get the server cert?

Here's an example with M2Crypto:

from M2Crypto import SSL

ctx = SSL.Context()
conn = SSL.Connection(ctx)
conn.connect(('www.verisign.com', 443))
cert = conn.get_peer_cert()

2) I like the idea of calling openssl in a subprocess.
Do you have any of those openssl commands handy? If
not, I can look through the documentation tommorrow.

I would be surprised if M2Crypto did not provide what you want. If it
doesn't, I'd be happy to add the functionality.

--
Heikki Toivonen

[Michael Ströder]

Paul Rubin wrote:

>
To dump out the certificate? Try:

openssl x509 -text -in filename.crt

if the cert is in a file. Omit that -in parameter if you want openssl
to read from stdin. Of course now you get this other text format
thing to parse, but it's not so bad.

I wouldn't recommend that. Actually I tried one time. Use a decent
module instead which parses certs for you. I wrote one myself for web2ldap.

Ciao, Michael.