How to verify certificate signature in pyOpenSSL?

Question

I have two certificates, a root.crt that was used to sign client.crt.

I want to verify that the client.crt was indeed signed by root.key.

Using openssl on terminal, it works like this:

$ openssl verify -CAfile root.crt client.crt  
> client.crt: OK

However using pyOpenSSL - following the documentation and this blog post - I tried something like this:

client_cert = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, file('client.crt').read())

root_cert = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, file('root.crt').read())  

store = OpenSSL.crypto.X509Store()  
store.add_cert(root_cert)  

ctx = OpenSSL.crypto.X509StoreContext(store, client_cert)
ctx.verify_certificate()

I get this error:

    > X509StoreContextError: [2, 1, 'unable to get issuer certificate']

What am I missing?

joaoricardo000 · Accepted Answer · 2020-06-12 17:01:39Z

4

The issue is that my root.crt is not really root, but a chain of certificates:

-----BEGIN CERTIFICATE----- 
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE----- 
...
-----END CERTIFICATE-----

And OpenSSL.crypto.load_certificate just loads the first one.

The solution is to extract all certificates in the chain file and add them to the X509Store.

The code solution looks like this:

_PEM_RE = re.compile(b'-----BEGIN CERTIFICATE-----\r?.+?\r?-----END CERTIFICATE-----\r?\n?', re.DOTALL)


def parse_chain(chain):
    # returns a list of certificates
    return [c.group() for c in _PEM_RE.finditer(chain)]


client_cert = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, file('server.crt').read())

store = OpenSSL.crypto.X509Store()
for cert in parse_chain(file('root.crt').read()):
    store.add_cert(OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, cert))

ctx = OpenSSL.crypto.X509StoreContext(store, client_cert)
ctx.verify_certificate()

Adapted from https://github.com/hynek/pem/blob/master/src/pem/_core.py#L115

edited Jun 12, 2020 at 17:01

answered Oct 3, 2017 at 22:28

joaoricardo000

4,9894 gold badges28 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Bogota Over a year ago

May I know what is cr in the store.add_cert command?

joaoricardo000 Over a year ago

Updated the code sample, it was a typo. Thanks for noticing!

Collectives™ on Stack Overflow

How to verify certificate signature in pyOpenSSL?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related