Geniwrapper uses two crypto libraries: pyOpenSSL and M2Crypto to implement the necessary crypto functionality. Ideally just one of these libraries would be used, but unfortunately each of these libraries is independently lacking. The pyOpenSSL library is missing many necessary functions, and the M2Crypto library has crashed inside of some of the functions. The design decision is to use pyOpenSSL whenever possible as it seems more stable, and only use M2Crypto for those functions that are not possible in pyOpenSSL. This module exports two classes: Keypair and Certificate.
The certificate class implements a general purpose X509 certificate, making use of the appropriate pyOpenSSL or M2Crypto abstractions.
For more information about this class, see The Certificate Class.
Public-private key pairs are implemented by the Keypair class.
For more information about this class, see The Keypair Class.
The certificate class implements a general purpose X509 certificate, making use of the appropriate pyOpenSSL or M2Crypto abstractions. It also adds several addition features, such as the ability to maintain a chain of parent certificates, and storage of application-specific data. Certificates include the ability to maintain a chain of parents. Each certificate includes a pointer to it's parent certificate. When loaded from a file or a string, the parent chain will be automatically loaded. When saving a certificate to a file or a string, the caller can choose whether to save the parent certificates as well.
Create a certificate object.
Add an X509 extension to the certificate. Add_extension can only be called once for a particular extension name, due to limitations in the underlying library.
Create a blank X509 certificate and store it in this object.
Return the data string that was previously set with set_data
Get an X509 extension from the certificate
Get the issuer name
Return the certificate object of the parent of this certificate.
Get the public key of the certificate. It is returned in the form of a Keypair object.
Get the subject name of the certificate
Return True if pkey is identical to the public key that is contained in the certificate.
Given a certificate cert, verify that this certificate was signed by the public key contained in cert. Throw an exception otherwise.
Load the certificate from a file
Given a pyOpenSSL X509 object, store that object inside of this certificate object.
Load the certificate from a string
Save the certificate to a file.
Save the certificate to a string.
Set_data is a wrapper around add_extension. It stores the parameter str in the X509 subject_alt_name extension. Set_data can only be called once, due to limitations in the underlying library.
Sets the issuer private key and name
Set the parent certificate.
Get the public key of the certificate.
Set the subject name of the certificate
Sign the certificate using the issuer private key and issuer subject previous set with set_issuer().
Verify the authenticity of a certificate.
Verification examines a chain of certificates to ensure that each parent signs the child, and that some certificate in the chain is signed by a trusted certificate. Verification is a basic recursion:
if this_certificate was signed by trusted_certs:
return
else
return verify_chain(parent, trusted_certs)
At each recursion, the parent is tested to ensure that it did sign the
child. If a parent did not sign a child, then an exception is thrown. If
the bottom of the recursion is reached and the certificate does not match
a trusted root, then an exception is thrown.
Public-private key pairs are implemented by the Keypair class. A Keypair object may represent both a public and private key pair, or it may represent only a public key (this usage is consistent with OpenSSL).
Creates a Keypair object
Return the private key in PEM format.
Create a RSA public/private key pair and store it inside the keypair object
Return an OpenSSL pkey object
Given another Keypair object, return TRUE if the two keys are the same.
Load the private key from a file. Implicity the private key includes the public key.
Load the private key from a string. Implicitly the private key includes the public key.
Load the public key from a string. No private key is loaded.
Load the public key from a string. No private key is loaded.
Save the private key to a file