crypto — Generic cryptographic module¶
Elliptic curves¶
- OpenSSL.crypto.get_elliptic_curves()¶
Return a set of objects representing the elliptic curves supported in the OpenSSL build in use.
The curve objects have a unicode name attribute by which they identify themselves.
The curve objects are useful as values for the argument accepted by Context.set_tmp_ecdh() to specify which elliptical curve should be used for ECDHE key exchange.
- OpenSSL.crypto.get_elliptic_curve(name)¶
Return a single curve object selected by name.
See get_elliptic_curves() for information about curve objects.
If the named curve is not supported then ValueError is raised.
Serialization and deserialization¶
The following serialization functions take one of these constants to determine the format.
- OpenSSL.crypto.FILETYPE_PEM¶
FILETYPE_PEM serializes data to a Base64-encoded encoded representation of the underlying ASN.1 data structure. This representation includes delimiters that define what data structure is contained within the Base64-encoded block: for example, for a certificate, the delimiters are -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.
- OpenSSL.crypto.FILETYPE_ASN1¶
FILETYPE_ASN1 serializes data to the underlying ASN.1 data structure. The format used by FILETYPE_ASN1 is also sometimes referred to as DER.
Certificates¶
- OpenSSL.crypto.dump_certificate(type, cert)¶
Dump the certificate cert into a buffer string encoded with the type type.
- OpenSSL.crypto.load_certificate(type, buffer)¶
Load a certificate (X509) from the string buffer encoded with the type type.
Certificate signing requests¶
- OpenSSL.crypto.dump_certificate_request(type, req)¶
Dump the certificate request req into a buffer string encoded with the type type.
- OpenSSL.crypto.load_certificate_request(type, buffer)¶
Load a certificate request (X509Req) from the string buffer encoded with the type type.
Private keys¶
- OpenSSL.crypto.load_privatekey(type, buffer[, passphrase])¶
Load a private key (PKey) from the string buffer encoded with the type type (must be one of FILETYPE_PEM and FILETYPE_ASN1).
passphrase must be either a string or a callback for providing the pass phrase.
Public keys¶
Certificate revocation lists¶
- OpenSSL.crypto.load_crl(type, buffer)¶
Load Certificate Revocation List (CRL) data from a string buffer. buffer encoded with the type type. The type type must either FILETYPE_PEM or FILETYPE_ASN1).
- OpenSSL.crypto.load_pkcs7_data(type, buffer)¶
Load pkcs7 data from the string buffer encoded with the type type. The type type must either FILETYPE_PEM or FILETYPE_ASN1).
- OpenSSL.crypto.load_pkcs12(buffer[, passphrase])¶
Load pkcs12 data from the string buffer. If the pkcs12 structure is encrypted, a passphrase must be included. The MAC is always checked and thus required.
See also the man page for the C function PKCS12_parse().
Signing and verifying signatures¶
- OpenSSL.crypto.sign(key, data, digest)¶
Sign a data string using the given key and message digest.
key is a PKey instance. data is a str instance. digest is a str naming a supported message digest type, for example b"sha256".
New in version 0.11.
- OpenSSL.crypto.verify(certificate, signature, data, digest)¶
Verify the signature for a data string.
certificate is a X509 instance corresponding to the private key which generated the signature. signature is a str instance giving the signature itself. data is a str instance giving the data to which the signature applies. digest is a str instance naming the message digest type of the signature, for example b"sha256".
New in version 0.11.
X509 objects¶
X509Name objects¶
X509Req objects¶
X509Store objects¶
X509StoreContextError objects¶
X509StoreContext objects¶
X509StoreFlags constants¶
PKCS7 objects¶
PKCS7 objects have the following methods:
- PKCS7.type_is_signed()¶
FIXME
- PKCS7.type_is_enveloped()¶
FIXME
- PKCS7.type_is_signedAndEnveloped()¶
FIXME
- PKCS7.type_is_data()¶
FIXME
- PKCS7.get_type_name()¶
Get the type name of the PKCS7.
PKCS12 objects¶
X509Extension objects¶
NetscapeSPKI objects¶
CRL objects¶
Revoked objects¶
Digest names¶
Several of the functions and methods in this module take a digest name. These must be strings describing a digest algorithm supported by OpenSSL (by EVP_get_digestbyname, specifically). For example, b"sha256" or b"sha384".
More information and a list of these digest names can be found in the EVP_DigestInit(3) man page of your OpenSSL installation. This page can be found online for the latest version of OpenSSL: https://www.openssl.org/docs/manmaster/crypto/EVP_DigestInit.html
Backwards compatible type names¶
When pyOpenSSL was originally written, the most current version of Python was 2.1. It made a distinction between classes and types. None of the versions of Python currently supported by pyOpenSSL still enforce that distinction: the type of an instance of an X509 object is now simply X509. Originally, the type would have been X509Type. These days, X509Type and X509 are literally the same object. pyOpenSSL maintains these old names for backwards compatibility.
Here’s a table of these backwards-compatible names:
Type name | Backwards-compatible name |
---|---|
X509 | X509Type |
X509Name | X509NameType |
X509Req | X509ReqType |
X509Store | X509StoreType |
X509Extension | X509ExtensionType |
PKey | PKeyType |
PKCS7 | PKCS7Type |
PKCS12 | PKCS12Type |
NetscapeSPKI | NetscapeSPKIType |
CRL | CRLType |
Some objects, such as Revoked, don’t have Type equivalents, because they were added after the restriction had been lifted.