Parse and split PEM files painlessly.
Project description
pem: Easy PEM file parsing
pem is an MIT-licensed Python module for parsing and splitting of PEM files, i.e. Base64 encoded DER keys and certificates.
It runs on Python 2.6, 2.7, 3.3, and PyPy 2.0+, has no dependencies and does not attempt to interpret the certificate data in any way. pem is intended to ease the handling of PEM files in combination with PyOpenSSL and – by extension – Twisted.
It’s born from my personal need because of the inconsistent handling of chain certificates by various servers: some servers (like Apache) expect them to be a separate file while others (like nginx) expect them concatenated to the server certificate. Since I want my Python software to be universal and to be able to cope with both, pem was born.
The core API call is the function parse():
import pem
with open('cert.pem', 'rb') as f:
certs = pem.parse(f.read())The function returns a list of valid PEM objects found in the string supplied. Currently possible types are DHParameters, Certificate, and RSAPrivateKey. Both can be transformed using str() into plain strings for other APIs. They don’t offer any other public API at the moment.
Convenience
Since pem is mostly a convenience module, there are several helper functions.
Files
parse_file(file_name) reads the file file_name and parses its contents. So the following example is equivalent with the first one:
import pem
certs = pem.parse_file('cert.pem')Twisted
A typical use case in Twisted with the APIs above would be:
import pem
from twisted.internet import ssl
key = pem.parse_file('key.pem')
cert, chain = pem.parse_file('cert_and_chain.pem')
cert = ssl.PrivateCertificate.loadPEM(str(key) + str(cert))
chainCert = ssl.Certificate.loadPEM(str(chain))
ctxFactory = ssl.CertificateOptions(
privateKey=cert.privateKey.original,
certificate=cert.original,
extraCertChain=[chainCert.original],
)Turns out, this is the major use case for me. Therefore it can be simplified to:
import pem
ctxFactory = pem.certificateOptionsFromFiles(
'key.pem', 'cert_and_chain.pem',
)The first certificate found will be used as the server certificate, the rest is passed as the chain. You can pass as many PEM files as you like. Therefore you can distribute your key, certificate, and chain certificates over a arbitrary number of files. A ValueError is raised if more than one key, no key, or no certificate are found. Any further keyword arguments will be passed to CertificateOptions.
If you want to load your PEM data from somewhere else, you can also use certificateOptionsFromPEMs to do the same thing with already-loaded Certificate, Key, and RSAPrivateKey objects, like so:
import pem
myPems = []
pems = pem.parse("""\
-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
""")
ctxFactory = pem.certificateOptionsFromPEMs(pems)Ephemeral Diffie-Hellman support
Starting with version 14.0.0, Twisted will support ephemeral Diffie-Hellman ciphersuites; you can pass an instance of twisted.internet.ssl.DiffieHellmanParameters as the dhParameters keyword argument to CertificateOptions. Since pem just passes keyword arguments to CertificateOptions verbatim, that will just work.
However, pem is also forward compatible. Twisted 14.0.0 is not released yet, but pem lets you use the API described above anyway. You can just use pem.DiffieHellmanParameters: if your version of Twisted comes with that class, you just get the Twisted version; if it doesn’t, you get a version from pem.
Just pass instances of that class as dhParameters to certificateOptionsFromFiles, and pem will make it magically work:
import pem
from twisted.python.filepath import FilePath
path = FilePath("/path/to/the/dh/params")
ctxFactory = pem.certificateOptionsFromFiles(
'key.pem', 'cert_and_chain.pem',
dhParameters=pem.DiffieHellmanParameters.fromFile(path)
)Future
pem currently only supports the PyOpenSSL/Twisted combo because that’s what I’m using. I’d be more than happy to merge support for additional frameworks though!
History
0.3.0 (2014-04-15)
Load PEM files as UTF-8 to allow for non-ASCII comments (like in certifi).
Allow keys, primary certificates, and chain certificates to occur in any order.
0.2.0 (2014-03-13)
Add forward-compatible support for DHE.
0.1.0 (2013-07-18)
Initial release.
Credits
“pem” is written and maintained by Hynek Schlawack.
Contributors
The following wonderful people contributed directly or indirectly to this project:
Please add yourself here alphabetically when you submit your first pull request.
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file pem-0.3.0.tar.gz.
File metadata
- Download URL: pem-0.3.0.tar.gz
- Upload date:
- Size: 11.7 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 1563ef54839ecd740c0982883c780f19d336ab6ccb5a2d50b85bc9cd82d0e099 |
|
| MD5 | 116eb62acafb1a12c608b8e9857c584a |
|
| BLAKE2b-256 | 4a125fc47938bf25c9caeed11dbb333d9f4226e2745d687ee7ca43bfd1b5336f |
File details
Details for the file pem-0.3.0-py2.py3-none-any.whl.
File metadata
- Download URL: pem-0.3.0-py2.py3-none-any.whl
- Upload date:
- Size: 23.7 kB
- Tags: Python 2, Python 3
- Uploaded using Trusted Publishing? No
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | ada3336d8c50801b393693979e5837ac086887d89b54ba0bc06fc9c39958187c |
|
| MD5 | 8d3422f71f78bbc627d9b629763f767a |
|
| BLAKE2b-256 | d9cf89cc165c5f6a598f5a920908fb476546fab0489b50a105550464323ea867 |
