pki-tools 0.0.2

PKI tools for e.g. checking certificate CRL/OCSP revocation

pki-tools

PKI tools exposes a high level cryptography API for e.g.:

• checking revocation of certificates:
  • using CRL defined in the x509 CRL distribution points extension (https://datatracker.ietf.org/doc/html/rfc5280.html#section-4.2.1.13)
  • using OCSP defined in the x509 Authority Information Access extension (https://datatracker.ietf.org/doc/html/rfc5280.html#section-4.2.2.1)
• loading certificates

Installation

pip install pki-tools

Usage

CRL

Checking revocation using PEM encoded certificate

from pki_tools.crl import check_revoked, Revoked, Error

cert_pem = """
-----BEGIN CERTIFICATE-----
<CERTIFICATE_PEM_BYTES>
-----END CERTIFICATE-----
"""

try:
    check_revoked(cert_pem)
except Revoked as e:
    print(f"Certificate revoked: {e}")
except Error as e:
    print(f"Revocation check failed. Error: {e}")
    raise

Checking revocation using an already loaded cryptography x509.Certificate:

from cryptography import x509
from pki_tools.ocsp import check_revoked_crypto_cert, Revoked, Error

cert : x509.Certificate = ...
issuer: x509.Certificate = ...

try:
    check_revoked_crypto_cert(cert, issuer)
except Revoked as e:
    print(f"Certificate revoked: {e}")
except Error as e:
    print(f"Revocation check failed. Error: {e}")
    raise

OCSP

Checking revocation using PEM encoded certificate

from pki_tools.ocsp import check_revoked, Revoked, Error

cert_pem = """
-----BEGIN CERTIFICATE-----
<CERTIFICATE_PEM_BYTES>
-----END CERTIFICATE-----
"""

issuer_pem = """
-----BEGIN CERTIFICATE-----
<ISSUER_PEM_BYTES>
-----END CERTIFICATE-----
"""

try:
    check_revoked(cert_pem, issuer_pem)
except Revoked as e:
    print(f"Certificate revoked: {e}")
except Error as e:
    print(f"Revocation check failed. Error: {e}")
    raise

Checking revocation using an already loaded cryptography x509.Certificate:

from cryptography import x509
from pki_tools.ocsp import check_revoked_crypto_cert, Revoked, Error

cert : x509.Certificate = ...
issuer_cert : x509.Certificate = ...

try:
    check_revoked_crypto_cert(cert, issuer_cert)
except Revoked as e:
    print(f"Certificate revoked: {e}")
except Error as e:
    print(f"Revocation check failed. Error: {e}")
    raise