PyOpenSSL throws error loading a certificate

Question

I have the following code

key = OpenSSL.crypto.PKey()
key.generate_key(OpenSSL.crypto.TYPE_RSA, 1024)
cert = OpenSSL.crypto.X509()
cert.set_pubkey(key)
cert.sign(key, 'sha1')
public_key =  OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_PEM, cert)
cert2 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, public_key)

the last line throws the following error, that is strange because nowhere I'm uding ASN1

OpenSSL.crypto.Error: [('asn1 encoding routines', 'ASN1_get_object', 'too long'), ('asn1 encoding routines', 'ASN1_CHECK_TLEN', 'bad object header'), ('asn1 encoding routines', 'ASN1_ITEM_EX_D2I', 'nested asn1 error'), ('asn1 encoding routines', 'ASN1_TEMPLATE_NOEXP_D2I', 'nested asn1 error'), ('asn1 encoding routines', 'ASN1_TEMPLATE_NOEXP_D2I', 'nested asn1 error'), ('asn1 encoding routines', 'ASN1_TEMPLATE_NOEXP_D2I', 'nested asn1 error'), ('PEM routines', 'PEM_ASN1_read_bio', 'ASN1 lib')]

this is the content of public_key

What causes it?

X.509 certificates are encoded in ASN.1 DER (the DER-encoded value is occasionally wrapped in PEM encoding, which is base64 with begin/end lines), which is why you're getting an error from the ASN.1 parsing code. An "object too long" error usually means that you've given it invalid input, though, and it has read a garbled length field which extends past the end of the input. — Wim Lewis
– Wim Lewis, Commented Sep 4, 2015 at 0:28

viraptor · Accepted Answer · 2015-09-04 01:58:44Z

4

You're actually producing an invalid certificate with dump_certificate. Openssl should error out, or pyopenssl should check it, but either way - it's a bug.

This is just a guess, but likely it fails because of some required fields missing: serial number, validity, subject, issuer. Try setting those.

If you have time, report this snippet as a bug to pyopenssl too - you should never get bad PEM from it in the first place.

answered Sep 4, 2015 at 1:58

viraptor

34.4k13 gold badges116 silver badges204 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

MikeyE Over a year ago

I was having the exact same problem, generating the exact same error. This solution worked for me!

Pekka Lehtikoski Over a year ago

Same here, thank you for the solution. I was missing validity.

Collectives™ on Stack Overflow

PyOpenSSL throws error loading a certificate

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related