The patch implements an add_cert(pem_or_der_data) method for the ssl.SSLContext() object. On success the method adds a trusted CA cert to the context's internal cert store. The CA certificate can either be an ASCII unicode string (PEM format) or buffer object (DER / ASN1 format).

The patch also implements a get_cert_count() method for debugging. I'm going to remove that function eventually as it doesn't give correct answers when the object table contains CRLs, too. A correct implementation might be useful to verify set_default_verify_paths().

I've split up the functions so I can re-use _add_cert() in my upcoming patch for an interface to crypt32.dll on Windows.

New patch:

• rename function to add_ca_cert()
• only accept CA certs, no other certs
• raise an error if extra data is found after cert (e.g. two certs). PEM_read_bio_X509() silently ignores extra data
• fixes from Ezio's code review
• documentation

Here is a simplified version of the C function. It uses y* or es# "ascii" to parse the argument.

The check for trailing data ensures that the user gets an error message if she tries to load a PEM string with multiple certs. She might expect that add_ca_cert(pem) loads all PEM certs from the string while in fact PEM_read_bio_X509() only loads the first cert. The new patch make the check optional.

I still need to find a good name for the option, though...

The check for trailing data ensures that the user gets an error
message if she tries to load a PEM string with multiple certs. She
might expect that add_ca_cert(pem) loads all PEM certs from the
string while in fact PEM_read_bio_X509() only loads the first cert.

I don't think it is useful. Just make the behaviour well-documented.
(there is no security risk in loading too few CA certs)

I'm pondering about the error case "cert already in hash table". There should be a way to distinguish the error from other errors. I see three ways to handle the case:

1. introduce SSLCertInStoreError exeption
2. ignore the error and do nothing
3. ignore the error and return True if a cert was added or False if the cert is already in the store

I like 3).

Le mardi 18 juin 2013 à 17:30 +0000, Christian Heimes a écrit :

Christian Heimes added the comment:

I'm pondering about the error case "cert already in hash table". There
should be a way to distinguish the error from other errors.

I don't know if you've seen it, but SSLError has "library" and "reason"
attributes (they are little known). See SSLErrorTests.

I see three ways to handle the case:

1. introduce SSLCertInStoreError exeption
2. ignore the error and do nothing
3. ignore the error and return True if a cert was added or False if
   the cert is already in the store

I like 3).

Yes, sounds reasonable.

Yes, I have seen them. In fact OpenSSL has library, function and reason.

if ((ERR_GET_LIB(errcode) == ERR_LIB_X509) &&
(ERR_GET_REASON(errcode) == X509_R_CERT_ALREADY_IN_HASH_TABLE)) {}

I'm going for 3)

I think the patch in bpo-16487 does too many things at once. The new patch is a draft for a new patch that adds SSLContext.load_verify_locations(cadata) to the SSL module. cadata can be a bunch of PEM encoded certs (ASCII) or DER encoded certs (bytes-like). The patch may contain bugs as I haven't verified all error paths yet.

Final patch

New changeset 234e3c8dc52f by Christian Heimes in branch 'default':
Issue bpo-18138: Implement cadata argument of SSLContext.load_verify_location()
http://hg.python.org/cpython/rev/234e3c8dc52f

Memo to me: update whatsnew

New changeset 8e3b3b4a90fb by R David Murray in branch 'default':
whatsnew: SSLcontext.load_verify_locations cadata argument (bpo-18138)
http://hg.python.org/cpython/rev/8e3b3b4a90fb