Generating a CSR in Python

Question

I'm trying to generate a CSR in Python without using OpenSSL. If someone could point in the right direction, I'd be very grateful.

Are you not able to use any toolkit, or just OpenSSL? PKCS#10 (cert request format) is fairly simple if you have access to an ASN.1 encoder. — Shawn D., Jul 16 '10 at 04:28

score 4 · Answer 1 · answered Nov 01 '15 at 17:46

I assume you don't want to use the command line openssl itself and a Python lib is ok.

Here is an helper function I wrote to create a CSR. It returns the private key from the generated key pair and the CSR. The function depends on pyOpenSSL.crypto.

def create_csr(self, common_name, country=None, state=None, city=None,
               organization=None, organizational_unit=None,
               email_address=None):
    """
    Args:
        common_name (str).

        country (str).

        state (str).

        city (str).

        organization (str).

        organizational_unit (str).

        email_address (str).

    Returns:
        (str, str).  Tuple containing private key and certificate
        signing request (PEM).
    """
    key = OpenSSL.crypto.PKey()
    key.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)

    req = OpenSSL.crypto.X509Req()
    req.get_subject().CN = common_name
    if country:
        req.get_subject().C = country
    if state:
        req.get_subject().ST = state
    if city:
        req.get_subject().L = city
    if organization:
        req.get_subject().O = organization
    if organizational_unit:
        req.get_subject().OU = organizational_unit
    if email_address:
        req.get_subject().emailAddress = email_address

    req.set_pubkey(key)
    req.sign(key, 'sha256')

    private_key = OpenSSL.crypto.dump_privatekey(
        OpenSSL.crypto.FILETYPE_PEM, key)

    csr = OpenSSL.crypto.dump_certificate_request(
               OpenSSL.crypto.FILETYPE_PEM, req)

    return private_key, csr

score 1 · Answer 2 · answered Aug 10 '10 at 15:43

m2crypto could be a solution (see CreateX509Request in the contrib example), although it relies OpenSSL.

You could also use python-nss, which uses Mozilla's NSS library. nss.nss.CertificateRequest was added quite recently. The API documentation available at the moment on the website isn't up to date, but here are some pointers for newer versions:

It's also in CVS:

:pserver:anonymous@cvs-mirror.mozilla.org:/cvsroot/mozilla/security/python/nss

score -6 · Answer 3 · edited Oct 07 '21 at 06:11

Like any language, Python just implements algorithms. I know next to nothing about cryptography, but if I had to implement this in Python, I would look for a specification on how to implement CSR.

Via Google and Wikipedia I found this RFC. Your task would be to implement this in Python.

Personally I'd probably first try to use a the command line tool (perhaps via a call to the system() function if it needed to be from Python).

Generating a CSR in Python

3 Answers3

Linked