python-trio / python-trio/trustme

Add a public API to calculate fingerprints of LeafCert instances

Open
#39 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
608
Forks
34
PR merge metrics
No merged PRs in 30d

Description

So I've been finally integrating trustme into aiohttp's test today.
Turns out that certificate fingerprint calculation isn't well-documented on the Internet for Python stdlib's ssl module. All examples use pyOpenSSL instead.
So after fighting it for a while, I've figured out that one should turn certificate into DER format as opposed to PEM (ssl.PEM_cert_to_DER_cert()), because it's what SSLSocket.getpeercert() returns and what client uses to calculate hash: https://github.com/aio-libs/aiohttp/commit/c180800a4c90dc123d05311edbec92a3a82d6317#diff-484462fced51d1a06b1d93b4a44dd535R69

Ref: https://github.com/aio-libs/aiohttp/blob/c9dabcb/aiohttp/client_reqrep.py#L105-L136

So I think it'd be nice to wrap it into a method bound to LeafCert (and maybe Blob?).
The suggested API is:

# fingerprint calc function wrapped with `lru_cache`
LeafCert.make_fingerprint(hash_function='sha256')

# @properties:
LeafCert.sha256_fingerprint
LeafCert.sha1_fingerprint
LeafCert.md5_fingerprint

Maybe fingerprint would need to be represented by its own Fingerprint class, not just some bytes.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting the existing LeafCert and Blob APIs, then compare the certificate representation with ssl.PEM_cert_to_DER_cert() and the aiohttp client_reqrep.py reference. Define the public fingerprint API and resolve whether fingerprints need their own class; done means the requested fingerprint access is available with behavior that matches the client calculation.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.