python-trio / python-trio/trustme
Add a public API to calculate fingerprints of LeafCert instances
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 608
- Forks
- 34
- PR merge metrics
- No merged PRs in 30d
Description
So I've been finally integrating trustme into aiohttp's test today.
Turns out that certificate fingerprint calculation isn't well-documented on the Internet for Python stdlib's ssl module. All examples use pyOpenSSL instead.
So after fighting it for a while, I've figured out that one should turn certificate into DER format as opposed to PEM (ssl.PEM_cert_to_DER_cert()), because it's what SSLSocket.getpeercert() returns and what client uses to calculate hash: https://github.com/aio-libs/aiohttp/commit/c180800a4c90dc123d05311edbec92a3a82d6317#diff-484462fced51d1a06b1d93b4a44dd535R69
Ref: https://github.com/aio-libs/aiohttp/blob/c9dabcb/aiohttp/client_reqrep.py#L105-L136
So I think it'd be nice to wrap it into a method bound to LeafCert (and maybe Blob?).
The suggested API is:
# fingerprint calc function wrapped with `lru_cache`
LeafCert.make_fingerprint(hash_function='sha256')
# @properties:
LeafCert.sha256_fingerprint
LeafCert.sha1_fingerprint
LeafCert.md5_fingerprint
Maybe fingerprint would need to be represented by its own Fingerprint class, not just some bytes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the existing LeafCert and Blob APIs, then compare the certificate representation with ssl.PEM_cert_to_DER_cert() and the aiohttp client_reqrep.py reference. Define the public fingerprint API and resolve whether fingerprints need their own class; done means the requested fingerprint access is available with behavior that matches the client calculation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100