SignedJwtAssertionCredentials on AppEngine doesn't recognize PEM key

Question

SignedJwtAssertionCredentials on appengine (with pycrypto 2.6) doesn't support the PKCS12 format, therefore I'm trying to use PEM keys instead, as suggested everywhere..

this is my code:

  f = file(os.path.join(os.path.dirname(__file__), KEY_FILE), "r")
  key = f.read()
  f.close()

  credentials = SignedJwtAssertionCredentials(SERVICE_ACCOUNT_EMAIL, key,
      scope="https://www.googleapis.com/auth/drive"
  http = httplib2.Http()
  http = credentials.authorize(http)

and the KEY_FILE is a PEM key, converted with the command:

openssl pkcs12 -in privatekey.p12 -nodes -nocerts > privatekey.pem

but I still get this error, as if it didn't recognize that's a PEM key:

NotImplementedError: PKCS12 format is not supported by the PyCrpto library. 
Try converting to a "PEM" (openssl pkcs12 -in xxxxx.p12 -nodes -nocerts > privatekey.pem) or using PyOpenSSL if native code is an option.

same error if I pass just the filename to the constructor (without reading the contents of the file)

any idea?

score 17 · Accepted Answer · edited Jul 27 '14 at 02:21

17

Yeah, the error is hugely misleading. What you're doing is fine; just remove the header from the PEM file so that it begins with -----BEGIN PRIVATE KEY-----, or run the following command over it:

openssl pkcs8 -nocrypt -in privatekey.pem -passin pass:notasecret -topk8 -out pk.pem

edited Jul 27 '14 at 02:21

animuson

53,861
28
137
147

answered Aug 04 '13 at 12:14

Jaime Gómez

6,961
3
40
41

I have a similar problem and I tried your solution too but I am getting a new error. Do you have a solution? Please check [PyCrypto Errors with x.p12 file from Google Developer Console](http://stackoverflow.com/q/25571504/1443563) – gsinha Aug 29 '14 at 15:42

score 6 · Answer 2 · answered Aug 21 '13 at 13:22

6

for those interested, I ended up compiling a short tutorial on how to use the Google+ Domains APIs with python on App Engine, you can find it here: https://gist.github.com/vircheck/6292176

It's also applicable to other APIs based on service accounts, such as the Drive API etc..

answered Aug 21 '13 at 13:22

luca

12,311
15
70
103

I have a similar problem and I tried your solution too but I am getting a new error. Do you have a solution? Please check [PyCrypto Errors with x.p12 file from Google Developer Console](http://stackoverflow.com/q/25571504/1443563) – gsinha Aug 29 '14 at 15:43

SignedJwtAssertionCredentials on AppEngine doesn't recognize PEM key

2 Answers2

Linked