Create a self signed X509 certificate in Python

Question

I followed this url to create a X509 certificate. And the code is:

from OpenSSL import crypto, SSL
from socket import gethostname
from pprint import pprint
from time import gmtime, mktime

CERT_FILE = "selfsigned.crt"
KEY_FILE = "private.key"

def create_self_signed_cert():
         
    # create a key pair
    k = crypto.PKey()
    k.generate_key(crypto.TYPE_<wbr>RSA, 1024)

    # create a self-signed cert
    cert = crypto.X509()
    cert.get_subject().C = "UK"
    cert.get_subject().ST = "London"
    cert.get_subject().L = "London"
    cert.get_subject().O = "Dummy Company Ltd"
    cert.get_subject().OU = "Dummy Company Ltd"
    cert.get_subject().CN = gethostname()
    cert.set_serial_number(1000)
    cert.gmtime_adj_notBefore(0)
    cert.gmtime_adj_notAfter(10*<wbr>365*24*60*60)
    cert.set_issuer(cert.get_<wbr>subject())
    cert.set_pubkey(k)
    cert.sign(k, 'sha1')

    open(CERT_FILE, "wt").write(
        crypto.dump_certificate(<wbr>crypto.FILETYPE_PEM, cert))
    open(KEY_FILE, "wt").write(
        crypto.dump_privatekey(crypto.<wbr>FILETYPE_PEM, k))

create_self_signed_cert()

But there is something wrong with the code when I run it. Could someone tell me what the meaning of <wbr>? There is a SyntaxError in cert.gmtime_adj_notAfter(10*<wbr>365*24*60*60). Thx.

The guide author is using to indicate places that you must modify to use the code yourself. — Andrew Domaszek, Nov 26 '14 at 04:34
You are right. Everything goes okay when I remove the ``.thx — changzhi, Nov 26 '14 at 04:39
`` is HTML tag meaning a word break is allowed here. I think the most likely answer is this is some kind of accident, somehow some blogging software/CMS/etc has malfunctioned along the way and accidentally inserted these `` HTML tags. I think that is more likely than the author intentionally putting `` (why pick that specific string?) at these rather arbitrary locations in the code to mean something. — Simon Kissane, Dec 14 '20 at 05:42

score 29 · Answer 1 · answered Mar 22 '20 at 19:42

A version which works with python3

from OpenSSL import crypto, SSL

def cert_gen(
    emailAddress="emailAddress",
    commonName="commonName",
    countryName="NT",
    localityName="localityName",
    stateOrProvinceName="stateOrProvinceName",
    organizationName="organizationName",
    organizationUnitName="organizationUnitName",
    serialNumber=0,
    validityStartInSeconds=0,
    validityEndInSeconds=10*365*24*60*60,
    KEY_FILE = "private.key",
    CERT_FILE="selfsigned.crt"):
    #can look at generated file using openssl:
    #openssl x509 -inform pem -in selfsigned.crt -noout -text
    # create a key pair
    k = crypto.PKey()
    k.generate_key(crypto.TYPE_RSA, 4096)
    # create a self-signed cert
    cert = crypto.X509()
    cert.get_subject().C = countryName
    cert.get_subject().ST = stateOrProvinceName
    cert.get_subject().L = localityName
    cert.get_subject().O = organizationName
    cert.get_subject().OU = organizationUnitName
    cert.get_subject().CN = commonName
    cert.get_subject().emailAddress = emailAddress
    cert.set_serial_number(serialNumber)
    cert.gmtime_adj_notBefore(0)
    cert.gmtime_adj_notAfter(validityEndInSeconds)
    cert.set_issuer(cert.get_subject())
    cert.set_pubkey(k)
    cert.sign(k, 'sha512')
    with open(CERT_FILE, "wt") as f:
        f.write(crypto.dump_certificate(crypto.FILETYPE_PEM, cert).decode("utf-8"))
    with open(KEY_FILE, "wt") as f:
        f.write(crypto.dump_privatekey(crypto.FILETYPE_PEM, k).decode("utf-8"))

cert_gen()

As someone getting this working for the first time, I also had to run `pip install pyOpenSSL` to ensure that I had an `OpenSSL` module to import. Thought I would add this as the pip module name required actually differed to the one you need to reference in the code — Max Carroll, Jul 28 '20 at 12:38
Works also fine with eval/exec in #maXbox4 at runtime eg.Execstring(DEF_CERTS); println('create selfsignedcert:: ') eg.Execstr('cert_gen()'); — Max Kleiner, Aug 28 '22 at 15:02

score 14 · Answer 2 · answered Nov 26 '14 at 04:39

14

Just remove <wbr>. So stupid I am.

answered Nov 26 '14 at 04:39

changzhi

2,641
9
36
46

score 7 · Answer 3 · answered Feb 21 '19 at 23:07

This is a really useful question; as the referenced link is now dead; and this is one of the first results for searching for "python create ssl certificate".

I would add to it though, that "open(xxx, "wt").write()" is asking for problems later. By not explicitly closing the file, you may find that the garbage collector hasn't run when you try to actually use the file - resulting in a failure.

it's better to use:

with open(xxx, "w") as f:
    f.write()

which will ensure that the file is closed when you're done.

Create a self signed X509 certificate in Python

3 Answers3

Linked

Related