Python requests CA certificates as a string
There is a way to do it via temp files, like this:
cert = tempfile.NamedTemporaryFile(delete=False)
cert.write(CERTIFICATE_AS_STRING)
cert.close()
requests.get(url, cert=cert.name, verify=True)
os.unlink(cert.name)
If you'd like to know why this is potentially unsecure, check out my answer here: https://stackoverflow.com/a/46570264/6445270
The example you have provided is passing a client-side cert as shown in the requests documentation.
As it stands there is no way to pass the client cert and key in memory (or as a string).
Monkey patching to the rescue - by monkey patching requests
you can add the ability to load client certs and keys from memory. The following patch enables passing in a client cert and key in a variety formats without breaking the existing functionality.
import requests
from OpenSSL.crypto import PKCS12, X509, PKey
def _is_key_file_encrypted(keyfile):
'''In memory key is not encrypted'''
if isinstance(keyfile, PKey):
return False
return _is_key_file_encrypted.original(keyfile)
class PyOpenSSLContext(requests.packages.urllib3.contrib.pyopenssl.PyOpenSSLContext):
'''Support loading certs from memory'''
def load_cert_chain(self, certfile, keyfile=None, password=None):
if isinstance(certfile, X509) and isinstance(keyfile, PKey):
self._ctx.use_certificate(certfile)
self._ctx.use_privatekey(keyfile)
else:
super().load_cert_chain(certfile, keyfile=keyfile, password=password)
class HTTPAdapter(requests.adapters.HTTPAdapter):
'''Handle a variety of cert types'''
def cert_verify(self, conn, url, verify, cert):
if cert:
# PKCS12
if isinstance(cert, PKCS12):
conn.cert_file = cert.get_certificate()
conn.key_file = cert.get_privatekey()
cert = None
elif isinstance(cert, tuple) and len(cert) == 2:
# X509 and PKey
if isinstance(cert[0], X509) and hasattr(cert[1], PKey):
conn.cert_file = cert[0]
conn.key_file = cert[1]
cert = None
# cryptography objects
elif hasattr(cert[0], 'public_bytes') and hasattr(cert[1], 'private_bytes'):
conn.cert_file = X509.from_cryptography(cert[0])
conn.key_file = PKey.from_cryptography_key(cert[1])
cert = None
super().cert_verify(conn, url, verify, cert)
def patch_requests(adapter=True):
'''You can perform a full patch and use requests as usual:
>>> patch_requests()
>>> requests.get('https://httpbin.org/get')
or use the adapter explicitly:
>>> patch_requests(adapter=False)
>>> session = requests.Session()
>>> session.mount('https', HTTPAdapter())
>>> session.get('https://httpbin.org/get')
'''
if hasattr(requests.packages.urllib3.util.ssl_, '_is_key_file_encrypted'):
_is_key_file_encrypted.original = requests.packages.urllib3.util.ssl_._is_key_file_encrypted
requests.packages.urllib3.util.ssl_._is_key_file_encrypted = _is_key_file_encrypted
requests.packages.urllib3.util.ssl_.SSLContext = PyOpenSSLContext
if adapter:
requests.sessions.HTTPAdapter = HTTPAdapter
To use the patch you can do something like the following (assume the above code is in a file called patch.py
)
import os
import requests
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization
from patch import patch_requests
CLIENT_CERT = serialization.load_pem_x509_certificate(
os.getenv('CLIENT_CERT'), default_backend())
CLIENT_KEY = serialization.load_pem_private_key(
os.getenv('CLIENT_KEY'), None, default_backend())
# monkey patch load_cert_chain to allow loading
# cryptography certs and keys from memory
patch_requests()
response = requests.get(url, cert=(CLIENT_CERT, CLIENT_KEY))
You now have the ability to supply a client cert to requests in memory in as pyopenssl
object(s) or cryptography
objects.
If one wants to do this without using temporary file, it is possible by overriding the requests SSLContext. Sample can be seen in this answer.