Package: pypki3
pypki3pypki3 is intended as a replacement for pypki2.
It is built around thecryptographypackage instead ofpyOpenSSL, which is now deprecated.Unlike pypki2, pypki3 does not try to do any auto-configuration, nor does it try to silently compensate when there's a configuration issue.  The mantra is, "Let it crash."pypki3 also does not support any monkey-patching like pypki2 did.  There's just no need for that.ConfigurationSince the user has to create their own configuration file now, the config file is much simpler, using a standardconfig.iniformat, of the following form.[global]
p12 = /path/to/your.p12
pem = /path/to/your.combined.pem
ca = /path/to/certificate_authorities.pemAt least one ofp12orpemmust be populated.  If both are populated, thenp12is used.Thepemfile must be a combined key-and-cert file of the following form, which is pretty normal in the Python world.-----BEGIN RSA PRIVATE KEY-----
... (private key in base64 encoding) ...
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
... (certificate in base64 PEM encoding) ...
-----END CERTIFICATE-----Configuration file locationspypki3 will first look at the location specified by thePYPKI3_CONFIGenvironment variable for a config file.  This can be helpful in corporate Windows environments where the "home directory" is not always in a standard location.  It can also be useful in test environments.Next pypki3 will look in~/.config/pypki3/config.ini.Next pypki3 will look in/etc/pypki3/config.ini.Finally, for existing library support, if pypki3 is being used in an NBGallery Jupyter environment, then pypki3 will attempt to look for the older pypki2~/.mypkifile, or use NBGallery's Javascript certificate upload dialog.UsageGet an SSLContextIf you have your own code and you just want to pass along an SSLContext based on the .mypki config (eg. forurlopen(), or for therequestspackage), then all you have to do is the following:fromurllib.requestimporturlopenimportpypki3ctx=pypki3.ssl_context()resp=urlopen(https_url,context=ctx)...If you have already configured your PKI info, you have the option of providing a certificate password tossl_context()rather than using the interactive prompt.  This can be useful when the password is stored in a vault, or when the code needs to run in some non-interactive way.  Please be conscientious of the security implications of putting your password directly in your code though.fromurllib.requestimporturlopenimportpypki3ctx=pypki3.ssl_context(password='supersecret')resp=urlopen(https_url,context=ctx)...Prompting for a password early (optional)Sometimes it can also be useful to force the certificate password prompt to appear beforessl_context()is called, by another library for example.  To do this, simply useprepare().importpypki3importanother_library_that_uses_pypki3pypki3.prepare()# Prompts for password here# A lot of other code/steps...# Does not prompt for password way down hereanother_library_that_uses_pypki3.does_something()Getting a decrypted key/cert contextpypki3 includes a context manager that ensures the decrypted key and cert are cleaned up.  This is useful when you want to make sure you don't leave your decrypted certs sitting around on disk.importpypki3withNamedTemporaryKeyCertPaths()askey_cert_paths:key_path=key_cert_paths[0]# key_path is a pathlib.Path objectcert_path=key_cert_paths[1]# cert_path is a pathlib.Path object# Do something awesome here# Decrypted key and cert are cleaned up when you leave the `with` context.Using the pip wrapperSome pip servers require PKI authentication.  To make this a bit easier, pypki3 includes a pip wrapper that takes care of filling in the--client-certand--certparameters based on the pypki3 configuration.  This also prevents pip from prompting for a password 8 million times when use password-protected (encrypted) certs.importpypki3pypki3.pip(['install','amazing-internal-package'])