title: How do I verify an SSL certificate in python?
body: <p>I need to verify that a certificate was signed by my custom CA.  Using OpenSSL command-line utilities this is easy to do:</p>
  
  <pre><code># Custom CA file: ca-cert.pem
  # Cert signed by above CA: bob.cert
  $ openssl verify -CAfile test-ca-cert.pem bob.cert
  bob.cert: OK
  </code></pre>
  
  <p>But I need to do the same thing in Python, and I really don't want to call out to command-line utilities.  As far as I'm aware, M2Crypto is the "most complete" python wrapper for OpenSSL, but I can't figure out how to accomplish what the command-line utility does!</p>
  
  <p>Referencing <a href="https://stackoverflow.com/questions/3288694/validating-x-509-certificate-on-linux">this question</a> for how to accomplish this same task in C code, I've been able to get about half-way.  <em>The variable names I chose are the same ones used in the source code for the openssl verify command-line utility, see <code>openssl-xxx/apps/verify.c</code>.</em></p>
  
  <pre><code>import M2Crypto as m2
  # Load the certificates
  cacert = m2.X509.load_cert('test-ca-cert.pem')   # Create cert object from CA cert file
  bobcert = m2.X509.load_cert('bob.cert')     # Create cert object from Bob's cert file
  cert_ctx = m2.X509.X509_Store()             # Step 1 from referenced C code steps
  csc = m2.X509.X509_Store_Context(cert_ctx)  # Step 2 &amp; 5
  cert_ctx.add_cert(cacert)                   # Step 3
  cert_ctx.add_cert(bobcert)                  # ditto
  # Skip step 4 (no CRLs to add)
  # Step 5 is combined with step 2...I think. (X509_STORE_CTX_init: Python creates and 
  #   initialises an object in the same step)
  # Skip step 6? (can't find anything corresponding to 
  #   X509_STORE_CTX_set_purpose, not sure if we need to anyway???)
  # 
  # It all falls apart at this point, as steps 7 and 8 don't have any corresponding
  # functions in M2Crypto -- I even grepped the entire source code of M2Crypto, and
  # neither of the following functions are present in it:
  # Step 7: X509_STORE_CTX_set_cert - Tell the context which certificate to validate.
  # Step 8: X509_verify_cert - Finally, validate it
  </code></pre>
  
  <p>So I'm halfway there, but I can't seem to actually get the validation done! Am I missing something?  Is there some other function I should be using from M2Crypto?  Should I be looking for a completely different python wrapper of OpenSSL?  How can I accomplish this task in python!?!?</p>
  
  <p><em>Note that I'm using certificates to encrypt/decrypt FILES, so I'm not interested in using the SSL-connection-based peer certificate verification (which has <a href="https://stackoverflow.com/questions/1087227/validate-ssl-certificates-with-python">already been answered</a>), because I don't have any SSL connections going.</em>    </p>