title: most efficient way to implement certificate revocation checks in Python?
body: <p>i am trying to implement certificate revocation checks either through CRL or OCSP in my python 3.6 code (using the requests library) which is:</p>
  
  <pre><code>import ssl
  import requests
  
  from requests.adapters import HTTPAdapter
  from requests.packages.urllib3.poolmanager import PoolManager
  from requests.packages.urllib3.util import ssl_
  
  CIPHERS = (
      'RSA+AES'
  )
  
  
  class TlsAdapter(HTTPAdapter):
  
      def __init__(self, ssl_options=0, **kwargs):
          self.ssl_options = ssl_options
          super(TlsAdapter, self).__init__(**kwargs)
  
      def init_poolmanager(self, *pool_args, **pool_kwargs):
          ctx = ssl_.create_urllib3_context(ciphers=CIPHERS, cert_reqs=ssl.CERT_REQUIRED, options=self.ssl_options)
          # ctx.verify_flags = ssl.VERIFY_CRL_CHECK_CHAIN
          self.poolmanager = PoolManager(*pool_args,
                                         ssl_context=ctx,
                                         **pool_kwargs)
  session = requests.session()
  adapter = TlsAdapter(ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1)
  session.mount("https://", adapter)
  r = session.request('GET', 'https://awesome.com', verify='/etc/ssl/certs/ca-certificates.crt')
  print(r)
  </code></pre>
  
  <p>As per the research that i did on CRL and OCSP (see <a href="https://stackoverflow.com/questions/39297240/python-failed-to-verify-any-crls-for-ssl-tls-connections?rq=1">here</a> and here), there is no built in mechanism in Python for implementing certificate revocation checks with CRL. The ssl.VERIFY_CRL_CHECK_CHAIN can be leveraged but that also expects us to provide the crl file manually on the client end which is not very efficient. For reference, the WinHTTP library on windows automatically extracts all the crl paths in the certificates and checks them automatically whether the certificate has been revoked or not.</p>
  
  <p>However, i could not find much information whether there is support for OSCP checks in Python 3.6 and whether it can be implemented easily either through a built in method or through a third party package maybe? Ideally, does any solution exist in Python which can automatically extract the crl server/ ocsp responder from the server certificate and then contact the respective service to verify whether the certificate has been revoked or not?</p>
  
  <p>Thanks guys! </p>