如何在Python的HTTPX中直接使用PKCS12（.p12）证书文件？

HTTPX本身没有直接加载PKCS12文件的API，但可以借助cryptography库先解析PKCS12文件，提取出证书和私钥，再传给HTTPX使用，实现直接基于PKCS12文件发起请求的需求。

步骤1：安装依赖 #

需要安装httpx和cryptography两个库：

pip install httpx cryptography

步骤2：解析PKCS12并发起请求 #

以下是两种常见场景的代码示例：

从文件路径加载PKCS12 #

import httpx
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.serialization import pkcs12

def parse_pkcs12_file(p12_path, password):
    # 读取PKCS12文件内容
    with open(p12_path, "rb") as f:
        p12_data = f.read()
    
    # 解析PKCS12，提取私钥、主证书及额外证书链
    private_key, main_cert, extra_certs = pkcs12.load_pkcs12(
        p12_data,
        password.encode(),
        backend=default_backend()
    )
    
    # 将私钥序列化为PEM格式
    private_key_pem = private_key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption()
    )
    
    # 将主证书序列化为PEM格式
    cert_pem = main_cert.public_bytes(encoding=serialization.Encoding.PEM)
    
    return private_key_pem, cert_pem

# 替换为你的PKCS12文件路径和密码
p12_file_path = "your_client_cert.p12"
p12_password = "your_p12_pass"

# 解析证书和私钥
key_pem, cert_pem = parse_pkcs12_file(p12_file_path, p12_password)

# 初始化HTTPX客户端并发起请求
with httpx.Client(
    cert=(cert_pem, key_pem),
    verify=True  # 生产环境建议保留True，自定义CA可指定路径如verify="ca_cert.pem"
) as client:
    response = client.get("https://your-protected-service.com/api/resource")
    print(response.status_code)
    print(response.json())

从二进制内容加载PKCS12 #

如果PKCS12内容是从内存或数据库中获取的二进制数据，可直接解析：

import httpx
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.serialization import pkcs12

def parse_pkcs12_bytes(p12_bytes, password):
    private_key, main_cert, extra_certs = pkcs12.load_pkcs12(
        p12_bytes,
        password.encode(),
        backend=default_backend()
    )
    
    private_key_pem = private_key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption()
    )
    
    cert_pem = main_cert.public_bytes(encoding=serialization.Encoding.PEM)
    
    return private_key_pem, cert_pem

# 假设p12_binary是获取到的PKCS12二进制数据
p12_binary = b"your_pkcs12_binary_content"
p12_password = "your_p12_pass"

key_pem, cert_pem = parse_pkcs12_bytes(p12_binary, p12_password)

with httpx.Client(cert=(cert_pem, key_pem)) as client:
    response = client.post(
        "https://your-protected-service.com/api/submit",
        json={"data": "test_content"}
    )
    print(response.status_code)

注意事项 #

• 若PKCS12包含额外证书链，可将extra_certs中的证书合并到主证书PEM中，部分严格的服务端需要完整证书链验证。
• verify参数设为False会跳过服务端证书验证，仅适合测试环境，生产环境必须验证服务端证书。

内容的提问来源于stack exchange，提问作者Tom Arn