Google Workspace批量推送SMIME证书API调用异常求助

核心问题分析与修复步骤 #

1. 权限Scope错误 #

代码中使用的gmail.labels权限仅用于标签管理，上传SMIME证书需要修改用户设置的权限，必须替换为正确的Scope：

• 替换原SCOPES为：

SCOPES = ['https://www.googleapis.com/auth/gmail.settings.basic']

若需管理共享类设置，也可使用https://www.googleapis.com/auth/gmail.settings.sharing，但basic权限已足够完成SMIME证书上传操作。

2. PFX证书文件读取方式错误 #

PFX是二进制格式文件，不能用文本模式('r')读取；且API要求pkcs12字段为base64编码的字符串，而非bytes对象。修改create_smime_info函数：

def create_smime_info(cert_filename, cert_password=None):
    smime_info = None
    try:
        # 用二进制模式读取PFX文件
        with open(cert_filename, 'rb') as f:
            smime_info = {}
            data = f.read()
            # 编码后转换为字符串
            smime_info['pkcs12'] = base64.urlsafe_b64encode(data).decode('UTF-8')
            if cert_password and len(cert_password) > 0:
                smime_info['encryptedKeyPassword'] = cert_password
    except (OSError, IOError) as error:
        print('读取证书文件出错: %s' % error)
    return smime_info

3. 未定义变量send_as_email #

主程序中调用insert接口时使用了未定义的send_as_email变量，需补充定义：

user_id = 'targetuser@domain.com'
send_as_email = user_id  # 或用户的发件别名邮箱

4. 错误处理模块导入统一 #

确保代码中HttpError的导入一致，主程序和functionalities.py中都使用：

from googleapiclient.errors import HttpError

避免出现errors.HttpError和HttpError混用的情况。

修复后的完整主程序示例 #

from __future__ import print_function
from google.oauth2 import service_account
from googleapiclient.discovery import build
from googleapiclient.errors import HttpError
import base64

def create_smime_info(cert_filename, cert_password=None):
    smime_info = None
    try:
        with open(cert_filename, 'rb') as f:
            smime_info = {}
            data = f.read()
            smime_info['pkcs12'] = base64.urlsafe_b64encode(data).decode('UTF-8')
            if cert_password and len(cert_password) > 0:
                smime_info['encryptedKeyPassword'] = cert_password
    except (OSError, IOError) as error:
        print('读取证书文件出错: %s' % error)
    return smime_info

def main():
    SCOPES = ['https://www.googleapis.com/auth/gmail.settings.basic']
    SERVICE_ACCOUNT_FILE = 'D:\\G_Mail_Certs\\eproject-444444444f.json'

    credentials = service_account.Credentials.from_service_account_file(
        SERVICE_ACCOUNT_FILE, scopes=SCOPES)

    try:
        delegated_credentials = credentials.with_subject('targetuser@domain.com')       
        gmail_service = build('gmail', 'v1', credentials=delegated_credentials)
        user_id = 'targetuser@domain.com'
        send_as_email = user_id
        smime_info = create_smime_info(cert_filename='D:\\Certs\\MPS2.pfx', cert_password='ABCD1234')
        results = gmail_service.users().settings().sendAs().smimeInfo().\
            insert(userId=user_id, sendAsEmail=send_as_email, body=smime_info)\
            .execute() 
        print(f'证书上传成功，ID: {results["id"]}')
    except HttpError as error:
        print(f'发生错误: {error}')
        results = None
    return results

if __name__ == '__main__':
    main()

内容的提问来源于stack exchange，提问作者frost