Python3.6在CentOS下调用ssl.enum_certificates报错如何解决

问题原因 #

ssl.enum_certificates 是Windows平台专属的API，仅在Windows环境编译的Python版本中提供，Linux平台的Python标准库ssl模块没有实现该方法，这是CentOS下报错的核心原因，和你使用的Python 3.6.8版本无关。

实现方案 #

CentOS系统的信任证书默认存储在几个固定路径下，直接遍历读取对应路径的证书文件即可实现需求，完整代码如下：

import os
import glob
from cryptography import x509
from cryptography.hazmat.backends import default_backend

# CentOS系统证书存储路径匹配规则
CERT_PATHS = [
    "/etc/pki/tls/certs/ca-bundle.crt",
    "/etc/pki/ca-trust/source/anchors/*.crt",
    "/etc/pki/ca-trust/source/anchors/*.pem",
    "/usr/share/pki/ca-trust-source/anchors/*.crt",
    "/usr/share/pki/ca-trust-source/anchors/*.pem"
]

def load_cert_from_file(file_path):
    try:
        with open(file_path, "rb") as f:
            cert_data = f.read()
        # 优先尝试PEM格式加载，失败则尝试DER格式
        try:
            return x509.load_pem_x509_certificate(cert_data, default_backend())
        except ValueError:
            return x509.load_der_x509_certificate(cert_data, default_backend())
    except Exception:
        return None

# 处理多证书合并的ca-bundle集合文件
with open(CERT_PATHS[0], "rb") as f:
    bundle_data = f.read().decode()
pem_certs = bundle_data.split("-----BEGIN CERTIFICATE-----")
for pem in pem_certs[1:]:
    pem = f"-----BEGIN CERTIFICATE-----{pem}"
    try:
        cert = x509.load_pem_x509_certificate(pem.encode(), default_backend())
        print(cert.issuer, cert.not_valid_after)
    except Exception:
        pass

# 遍历目录下的独立证书文件
for path_pattern in CERT_PATHS[1:]:
    for cert_file in glob.glob(path_pattern):
        cert = load_cert_from_file(cert_file)
        if cert:
            print(cert.issuer, cert.not_valid_after)

注意事项 #

• 运行代码前需先安装适配Python 3.6的cryptography依赖：pip install cryptography==3.4.8，更高版本的cryptography不再支持Python 3.6
• 上述代码仅读取系统级信任证书，若需要读取当前用户目录下的私人证书，可将~/.pki/CA/路径下的crt、pem文件匹配规则添加到CERT_PATHS列表中
• 若需要读取Chrome、Firefox等浏览器自有证书库中的证书，需单独调用对应浏览器的证书读取工具实现

内容的提问来源于stack exchange，提问作者neves