Windows系统下如何用Python列举读取全部已安装SSL证书并校验有效期

问题原因 #

你之前使用的certifi库仅返回Python包内置的公共可信CA根证书集合，和Windows证书管理器（certmgr.msc）中存储的本地自定义证书、企业内部证书、个人证书等内容完全独立，因此无法获取系统全量证书。

实现依赖 #

需要提前安装两个依赖库：

pip install pypiwin32 cryptography

完整实现代码 #

import win32crypt
import win32cryptcon
from datetime import datetime
from cryptography import x509
from cryptography.hazmat.backends import default_backend

# 定义需要遍历的证书存储区，可根据需要增减
CERT_STORES = [
    ("ROOT", "受信任的根证书颁发机构"),
    ("CA", "中级证书颁发机构"),
    ("MY", "个人证书"),
    ("TrustedPublisher", "受信任的发布者")
]

def get_all_system_certs():
    cert_list = []
    for store_name, store_desc in CERT_STORES:
        # 打开当前用户的证书存储区，若要读取本地计算机存储区需管理员权限，将最后一个参数改为win32cryptcon.CERT_SYSTEM_STORE_LOCAL_MACHINE
        store = win32crypt.CertOpenSystemStore(None, store_name)
        try:
            # 遍历存储区所有证书
            for cert_ctx in win32crypt.CertEnumCertificatesInStore(store):
                # 导出DER格式证书内容
                der_cert = cert_ctx[1]
                # 解析证书详情
                try:
                    cert_detail = x509.load_der_x509_certificate(der_cert, default_backend())
                    # 组装证书信息
                    cert_info = {
                        "store_name": store_name,
                        "store_desc": store_desc,
                        "issuer": cert_detail.issuer.rfc4514_string(),
                        "subject": cert_detail.subject.rfc4514_string(),
                        "not_valid_before": cert_detail.not_valid_before,
                        "not_valid_after": cert_detail.not_valid_after,
                        "serial_number": cert_detail.serial_number,
                        "raw_data": der_cert
                    }
                    # 校验有效期状态
                    now = datetime.utcnow()
                    if now < cert_info["not_valid_before"]:
                        cert_info["status"] = "未生效"
                    elif now > cert_info["not_valid_after"]:
                        cert_info["status"] = "已过期"
                    else:
                        cert_info["status"] = "有效期内"
                    cert_list.append(cert_info)
                except Exception as e:
                    # 跳过解析失败的异常证书
                    continue
        finally:
            win32crypt.CertCloseStore(store, 0)
    return cert_list

if __name__ == "__main__":
    all_certs = get_all_system_certs()
    # 打印证书信息示例
    for cert in all_certs:
        print(f"存储区: {cert['store_desc']}")
        print(f"颁发者: {cert['issuer']}")
        print(f"使用者: {cert['subject']}")
        print(f"有效期至: {cert['not_valid_after'].strftime('%Y-%m-%d %H:%M:%S')}")
        print(f"状态: {cert['status']}")
        print("-"*50)

补充说明 #

• 若需要读取本地计算机级别的证书存储区（而非当前用户的存储区），需要以管理员权限运行脚本，同时将CertOpenSystemStore的最后一个参数修改为win32cryptcon.CERT_SYSTEM_STORE_LOCAL_MACHINE
• 上述代码仅校验了证书的有效期，若需要完整校验证书的信任链、是否被吊销等状态，可以调用Windows原生APIwin32crypt.CertVerifyCertificateChainPolicy实现

内容的提问来源于stack exchange，提问作者Abhijeet Nikam