在Python中是否有解析CRL的简单方法？

Question

我正在尝试做一件看起来有点傻的事情：加载一个证书吊销列表（CRL），然后输出被吊销的证书序列号。

使用M2Crypto加载CRL的方法是：

import M2Crypto
crl = M2crypto.X509.load_crl('my.crl')

不过我真的很惊讶，返回的对象只有一个有用的内容，就是

crl.as_text()

通过一些正则表达式，我可以解析输出，提取出被吊销的序列号。但是有没有其他方法可以做到这一点呢？

为了提供一些信息，这里有一个经典的CRL的文本输出。

Certificate Revocation List (CRL):
        Version 2 (0x1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: /C=FR/ST=IDF/L=Paris/O=XXXXX/OU=XXXXX/CN=XXXXX Certificate Authority
        Last Update: Nov  6 21:49:51 2010 GMT
        Next Update: Nov  7 21:49:51 2010 GMT
Revoked Certificates:
    Serial Number: 02
        Revocation Date: Aug 10 15:40:09 2010 GMT
    Serial Number: 03
        Revocation Date: Sep  9 15:12:24 2010 GMT
    Serial Number: 05
        Revocation Date: Aug 17 14:18:22 2010 GMT
    Serial Number: 06
        Revocation Date: Aug 18 08:57:15 2010 GMT
    Signature Algorithm: sha1WithRSAEncryption
        d1:05:da:1f:c0:1c:68:78:0e:e2:ea:78:de:b8:b2:58:9c:ba:
        b4:7c:c5:e8:2a:8d:8c:82:1d:4b:ed:a7:2d:cb:f6:bf:da:fa:
        38:a4:7a:3d:2b:19:6c:7a:ba:4c:1c:4c:e4:d8:e6:20:3d:0a:
        95:03:75:bf:17:cf:97:ce:3e:4a:93:1c:a6:4c:36:62:97:a2:
        d3:be:f2:78:38:89:13:3e:d4:b0:80:a1:24:52:0d:3a:01:67:
        0d:4f:e7:0b:07:0c:80:04:b7:25:66:a4:61:36:dd:3a:24:29:
        30:67:f6:23:31:34:6f:0b:a8:30:c1:c9:b7:ee:4e:2b:7a:e7:
        6b:31:7d:0b:cb:12:8a:7c:5f:7e:73:a0:42:8d:ea:4f:f7:76:
        ce:1b:0b:6c:6a:3e:eb:08:a6:d6:67:81:cb:cb:98:6d:40:ec:
        8c:e5:a5:f7:f0:ed:0c:7f:38:fd:42:3d:19:c4:69:ec:eb:71:
        7a:e1:30:b4:81:98:f5:00:a0:bd:ac:75:46:15:e6:2b:1c:da:
        f4:09:19:e5:1b:4e:c9:a4:7c:11:79:24:a4:3b:13:84:84:a7:
        5b:0e:07:80:ae:ae:26:8e:d7:b3:cb:b8:6c:79:df:9d:26:b0:
        34:bc:c1:f4:8f:4b:3e:f5:9b:d0:e3:e7:ab:37:27:f6:79:09:
        47:fb:76:07

Answer 1

这里有另一种（现代的）方法来从CRL.pem文件中获取序列号：

from cryptography import x509
from cryptography.hazmat.backends import default_backend


CRL_FILENAME = crl.pem"

def get_serial_numbers_from_crl_file(crl_file_path):
    with open(crl_file_path, 'rb') as crl_file:
        crl_data = crl_file.read()
        crl = x509.load_der_x509_crl(crl_data, default_backend())

        serial_numbers = [entry.serial_number for entry in crl]
        return serial_numbers

serial_numbers = get_serial_numbers_from_crl_file(CRL_FILENAME)


print("Serial Numbers in the list:")
print(serial_numbers)
print("Serial Numbers one by one:")
for serial_number in serial_numbers:
    print(serial_number)

Answer 2

pyOpenSSL 有一个叫做 CRL 的类，里面有一个 get_revoked() 方法，应该正好能满足你的需求，我认为这个方法是用来获取被吊销的证书的（具体可以查看 这里 的文档）。

我明白如果你出于某种原因必须使用 M2Crypto，这可能不是你想要的，但这个方法似乎也能正常工作。

Answer 3

工作完成了，多亏了pyOpenSSL。下面是使用的代码：

import OpenSSL

with open('path_to_the_crl', 'r') as _crl_file:
    crl = "".join(_crl_file.readlines())

crl_object = OpenSSL.crypto.load_crl(OpenSSL.crypto.FILETYPE_PEM, crl)

revoked_objects = crl_object.get_revoked()

for rvk in revoked_objects:
    print "Serial:", rvk.get_serial()

这段代码在我的CRL示例中输出了以下内容：

Serial: 02
Serial: 03
Serial: 05
Serial: 06