(CkPython) Validate Certificate using OCSP Protocol

Demonstrates how to validate a certificate (check the revoked status) using the OCSP protocol.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

# Note: Requires Chilkat v9.5.0.75 or greater.

# This requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# This example will check the revoked status of a certificate loaded from a file.
cert = chilkat.CkCert()
success = cert.LoadFromFile("qa_data/certs/google.crt")
if (success != True):
    print(cert.lastErrorText())
    sys.exit()

# Get the cert's OCSP URL.
ocspUrl = cert.ocspUrl()

# Build the JSON that will be the OCSP request.

# Possible hash algorithms are sha1, sha256, sha384, sha512.  
hashAlg = "sha256"
prng = chilkat.CkPrng()
json = chilkat.CkJsonObject()
json.put_EmitCompact(False)
# Read more about OCSP nonce lengths
json.UpdateString("extensions.ocspNonce",prng.genRandom(16,"base64"))
json.put_I(0)
json.UpdateString("request[i].cert.hashAlg",hashAlg)
json.UpdateString("request[i].cert.issuerNameHash",cert.hashOf("IssuerDN",hashAlg,"base64"))
json.UpdateString("request[i].cert.issuerKeyHash",cert.hashOf("IssuerPublicKey",hashAlg,"base64"))
json.UpdateString("request[i].cert.serialNumber",cert.serialNumber())

print(json.emit())

# Our OCSP request looks something like this:
# {
#   "extensions": {
#     "ocspNonce": "qZDfbpO+nUxRzz6c/SPjE5QCAsPfpkQlRDxTnGl0gnxt7iXO"
#   },
#   "request": [
#     {
#       "cert": {
#         "hashAlg": "sha1",
#         "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=",
#         "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
#         "serialNumber": "6175535D87BF94B6"
#       }
#     }
#   ]
# }

ocspRequest = chilkat.CkBinData()
http = chilkat.CkHttp()

# Convert our JSON to a binary (ASN.1) OCSP request
success = http.CreateOcspRequest(json,ocspRequest)
if (success == False):
    print(http.lastErrorText())
    sys.exit()

# Send the OCSP request to the OCSP server
# resp is a CkHttpResponse
resp = http.PBinaryBd("POST",ocspUrl,ocspRequest,"application/ocsp-request",False,False)
if (http.get_LastMethodSuccess() != True):
    print(http.lastErrorText())
    sys.exit()

# Get the binary (ASN.1) OCSP reply
ocspReply = chilkat.CkBinData()
resp.GetBodyBd(ocspReply)

# Convert the binary reply to JSON.
# Also returns the overall OCSP response status.
jsonReply = chilkat.CkJsonObject()
ocspStatus = http.ParseOcspReply(ocspReply,jsonReply)

# The ocspStatus can have one of these values:
# -1:  The ARG1 does not contain a valid OCSP reply.
# 0:  Successful - Response has valid confirmations..
# 1: Malformed request - Illegal confirmation request.
# 2: Internal error - Internal error in issuer.
# 3: Try later -  Try again later.
# 4: Not used - This value is never returned.
# 5: Sig required - Must sign the request.
# 6: Unauthorized - Request unauthorized.

if (ocspStatus < 0):
    print("Invalid OCSP reply.")
    sys.exit()

print("Overall OCSP Response Status: " + str(ocspStatus))

# Let's examine the OCSP response (in JSON).
jsonReply.put_EmitCompact(False)
print(jsonReply.emit())

# The JSON reply looks like this:
# (Use the online tool at https://tools.chilkat.io/jsonParse.cshtml
# to generate JSON parsing code.)

# {
#   "responseStatus": 0,
#   "responseTypeOid": "1.3.6.1.5.5.7.48.1.1",
#   "responseTypeName": "ocspBasic",
#   "response": {
#     "responderIdChoice": "KeyHash",
#     "responderKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
#     "dateTime": "20180803193937Z",
#     "cert": [
#       {
#         "hashOid": "1.3.14.3.2.26",
#         "hashAlg": "SHA-1",
#         "issuerNameHash": "9u2wY2IygZo19o11oJ0CShGqbK0=",
#         "issuerKeyHash": "d8K4UJpndnaxLcKG0IOgfqZ+uks=",
#         "serialNumber": "6175535D87BF94B6",
#         "status": 0,
#         "thisUpdate": "20180803193937Z",
#         "nextUpdate": "20180810193937Z"
#       }
#     ]
#   }
# }
# 

# The certificate status:
certStatus = -1
if (jsonReply.HasMember("response.cert[0].status") == True):
    certStatus = jsonReply.IntOf("response.cert[0].status")

# Possible certStatus values are:
# -1: No status returned.
# 0: Good
# 1: Revoked
# 2: Unknown.
print("Certificate Status: " + str(certStatus))