M2Crypto and CAcert.org certificates

Jeremy Morel <[email protected]> Tue, 28 Oct 2008 10:35:15 +0100
Newsgroups gmane.comp.python.cryptography
Message-ID <LISTSERV%[email protected]>
Hi all,

I am trying to use M2Crypto to authentify mails signed with a certificate=

delivered by CACert.org. I understand they do not use traditional public
key/private key signing, but rather give you a certificate you use to sig=
n
your mails with embed the public key. Toying with M2Crypto, I was able to=

extract that public key, but all my attempts at verifying the signature f=
ailed.

My code derives from the example available at
http://sandbox.rulemaker.net/ngps/m2/howto.smime.html

Here :
from M2Crypto import SMIME, X509

# Load the data, verify it.
p7, data =3D SMIME.smime_load_pkcs7('test_sign.eml')

certif =3D X509.load_cert('root.crt')
stack =3D X509.X509_Stack()

signers =3D p7.get0_signers(stack)
for signer in signers:
    pubkey =3D signer.get_pubkey()
    print signer=20=20

# Instantiate an SMIME object.
s =3D SMIME.SMIME()

# Load the signer's cert.
x509 =3D X509.X509()
x509.set_pubkey(pubkey)
sk =3D X509.X509_Stack()
sk.push(x509)
s.set_x509_stack(sk)

st =3D X509.X509_Store()
st.load_info('root.crt')
s.set_x509_store(st)

# Load the data, verify it.
v =3D s.verify(p7)

In this context, I have 2 files :
 * test_sign.eml is a signed email
 * root.crt is the root certificate from CACert.org

data does contain the body of the mail, but it looks like p7 is empty. I =
get
this error :
<M2Crypto.X509.X509 instance at 0x6c1b98>
Traceback (most recent call last):
  File "sign.py", line 38, in <module>
    v =3D s.verify(p7)
  File "build/bdist.macosx-10.5-i386/egg/M2Crypto/SMIME.py", line 215, in=
 verify
M2Crypto.SMIME.PKCS7_Error: no content

Does anyone know how to fix this ?

Thanks in advance,

J=E9r=E9my