pyasn1及pyasn1-modules解析DER格式证书、私钥及公钥

PEM转DER

DER格式是证书、私钥、公钥等按ASN.1编码后序列化生成的二进制格式。 我们可以从PEM格式中得到DER格式：例如：

import base64

# PEM转DER格式
def pem2der(pem: bytes) -> bytes:
    return base64.b64decode(b''.join(pem.strip().split(b'\n')[1:-1]))


# 使用方法
pem = b"""-----BEGIN EC PRIVATE KEY-----
MHcCAQEEILb9XVRPCaPgtmBLTfusYmTDBzACWEIMP7G47ttUSgcZoAoGCCqGSM49
AwEHoUQDQgAEIL5WxHjk/yCczEPlMxcLSSYqsOs4uhGzlq0FQnIx4uJrvDaIq6ht
+tdT2VAnfDTNbyhkJWWfCCpe9meVIQj6hQ==
-----END EC PRIVATE KEY-----"""

der = pem2der(pem)

pyasn1-modules介绍

我们可以使用三方包pyasn1结合pyasn1-modules来解析DER格式的证书、私钥或公钥 pyasn1-modules中包含了各种RFC格式标准，常见对应关系为：

名称	对应PEM标识	对应pyasn1-modules模块
X.509证书证书	—–BEGIN CERTIFICATE—– … —–END CERTIFICATE—–	rfc5280.Certificate()
PKCS#1格式RSA私钥	—–BEGIN RSA PRIVATE KEY—– … —–END RSA PRIVATE KEY—–	rfc2437.RSAPrivateKey()
PKCS#13格式EC私钥	—–BEGIN EC PRIVATE KEY—- - … —–END EC PRIVATE KEY—–	rfc5915.ECPrivateKey()
PKCS#8格式私钥	—–BEGIN PRIVATE KEY—– … —–END PRIVATE KEY—–	rfc5208.PrivateKeyInfo()
PKCS#1格式RSA公钥	—–BEGIN RSA PUBLIC KEY—- - … —–END RSA PUBLIC KEY—–	rfc2437.RSAPublicKey()
X.509证书扩展标准公钥	—–BEGIN PUBLIC KEY—– … —–END PUBLIC KEY—–	rfc5280.SubjectPublicKeyInfo()

安装pyasn1及pyasn1-modules:

pip install pyasn1 pyasn1-modules

pyasn1解析X.509证书

import base64

from pyasn1_modules import rfc5280
from pyasn1.codec.der import decoder


cert_pem = b"""-----BEGIN CERTIFICATE-----
MIICeDCCAh6gAwIBAgIDCQiGMAoGCCqGSM49BAMCMIGKMQswCQYDVQQGEwJDTjEQ
MA4GA1UECBMHQmVpamluZzEQMA4GA1UEBxMHQmVpamluZzEfMB0GA1UEChMWd3gt
b3JnMS5jaGFpbm1ha2VyLm9yZzESMBAGA1UECxMJcm9vdC1jZXJ0MSIwIAYDVQQD
ExljYS53eC1vcmcxLmNoYWlubWFrZXIub3JnMB4XDTIyMDYxMDA3MTczNloXDTI3
MDYwOTA3MTczNlowgZExCzAJBgNVBAYTAkNOMRAwDgYDVQQIEwdCZWlqaW5nMRAw
DgYDVQQHEwdCZWlqaW5nMR8wHQYDVQQKExZ3eC1vcmcxLmNoYWlubWFrZXIub3Jn
MQ8wDQYDVQQLEwZjbGllbnQxLDAqBgNVBAMTI2NsaWVudDEuc2lnbi53eC1vcmcx
LmNoYWlubWFrZXIub3JnMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKQK43j7b
gR5l7w6lksM39GPKouVG1APdU2dRSElnGleAwSE6462wcCec/z/X9oLltEH+N7J+