certificate - Getting PKCS7 signer chain in python -

i have pkcs7 message signed. contains data , signing certificate (with whole chain of trust).

i have code uses m2crypto certificate out of it.

bio = bio.memorybuffer(pkcs7message) p7 = smime.pkcs7(m2.pkcs7_read_bio_der(bio._ptr())) sk = x509.x509_stack() certstack = p7.get0_signers(sk) 

it works. however, certstack returns 1 certificate (instead of returning whole chain of certificates.

two questions:

• am missing (may there option let know need whole chain)
• are there other methods how whole chain (may using pyopenssl)?

i guess making confusion between signers , certificate chain of signer. pkcs7_get0_signers return list of signers.

in order building pkcs7 message 2 signers, can use following steps:

1. build key , certificate first signer:

   openssl genrsa -out key1.pem openssl req -new -key key1.pem -subj "/cn=key1" | openssl x509 -req -signkey key1.pem -out cert1.pem 

2. build key , certificate second signer:

   openssl genrsa -out key2.pem openssl req -new -key key2.pem -subj "/cn=key2" | openssl x509 -req -signkey key2.pem -out cert2.pem 

3. create pkcs7 message using both signers :

   echo "hello" | openssl smime -sign -nodetach \   -out signature.der -outform der \   -inkey key1.pem -signer cert1.pem -inkey key2.pem -signer cert2.pem  

then signers printed running python script:

from m2crypto import *  bio=bio.file(open('signature.der')) smime_object = smime.pkcs7(m2.pkcs7_read_bio_der(bio._ptr()))     signers = smime_object.get0_signers(x509.x509_stack())  cert in signers:     print(cert.get_issuer().as_text()) 

it give signers' issuer:

cn=key1
cn=key2