python3::ssl::_local_证书验证

Question

I am trying to do (python 3.6) the equivalent of

openssl verify -CApath my_dir_of_CA_certs my_cert_from_one_of_those_CAs

I keep looking over ssl and pyOpenSSL but nothing seems apparent.. any form of verification for these modules require a connection which is not what the above command do. Do i miss something obvious here or it's just not possible? (and i will have to run it as system command)

Answer 1

so, @patrick-mevzek was right, to do certificate verification against a (collection of) CA, with python3, one can use pyOpenSSL and do:
x509store = OpenSSL.crypto.X509Store()
x509store.load_locations(None, capath = ca_verify_location)
OR
x509store.load_locations(cafile = ca_verify_location) if the CAs are store in a file
store_ctx = OpenSSL.crypto.X509StoreContext(x509store, x509)
where x509 is the x509 cert object, and then
store_ctx.verify_certificate()