pyOpenSSL

pyOpenSSL is a thin, Pythonic wrapper around a subset of the OpenSSL C library, maintained by the Python Cryptographic Authority (PyCA). It exposes SSL.Connection objects that wrap Python’s portable socket API, extensive error-handling that mirrors OpenSSL’s native error codes, and Python-level callbacks for verification and session handling.

The project predates the modern cryptography library and today serves mainly as a compatibility layer: PyCA explicitly recommends new code use cryptography directly and only reach for pyOpenSSL when a dependency (commonly Twisted, or legacy TLS-heavy codebases) requires its specific SSL.Connection interface.

What You Get

• SSL.Context and SSL.Connection classes that wrap OpenSSL’s TLS state machine around Python sockets
• X.509 certificate, certificate-request, and CRL parsing and generation via the crypto module
• Python-level callbacks for certificate verification, SNI, ALPN/NPN negotiation, and session tickets
• Detailed exception hierarchy (SSL.Error, crypto.Error) that mirrors OpenSSL’s native error codes
• PKCS#12 and PKCS#7 container support for loading bundled keys/certs

Common Use Cases

• Powering Twisted’s TLS transport, which depends directly on pyOpenSSL’s SSL.Connection API
• Legacy codebases that need fine-grained control over TLS handshake callbacks not exposed by the stdlib ssl module
• Generating and inspecting X.509 certificates and CRLs in internal PKI tooling
• Parsing PKCS#12 (.p12/.pfx) bundles for certificate/key extraction

Under The Hood

Architecture - pyOpenSSL is organized as two flat modules under src/OpenSSL/: SSL.py (3,361 lines) implements Context and Connection, wrapping OpenSSL’s TLS state machine around Python’s socket objects and dispatching handshake/verification events to user-supplied Python callbacks; crypto.py (1,950 lines) implements X.509 certificate, certificate-request, CRL, and PKCS#12/PKCS#7 parsing and generation. Both modules call into cryptography’s CFFI bindings to OpenSSL rather than binding libssl directly, so pyOpenSSL is effectively a higher-level, backward-compatible facade over cryptography’s lower-level primitives. Tech Stack - The only runtime dependency is cryptography itself (which supplies the CFFI/OpenSSL bindings); the package is pure Python with no C extension of its own, built via a standard setup.py/pyproject.toml combo and tested across CPython and PyPy. Code Quality - The tests/ directory mirrors the source layout (test_ssl.py, test_crypto.py, test_rand.py, test_util.py) with pytest and strict-markers enabled, plus ruff linting and mypy --strict type checking configured in pyproject.toml, indicating a mature, well-guarded test and type-safety setup for a 900+ star, decade-old project. API Design - The API mirrors OpenSSL’s own C API naming closely (Context, Connection, X509, X509Req) which gives experienced OpenSSL/TLS users a familiar surface but means newcomers face OpenSSL’s own conceptual complexity; the README is explicit that new projects should prefer cryptography directly, positioning pyOpenSSL as a compatibility/legacy layer rather than a beginner-friendly entry point.