title: Python Openssl Sign and Verify functions
body: <p>I'm currently working on expanding some python code a co-worker wrote to use X509 certificates with the OpenSSL library. I have managed to get all but a few of the OpenSSL functions working. The libraries / functions that I am using are</p>
  
  <pre><code>from OpenSSL.crypto import FILETYPE_PEM
  from OpenSSL.crypto load_certificate, verify, sign, load_privatekey
  </code></pre>
  
  <p>I am currently creating certificates on my local machine with </p>
  
  <pre><code> openssl req -x509 -newkey rsa:2048 -out rootcert.pem -outform PEM -days 1825
  </code></pre>
  
  <p>and then "pushing" that to a server (also on local machine), which then returns me a 64 character long random alphanumeric string. I then take the string and sign it using</p>
  
  <pre><code> openssl rsautl -sign -inkey rootprivkey.pem -in string -out signedstring
  </code></pre>
  
  <p>When I push the signed random string to the server, it takes it to verify (using OpenSSL.crypto.verify) with the certificate I previously sent, the process fails. However, if I use the verify function on the command line (<code>openssl rsautl -verify -inkey rootprivkey.pem -in signedstring</code>), it works.</p>
  
  <p>If I push the private key to the server and use the OpenSSL.crypto.sign (<code>sign(private key, data, digest)</code>) function to sign the same random string and put that into the verify (<code>verify(certificate, signature, data, digest)</code>) function, it works. </p>
  
  <p>I've tried all of the different types of padding when signing the string, and none of those worked. I've also tried doing a digest hash of the string first and then signing that file, based on an old question on SO:</p>
  
  <pre><code> openssl dgst -sha1 -binary &lt; string &gt; digeststring
   openssl rsautl -sign -inkey rootprivkey.pem -keyform PEM -in digeststring &gt; signedstring
  </code></pre>
  
  <p>But obviously that did not work either.</p>
  
  <p>I do not know if I am either generating the certificate and signing the string incorrectly, if I am using the OpenSSL.crypto library incorrectly (I have checked many times to make sure that I am passing the correct variables into the OpenSSL functions), or if the command line functions and the python functions are incompatible. </p>
  
  <p>For reference:</p>
  
  <pre><code>Python 2.7.3
  OpenSSL 1.0.1 (March 12)
  </code></pre>