title: Verify SSL/X.509 certificate is signed by another certificate
body: <p><strong>Question</strong></p>
  
  <p>How can I verify that an X.509 certificate is signed by another certificate using PyOpenSSL or Twisted? I want a client to verify that the received server certificate is the one that signed its client certificate.</p>
  
  <p>I've looked through the PyOpenSSL documentation and can't seem to find anything on how to verify a certificate separately from the establishing the SSL connection.</p>
  
  <p>I found a reference to <code>OpenSSL.crypto:X509.verify()</code> in <code>twisted.internet._sslverify:PublicKey.verifyCertificate()</code> , but the twisted method is commented out (in Twisted 13.0) and the X509 method does not exist (in PyOpenSSL 0.13).</p>
  
  <p><a href="https://bugs.launchpad.net/pyopenssl/+bug/892522" rel="nofollow">pyOpenSSL has no support for verifying a certificate</a> describes a bug for not being able to manually verify a certificate chain, but I'm not entirely sure if that's what I'm trying to do.</p>
  
  <p><strong>Use Case</strong></p>
  
  <p>Certificates:</p>
  
  <ul>
  <li><p>Generated self-signed CA certificate with openssl.</p></li>
  <li><p>Generated server certificate signed by CA certificate.</p></li>
  <li><p>Generated client certificate signed by server certificate.</p></li>
  </ul>
  
  <p>Setup:</p>
  
  <ul>
  <li><p>The server is using Twisted's <a href="http://twistedmatrix.com/documents/current/api/twisted.internet.ssl.CertificateOptions.html" rel="nofollow">CertificateOptions</a> with its server cert. The CA certs are the CA and server certs to setup a chain where the server cert verifies the received client cert, and the CA cert verifies the server cert (all built-in functionality).</p></li>
  <li><p>The client is also using CertificateOptions for the client cert. The CA certs only contains the CA cert.</p></li>
  </ul>
  
  <p>This all works fine (both sides verify each other) but I want to perform an additional step:</p>
  
  <ul>
  <li>In the client <a href="http://pyopenssl.sourceforge.net/pyOpenSSL.html/openssl-context.html#l2h-141" rel="nofollow">set_verify()</a> callback, verify that the client cert is signed by the server cert.</li>
  </ul>