Method load_cert_chain

crates/stdlib/src/openssl.rs:1833–1969

(&self, args: LoadCertChainArgs, vm: &VirtualMachine)

        #[pymethod]
        fn load_cert_chain(&self, args: LoadCertChainArgs, vm: &VirtualMachine) -> PyResult<()> {
            use openssl::pkey::PKey;
            use std::cell::RefCell;

            let LoadCertChainArgs {
                certfile,
                keyfile,
                password,
            } = args;

            let mut ctx = self.builder();
            let key_path = keyfile.map(|path| path.to_path_buf(vm)).transpose()?;
            let cert_path = certfile.to_path_buf(vm)?;

            // Check file existence before calling OpenSSL to get proper errno
            if !cert_path.exists() {
                return Err(vm
                    .new_os_subtype_error(
                        vm.ctx.exceptions.file_not_found_error.to_owned(),
                        Some(libc::ENOENT),
                        format!("No such file or directory: '{}'", cert_path.display()),
                    )
                    .upcast());
            }
            if let Some(ref kp) = key_path
                && !kp.exists()
            {
                return Err(vm
                    .new_os_subtype_error(
                        vm.ctx.exceptions.file_not_found_error.to_owned(),
                        Some(libc::ENOENT),
                        format!("No such file or directory: '{}'", kp.display()),
                    )
                    .upcast());
            }

            // Load certificate chain
            ctx.set_certificate_chain_file(&cert_path)
                .map_err(|e| convert_openssl_error(vm, e))?;

            // Load private key - handle password if provided
            let key_file_path = key_path.as_ref().unwrap_or(&cert_path);

            // PEM_BUFSIZE = 1024 (maximum password length in OpenSSL)
            const PEM_BUFSIZE: usize = 1024;

            // Read key file data
            let key_data = std::fs::read(key_file_path)
                .map_err(|e| crate::vm::convert::ToPyException::to_pyexception(&e, vm))?;

            let pkey = if let Some(ref pw_obj) = password {
                if pw_obj.is_callable() {
                    // Callable password - use callback that calls Python function
                    // Store any Python error that occurs in the callback
                    let py_error: RefCell<Option<PyBaseExceptionRef>> = RefCell::new(None);

                    let result = PKey::private_key_from_pem_callback(&key_data, |buf| {
                        // Call the Python password callback