Install & Compatibility
Where this runs
tested against v26.1.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.95 runs
installs and imports cleanly · install 0.0s · import 0.382s · 35.6MB
glibcpy 3.10–3.95 runs
installs and imports cleanly · install 2.4s · import 0.360s · 36MB
34MB installed
● package 34MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
CertificateError
✓ from service_identity import CertificateError
✗ from service_identity import verify_service_identity
VerificationError
✓ from service_identity import VerificationError
SubjectAltNameWarning
✓ from service_identity import SubjectAltNameWarning
This quickstart demonstrates how to use `service-identity` to verify a service's identity against certificate patterns. It shows both successful and failed verification cases, including a simulation of a certificate lacking `subjectAltName` entries, which is a common error scenario.
from service_identity import verify_service_identity
from service_identity.patterns import DNS_ID, DNSPattern
from service_identity.exceptions import CertificateError
# --- Example 1: Successful verification ---
# In a real scenario, certificate_patterns would be extracted from an actual
# certificate object using service_identity.cryptography.extract_patterns()
# or service_identity.pyopenssl.extract_patterns().
certificate_patterns_ok = [
DNSPattern("example.com"),
DNSPattern("www.example.com")
]
service_identity_ok = DNS_ID("www.example.com")
try:
verify_service_identity(certificate_patterns_ok, service_identity_ok)
print(f"[SUCCESS] Service identity '{service_identity_ok.id}' verified.")
except CertificateError as e:
print(f"[FAILURE] Verification failed: {e}")
# --- Example 2: Failed verification (mismatched hostname) ---
certificate_patterns_mismatch = [DNSPattern("example.com")]
service_identity_mismatch = DNS_ID("wrong-host.com")
try:
verify_service_identity(certificate_patterns_mismatch, service_identity_mismatch)
print(f"[SUCCESS] Service identity '{service_identity_mismatch.id}' verified.")
except CertificateError as e:
print(f"[FAILURE] Verification failed: {e}")
# --- Example 3: Failed verification (simulated missing subjectAltName) ---
# This simulates a certificate that has no subjectAltName entries,
# which will always lead to a CertificateError.
certificate_patterns_no_san = []
service_identity_no_san = DNS_ID("anyhost.com")
try:
verify_service_identity(certificate_patterns_no_san, service_identity_no_san)
print(f"[SUCCESS] Service identity '{service_identity_no_san.id}' verified.")
except CertificateError as e:
print(f"[FAILURE] Verification failed (missing SAN): {e}")
Upgrade
Version history
26.1.0latest on PyPI · released May 30, 2026
Audit
Dependencies
attrsrequiredUsed for defining pattern objects.
pyopensslrequiredBackend for extracting service identity patterns from pyOpenSSL certificate objects.
cryptographyrequiredBackend for extracting service identity patterns from cryptography certificate objects.
idnarequiredUsed for IDNA (Internationalized Domain Names in Applications) encoding/decoding.