# 11. `example_pki_blocks.py` — Format-agnostic PKI reader
[← Example index](index.md) · [example_pki_blocks.py on Codeberg](https://codeberg.org/abbra/synta/src/branch/main/examples/example_pki_blocks.py)
Bindings: `read_pki_blocks`.
- Pass PEM, DER, PKCS#7, and PKCS#12 bytes to `read_pki_blocks` and print the
`(label, len(der))` tuples returned.
- Show PKCS#12 password handling.
## Source
```python
#!/usr/bin/env python3
"""
Example 10: Format-agnostic PKI reader.
Demonstrates: read_pki_blocks — accepts PEM, DER, PKCS#7, and PKCS#12 bytes and
returns a list of (label, der_bytes) tuples.
Labels returned:
"CERTIFICATE" — X.509 certificate (from any format)
"PRIVATE KEY" — PKCS#8 OneAsymmetricKey (from PKCS#12 keyBag /
pkcs8ShroudedKeyBag, or PEM PRIVATE KEY blocks)
"""
import pathlib
import synta
VECTORS = pathlib.Path(__file__).parent.parent / "tests" / "vectors"
CRYPTO_PKCS12 = (
VECTORS
/ "cryptography"
/ "vectors"
/ "cryptography_vectors"
/ "pkcs12"
)
def section(title):
print(f"\n{'─' * 60}\n{title}\n{'─' * 60}")
def demo_pem_input():
section("read_pki_blocks — PEM certificate input")
path = VECTORS / "test_certificate.pem"
if not path.exists():
print(f" Skipped: {path} not found")
return
pem_data = path.read_bytes()
blocks = synta.read_pki_blocks(pem_data)
print(f" Found {len(blocks)} block(s)")
for label, der in blocks:
print(f" label={label!r} der_len={len(der)}")
cert = synta.Certificate.from_der(der)
print(f" subject={cert.subject}")
def demo_der_input():
section("read_pki_blocks — DER certificate input")
path = VECTORS / "test_certificate.der"
if not path.exists():
print(f" Skipped: {path} not found")
return
der_data = path.read_bytes()
blocks = synta.read_pki_blocks(der_data)
print(f" Found {len(blocks)} block(s)")
for label, der in blocks:
print(f" label={label!r} der_len={len(der)}")
def demo_pkcs7_input():
section("read_pki_blocks — PKCS#7 bundle input")
path = VECTORS / "test_bundle_2certs.p7b"
if not path.exists():
print(f" Skipped: {path} not found")
return
p7b_data = path.read_bytes()
blocks = synta.read_pki_blocks(p7b_data)
print(f" Found {len(blocks)} block(s)")
for i, (label, der) in enumerate(blocks):
cert = synta.Certificate.from_der(der)
print(f" [{i}] label={label!r} subject={cert.subject}")
def demo_pkcs12_no_password():
section("read_pki_blocks — PKCS#12 (no password, certs only)")
path = VECTORS / "test_bundle_nopass.p12"
if not path.exists():
print(f" Skipped: {path} not found")
return
p12_data = path.read_bytes()
blocks = synta.read_pki_blocks(p12_data)
print(f" Found {len(blocks)} block(s)")
for i, (label, der) in enumerate(blocks):
cert = synta.Certificate.from_der(der)
print(f" [{i}] label={label!r} subject={cert.subject}")
def demo_pkcs12_with_key():
section("read_pki_blocks — PKCS#12 with cert + unencrypted key")
path = CRYPTO_PKCS12 / "cert-none-key-none.p12"
if not path.exists():
print(f" Skipped: {path} not found")
return
p12_data = path.read_bytes()
blocks = synta.read_pki_blocks(p12_data)
print(f" Found {len(blocks)} block(s)")
for i, (label, der) in enumerate(blocks):
if label == "CERTIFICATE":
cert = synta.Certificate.from_der(der)
print(f" [{i}] label={label!r} subject={cert.subject}")
else:
# "PRIVATE KEY" — raw PKCS#8 DER, tag 0x30
print(f" [{i}] label={label!r} der_len={len(der)} bytes tag=0x{der[0]:02x}")
def demo_pkcs12_with_password():
section("read_pki_blocks — PKCS#12 with password")
path = VECTORS / "test_bundle_pass.p12"
if not path.exists():
print(f" Skipped: {path} not found")
return
p12_data = path.read_bytes()
try:
blocks = synta.read_pki_blocks(p12_data, b"synta")
print(f" Found {len(blocks)} block(s) with correct password")
for i, (label, der) in enumerate(blocks):
if label == "CERTIFICATE":
cert = synta.Certificate.from_der(der)
print(f" [{i}] label={label!r} subject={cert.subject}")
else:
print(f" [{i}] label={label!r} der_len={len(der)} bytes")
except ValueError as e:
print(f" ValueError: {e}")
print(" (Encrypted PKCS#12 requires the 'openssl' feature)")
def demo_multi_block_pem():
section("read_pki_blocks — multi-block PEM chain")
pem1 = (VECTORS / "test_certificate.pem").read_bytes()
pem2 = (VECTORS / "test_certificate2.pem").read_bytes()
if not (VECTORS / "test_certificate.pem").exists():
print(" Skipped: test vectors not found")
return
blocks = synta.read_pki_blocks(pem1 + pem2)
print(f" Found {len(blocks)} block(s) in two-cert PEM chain")
for label, der in blocks:
print(f" label={label!r} der_len={len(der)}")
def main():
print("=" * 60)
print("Example 10: Format-agnostic PKI reader (read_pki_blocks)")
print("=" * 60)
demo_pem_input()
demo_der_input()
demo_pkcs7_input()
demo_pkcs12_no_password()
demo_pkcs12_with_key()
demo_pkcs12_with_password()
demo_multi_block_pem()
print("\nAll read_pki_blocks examples completed.")
if __name__ == "__main__":
main()
```