service-identity

What it is and what it does

service-identity is a certificate verification library that checks whether a cryptography or pyOpenSSL certificate is valid for a given hostname or IP address. It implements RFC 6125 fully, going beyond simple hostname matching to handle wildcards, alternative names, and other service identity verification scenarios. The package protects against man-in-the-middle attacks by ensuring certificates are actually issued for the services you're connecting to.

The library recently dropped its dependency on pyasn1 in favor of cryptography's native Rust-based ASN.1 decoder, simplifying its dependency tree. It works with modern Python versions (3.8 through 3.15) and is actively maintained. The package is particularly useful when building TLS clients or servers that need robust certificate validation beyond what basic SSL libraries provide.

Use it for:

• Verify TLS certificates in custom HTTPS clients to prevent MITM attacks
• Validate certificates in pyOpenSSL-based applications before accepting connections
• Inspect certificate service identities to debug hostname mismatch errors
• Build secure reverse proxies or load balancers that validate upstream certificates
• Implement certificate validation logic in network services

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Verifies that cryptography or pyOpenSSL certificates are valid for a specific hostname or IP address, implementing RFC 6125 hostname verification and service identity inspection.

Yes. This is a focused, well-maintained security library with no known vulnerabilities, low install friction, and permissive licensing. Install it if you're building TLS clients or servers with cryptography or pyOpenSSL and need robust hostname verification beyond basic SSL defaults. The recent removal of pyasn1 dependencies makes it lighter and more maintainable.

Install

service-identity on PyPI

pip install service-identity

uv add service-identity

poetry add service-identity

Installing service-identity

Before you install

Low friction installation with only two runtime dependencies (attrs and cryptography). Actively maintained with recent releases; status is active and supports current Python versions from 3.8 through 3.15.

License in practice

MIT license is permissive; you can use this package freely in commercial and private projects with minimal restrictions.

Quickstart

pip install service-identity

from service_identity import cryptography as si_crypto

# Verify a certificate against a hostname
si_crypto.verify_hostname(cert, hostname)

Requires cryptography 47.0.0 or later (or pyOpenSSL 26.1.0 with cryptography 47.0.0) as the package no longer depends on pyasn1.

Verify before relying

• Exact API surface and available verification methods beyond hostname checking
• Performance characteristics when verifying large certificate batches
• Whether wildcard certificate handling covers all RFC 6125 edge cases beyond the single-label fix

Package facts

Evidence: service_identity-26.1.0-py3-none-any.whl

Keywords: cryptography, openssl, pyopenssl

Tags

More Python Modules packages