---
id: service-identity
version: "26.1.0"
license: MIT
license_treatment: permissive
maintenance: active
---

# service-identity — Service identity verification for pyOpenSSL & cryptography.

License: permissive · Maintenance: active · Downloads: 16.5M/mo

## What it is and what it does

service-identity is a certificate verification library that checks whether a cryptography or pyOpenSSL certificate is valid for a given hostname or IP address. It implements RFC 6125 fully, going beyond simple hostname matching to handle wildcards, alternative names, and other service identity verification scenarios. The package protects against man-in-the-middle attacks by ensuring certificates are actually issued for the services you're connecting to.

The library recently dropped its dependency on pyasn1 in favor of cryptography's native Rust-based ASN.1 decoder, simplifying its dependency tree. It works with modern Python versions (3.8 through 3.15) and is actively maintained. The package is particularly useful when building TLS clients or servers that need robust certificate validation beyond what basic SSL libraries provide.

Use it for:

- Verify TLS certificates in custom HTTPS clients to prevent MITM attacks
- Validate certificates in pyOpenSSL-based applications before accepting connections
- Inspect certificate service identities to debug hostname mismatch errors
- Build secure reverse proxies or load balancers that validate upstream certificates
- Implement certificate validation logic in network services

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Verifies that cryptography or pyOpenSSL certificates are valid for a specific hostname or IP address, implementing RFC 6125 hostname verification and service identity inspection.

Yes. This is a focused, well-maintained security library with no known vulnerabilities, low install friction, and permissive licensing. Install it if you're building TLS clients or servers with cryptography or pyOpenSSL and need robust hostname verification beyond basic SSL defaults. The recent removal of pyasn1 dependencies makes it lighter and more maintainable.

## Install

pip install service-identity
uv add service-identity
poetry add service-identity

## Installing service-identity

Before you install: Low friction installation with only two runtime dependencies (attrs and cryptography). Actively maintained with recent releases; status is active and supports current Python versions from 3.8 through 3.15.

License in practice: MIT license is permissive; you can use this package freely in commercial and private projects with minimal restrictions.

Quickstart:

pip install service-identity

from service_identity import cryptography as si_crypto

# Verify a certificate against a hostname
si_crypto.verify_hostname(cert, hostname)

Requires cryptography 47.0.0 or later (or pyOpenSSL 26.1.0 with cryptography 47.0.0) as the package no longer depends on pyasn1.

Verify before relying:

- Exact API surface and available verification methods beyond hostname checking
- Performance characteristics when verifying large certificate batches
- Whether wildcard certificate handling covers all RFC 6125 edge cases beyond the single-label fix

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 16.5M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

certificate hostname verification, SSL certificate validation, pyOpenSSL certificate verification, MITM attack prevention, service identity verification, RFC 6125 implementation, cryptography certificate checking, tls-security, certificate-validation

[View on SkillFed](https://skillfed.io/packages/service-identity) · [View on PyPI](https://pypi.org/project/service-identity/)