pem is an MIT-licensed Python module for parsing and splitting of PEM files, i.e. Base64-encoded DER keys and certificates.

It runs on Python 3.7+, has no dependencies, and does not attempt to interpret the certificate data in any way.

It’s born from the need to load keys, certificates, trust chains, and DH parameters from various certificate deployments: some servers (like Apache) expect them to be a separate file, others (like nginx) expect them concatenated to the server certificate and finally some (like HAProxy) expect key, certificate, and chain to be in one file. With pem, your Python application can cope with all of those scenarios:

>>> import pem
>>> certs = pem.parse_file("chain.pem")
>>> certs
[<Certificate(PEM string with SHA-1 digest '...')>, <Certificate(PEM string with SHA-1 digest '...')>]
>>> str(certs[0])
'-----BEGIN CERTIFICATE-----\n...'

Additionally to the vanilla parsing code, pem also contains helpers for Twisted that save a lot of boilerplate code.

pem is available from PyPI, its documentation lives at Read the Docs, the code on GitHub.

Available as part of the Tidelift Subscription.

The maintainers of pem and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use. Learn more.