gistfile1.py

    # creates a signed cert using openssl.  depends on Debian's default openssl.cnf.
    def _ssl_ca_signed_certificate(self, private_key, subject,
                                   ca_key, ca_cert):
        # Generate a CSR
        csr = self._ssl_self_signed_cert(
            private_key, subject=subject, req=True)

        # Make some FIFOs, where one end is inherited across execve()
        r, w = os.pipe()
        fcntl.fcntl(r, F_SETFD, fcntl.fcntl(r, F_GETFD) & ~FD_CLOEXEC)
        fcntl.fcntl(w, F_SETFD, fcntl.fcntl(r, F_GETFD) | FD_CLOEXEC)
        CAcert_rfd, CAcert_wfd = r, w

        r, w = os.pipe()
        fcntl.fcntl(r, F_SETFD, fcntl.fcntl(r, F_GETFD) & ~FD_CLOEXEC)
        fcntl.fcntl(w, F_SETFD, fcntl.fcntl(r, F_GETFD) | FD_CLOEXEC)
        CAkey_rfd, CAkey_wfd = r, w

        proc = subprocess.Popen(
            ['openssl', 'x509', '-req',
             '-CA', '/dev/fd/%d' % CAcert_rfd,
             '-CAkey', '/dev/fd/%d' % CAkey_rfd,
             '-set_serial', '%d' % int(binascii.hexlify(os.urandom(20)), 16),
             '-days', '3650',
             '-extensions', 'v3_req',
             '-in', '/dev/stdin'],
            stdin=subprocess.PIPE,
            stdout=subprocess.PIPE)

        proc.stdin.write(csr)
        proc.stdin.flush()

        with os.fdopen(CAcert_wfd, 'w') as f:
            f.write(ca_cert)

        with os.fdopen(CAkey_wfd, 'w') as f:
            f.write(ca_key)

        stdout, nostderr = proc.communicate()

        return stdout.strip()