---
product: Chilkat
product_version: 11.7.0
language: python
language_label: Python
class: XmlCertVault
license: free
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/pythonXmlCertVaultRef.html
---
# Chilkat XmlCertVault — Python — v11.7.0

> Chilkat 11.7.0 · language=python · class=XmlCertVault
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/XmlCertVault.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/python/guide.md`.

## Purpose

**Collect certificates, certificate chains, PEM data, and PFX private keys in an XML vault.**

`Chilkat.XmlCertVault` stores certificates and private-key material in a portable XML-based certificate vault. It can add individual certificates, certificate chains, DER or encoded certificates, PEM files, certificate strings, and PFX/PKCS12 data from files, memory, encoded text, or existing Chilkat objects. The vault can then be exported as XML, loaded from XML, or saved to an XML file for later reuse by other Chilkat certificate and TLS workflows.

**Add certificates**

Add certificates from `Cert` objects, files, PEM strings, binary DER bytes, or encoded data such as Base64 or hex.

**Add certificate chains**

Import an entire `CertChain` when related issuer and intermediate certificates should be kept together in the vault.

**Add PEM content**

Load PEM files containing one or more certificates and/or private keys, including encrypted PEM content when a password is supplied.

**Add PFX / PKCS12**

Add PFX data from a `Pfx` object, file, byte array, or encoded string, using the PFX password to import private-key material.

**Master password protection**

Use `MasterPassword` to protect access to private keys stored in the vault.

**Load and save XML**

Export the vault with `GetXml`, load it with `LoadXml` or `LoadXmlFile`, and persist it with `SaveXml`.

**Common pattern:** Create an `XmlCertVault`, set `MasterPassword` when the vault will contain private keys, add certificates or PFX/PEM material, then save the vault with `SaveXml` or keep the XML string from `GetXml`. Later, reload the same vault with `LoadXml` or `LoadXmlFile` and provide the same master password before using private keys.

**Security note:** Certificates are stored unencrypted, but private keys are stored using 256-bit AES encryption. The individual PFX passwords are also stored encrypted with the vault's `MasterPassword`, which is required to access any private keys contained in the XML vault.

## Object creation, unlocking and error handling

**Object Creation**

```python
obj = chilkat2.XmlCertVault()
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Python.

Minimal complete program:

```python
import chilkat2

# Required once per process. Any string unlocks a 30-day trial; use your purchased code in production.
glob = chilkat2.Global()
if not glob.UnlockBundle("Anything for 30-day trial"):
    print(glob.LastErrorText)
    raise SystemExit(1)

xmlCertVault = chilkat2.XmlCertVault()

success = xmlCertVault.AddCertEncoded("<encodedBytes>", "<encoding>")
if not success:
    print(xmlCertVault.LastErrorText)   # full diagnostic of what went wrong
    raise SystemExit(1)
```

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `string DebugLogFilePath` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `string LastErrorHtml (read-only)` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `string LastErrorText (read-only)` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `string LastErrorXml (read-only)` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `bool LastMethodSuccess` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `bool VerboseLogging` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `string Version (read-only)` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `MasterPassword` | property, read/write | `string MasterPassword` |
| `AddCert` | method | `bool AddCert(Cert cert)` |
| `AddCertBinary` | method | `bool AddCertBinary(memoryview certBytes)` |
| `AddCertChain` | method | `bool AddCertChain(CertChain certChain)` |
| `AddCertEncoded` | method | `bool AddCertEncoded(string encodedBytes, string encoding)` |
| `AddCertFile` | method | `bool AddCertFile(string path)` |
| `AddCertString` | method | `bool AddCertString(string certData)` |
| `AddPemFile` | method | `bool AddPemFile(string path, string password)` |
| `AddPfx` | method | `bool AddPfx(Pfx pfx)` |
| `AddPfxBinary` | method | `bool AddPfxBinary(memoryview pfxBytes, string password)` |
| `AddPfxEncoded` | method | `bool AddPfxEncoded(string encodedBytes, string encoding, string password)` |
| `AddPfxFile` | method | `bool AddPfxFile(string path, string password)` |
| `GetXml` | method | `string GetXml()` |
| `LoadXml` | method | `bool LoadXml(string xml)` |
| `LoadXmlFile` | method | `bool LoadXmlFile(string path)` |
| `SaveXml` | method | `bool SaveXml(string path)` |

## Properties

### XmlCertVault.MasterPassword

`Chilkat 11.7.0 · python · XmlCertVault · MasterPassword · property · read/write · since 9.5.0.40`

```python
string MasterPassword
```

The master password for the vault. Certificates are stored unencrypted, but private keys are stored 256-bit AES encrypted using the individual PFX passwords. The PFX passwords are stored 256-bit AES encrypted using the master password. The master password is required to acces any of the private keys stored within the XML vault.

## Methods

### XmlCertVault.AddCert

`Chilkat 11.7.0 · python · XmlCertVault · AddCert · method · since 9.5.0.40`

```python
bool AddCert(Cert cert)
```

Adds a certificate to the XML vault.

Returns True for success, False for failure.

### XmlCertVault.AddCertBinary

`Chilkat 11.7.0 · python · XmlCertVault · AddCertBinary · method · since 9.5.0.40`

```python
bool AddCertBinary(memoryview certBytes)
```

Adds a certificate to the XML vault from any binary format, such as DER.

Returns True for success, False for failure.

### XmlCertVault.AddCertChain

`Chilkat 11.7.0 · python · XmlCertVault · AddCertChain · method · since 9.5.0.40`

```python
bool AddCertChain(CertChain certChain)
```

Adds a chain of certificates to the XML vault.

Returns True for success, False for failure.

### XmlCertVault.AddCertEncoded

`Chilkat 11.7.0 · python · XmlCertVault · AddCertEncoded · method · since 9.5.0.40`

```python
bool AddCertEncoded(string encodedBytes, string encoding)
```

Adds a certificate to the XML vault where certificate is passed directly from encoded bytes (such as Base64, Hex, etc.). The encoding is indicated by `encoding`.

Returns True for success, False for failure.

### XmlCertVault.AddCertFile

`Chilkat 11.7.0 · python · XmlCertVault · AddCertFile · method · since 9.5.0.40`

```python
bool AddCertFile(string path)
```

Adds a certificate to the XML vault.

Returns True for success, False for failure.

### XmlCertVault.AddCertString

`Chilkat 11.7.0 · python · XmlCertVault · AddCertString · method · since 9.5.0.40`

```python
bool AddCertString(string certData)
```

Adds a certificate from any string representation format such as PEM.

Returns True for success, False for failure.

### XmlCertVault.AddPemFile

`Chilkat 11.7.0 · python · XmlCertVault · AddPemFile · method · since 9.5.0.40`

```python
bool AddPemFile(string path, string password)
```

Adds the contents of a PEM file to the XML vault. The PEM file may be encrypted, and it may contain one or more certificates and/or private keys. The password is optional and only required if the PEM file contains encrypted content that requires a password.

Returns True for success, False for failure.

### XmlCertVault.AddPfx

`Chilkat 11.7.0 · python · XmlCertVault · AddPfx · method · since 9.5.0.40`

```python
bool AddPfx(Pfx pfx)
```

Adds a PFX (PKCS12) to the XML vault.

Returns True for success, False for failure.

### XmlCertVault.AddPfxBinary

`Chilkat 11.7.0 · python · XmlCertVault · AddPfxBinary · method · since 9.5.0.40`

```python
bool AddPfxBinary(memoryview pfxBytes, string password)
```

Adds a PFX to the XML vault where PFX is passed directly from in-memory binary bytes.

Returns True for success, False for failure.

### XmlCertVault.AddPfxEncoded

`Chilkat 11.7.0 · python · XmlCertVault · AddPfxEncoded · method`

```python
bool AddPfxEncoded(string encodedBytes, string encoding, string password)
```

Adds a PFX to the XML vault where PFX is passed directly from encoded bytes (such as Base64, Hex, etc.). The encoding is indicated by `encoding`.

Returns True for success, False for failure.

### XmlCertVault.AddPfxFile

`Chilkat 11.7.0 · python · XmlCertVault · AddPfxFile · method · since 9.5.0.40`

```python
bool AddPfxFile(string path, string password)
```

Adds a PFX file to the XML vault.

Returns True for success, False for failure.

### XmlCertVault.GetXml

`Chilkat 11.7.0 · python · XmlCertVault · GetXml · method · since 9.5.0.40`

```python
string GetXml()
```

Returns the contents of the cert vault as an XML string.

Returns an empty string on failure. Check the `LastMethodSuccess` property to determine success or failure.

### XmlCertVault.LoadXml

`Chilkat 11.7.0 · python · XmlCertVault · LoadXml · method · since 9.5.0.40`

```python
bool LoadXml(string xml)
```

Loads from an XML string.

Returns True for success, False for failure.

### XmlCertVault.LoadXmlFile

`Chilkat 11.7.0 · python · XmlCertVault · LoadXmlFile · method · since 9.5.0.40`

```python
bool LoadXmlFile(string path)
```

Loads from an XML file.

Returns True for success, False for failure.

### XmlCertVault.SaveXml

`Chilkat 11.7.0 · python · XmlCertVault · SaveXml · method · since 9.5.0.40`

```python
bool SaveXml(string path)
```

Saves the contents to an XML file.

Returns True for success, False for failure.

## Related classes

[`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/python/classes/Cert.md), [`CertChain`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/python/classes/CertChain.md), [`Pfx`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/python/classes/Pfx.md)