-
Notifications
You must be signed in to change notification settings - Fork 43
Open
Description
See for instance this seemingly correct code:
try:
certificates = [
X509Certificate.from_der(raw_leaf),
*(X509Certificate.from_der(raw) for raw in raw_intermediates)
]
except ValueError:
return ValidateX509TrustchainBadOutcome.INVALID_DER_X509_CERTIFICATE
current = certificates[0]
already_seen: set[bytes] = set()
while True:
already_seen.add(current.subject())
...The trick is X509Certificate.from_der never raise any exception ! Instead the actual certificate validation is done lazily when calling current.subject() :/
This is error prone and not needed. Instead we should:
- Have
X509Certificate.from_derdoing the validation and raise aValueErrorif the provided certificate is invalid - Rename
X509Certificate.try_from_pemintoX509Certificate.from_pemand also have this function do the validation eagerly (thetry_prefix is not something Pythonic) - Replace the
subject()andissuer()method by simple properties
AureliaDolo
Metadata
Metadata
Assignees
Labels
No labels