Open
Description
Version:
cryptography-44.0.2
Hello developer, I successfully parsed a CRL file with duplicate revoked certificate entries using cryptography. According to RFC 5280:
Each revocation entry is uniquely identified by its serial number.
So, is this a bug?
Code:
from cryptography.x509 import load_pem_x509_crl, load_der_x509_crl
from cryptography.x509 import ExtensionNotFound
import sys
def load_crl(file_path):
with open(file_path, "rb") as f:
crl_data = f.read()
try:
crl = load_pem_x509_crl(crl_data)
except ValueError:
crl = load_der_x509_crl(crl_data)
return crl
def print_crl_issuer(file_path):
crl=load_crl(file_path)
try:
for entry in crl:
print(f"Serial Number: {entry.serial_number}")
print(f"Revocation Date: {entry.revocation_date_utc}")
if entry.extensions:
for ext in entry.extensions:
if ext.oid ==x509.oid.CRLEntryExtensionOID.CRL_REASON:
print(f"reason: {ext.value.reason}")
except Exception as e:
print(f"Error occurred: {e}")
file_path = 'crl_revoked_dublicate.der'
print_crl_issuer(file_path)
Test Case:
crl_revoked_dublicate.zip