forked from hiviah/pyx509
-
Notifications
You must be signed in to change notification settings - Fork 5
/
README.txt
83 lines (49 loc) · 2.17 KB
/
README.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
pyx509: X.509 Certificate and PKCS7 Parser / Verifier for Python
################################################################
This is a fork of the original project:
pyx509 - Python library for parsing X.509
Copyright (C) 2009-2012 CZ.NIC, z.s.p.o. (http://www.nic.cz)
Work in progress!
Description
===========
This is probably the most complete parser of X.509 certificates in python.
Code is in alpha stage! Don't use for anything sensitive. I wrote it (based on
previous work of colleagues) since there is no comprehensive python parser for
X.509 certificates. Often python programmers had to parse openssl output.
Advantages
----------
* I find it less painful to use than parsing output of 'openssl x509'
somewhat stricter in extension parsing compared to openssl
Disadvantages
-------------
* It's slow compared to openssl (about 2.3x compared to RHEL's openssl-1.0-fips)
* Currently not very strict in what string types in RDNs it accepts
* API is still rather ugly and has no documentation yet; code is nasty at some
places (and there's some old dangling code like pkcs7/verifier.py)
Dependencies
============
* pyasn1 >= 0.1.7
License
=======
LGPL v2 or later.
See LICENSE.txt.
Known bugs and quirks
=====================
* Subject alternative name doesn't show all subtypes,
but 'DNS', 'dirName' and 'email' are supported.
* Name constraints don't distinguish among various GeneralName subtypes
* Some extensions are not shown very nicely when put in string format
* Not all extensions are supported
* String types accepted for various RDN subelements are rather too permissive
* RDN string conversion does not conform to RFC 4514
* Badly formed extensions are ignored if not marked critical
* easy to switch to more strict behavior
* other clients do this as well; RFC 5280 specifies behavior for unknown
elements in extensions in appendix B.1, but does not cover all cases (e.g.
element exists, but with string type different from spec)
TODO
====
* Publish in Pypi
* Cleanup: This module has it's own pyasn1 models. Look if we can
reuse the pyasn1_modules.rfc2459 X509 cert model.
* Cleanup: Currently, the signature verifier does not work.