Say I have a 256 bit secret and its associated secp256k1 serialized public key, how can I convert to DER? Specifically, I'm using this as a reference: https://github.com/ofek/coincurve/blob/master/tests/samples.py

Hello, I'm stuck on trying to build an extension:

authority_information_access = Extension({'extn_id': ExtensionId('1.3.6.1.5.5.7.1.1'), 'critical': False, 'extn_value': {'access_method': AccessMethod('1.3.6.1.5.5.7.48.5'), 'access_location': GeneralName(URI('http://test.com'))} })

I get:

.virtualenv/lib/python3.5/site-packages/asn1crypto/core.py", line 1100, in __init__ if name not in self._name_map: TypeError: unhashable type: 'URI' while constructing asn1crypto.x509.GeneralName

I tried many ways, like uri = URI() uri.set(value='http://test.com') GeneralName(uri) But no success. Don't know what else to try to make it works

I am trying to create a CMS Enveloped Data using asn1crypto as a substitution of the Google's certificate-transparency source code I forked on my project https://github.com/balena/python-smime. I had the idea of using asn1crypto after having some trouble when parsing indefinite-length attributes generated by certain E-Mail managers (like Thunderbird).

While asn1crypto is great for parsing all kinds of CMS data, I am getting some trouble when generating them. I have an unit test where the PKCS7 output is passed as input to command-line OpenSSL in order to make sure the implementation is compatible. But all I get is an error from OpenSSL when parsing ASN.1 tags (I don't know exactly which one).

There is a single function responsible for returning a CMS ContentInfo structure as follows:

def __get_enveloped_data(pubkey_cipher, sym_cipher, x509_cert,
                         encrypted_key, iv, encrypted_content):
    return cms.ContentInfo({
        'contentType': cms.ContentType(u'enveloped_data'),
        'content': cms.EnvelopedData({
            'version': u'v0',
            'recipient_infos': cms.RecipientInfos([
                cms.RecipientInfo(
                    name='ktri',
                    value=cms.KeyTransRecipientInfo({
                        'version': u'v0',
                        'rid': cms.RecipientIdentifier(
                            name='issuer_and_serial_number',
                            value=__get_issuer_and_serial_number(x509_cert)
                        ),
                        'key_encryption_algorithm': cms.KeyEncryptionAlgorithm({
                            'algorithm': pubkey_cipher.oid,
                            'parameters': core.Null()
                        }),
                        'encrypted_key': encrypted_key
                    })
                )
            ]),
            'encrypted_content_info': cms.EncryptedContentInfo({
                'content_type': cms.ContentType(u'data'),
                'content_encryption_algorithm': cms.EncryptionAlgorithm({
                    'algorithm': sym_cipher.oid,
                    'parameters': iv
                }),
                'encrypted_content': cms.OctetString(
                    encrypted_content, tag=0, tag_type='implicit')
            })
        }, tag=0, tag_type='explicit')
    })

The object returned by the above function is encoded using:

encoded_content = __encode_in_base64(enveloped_data.dump())

And the __encode_in_base64 is just a pretty printer function to convert the DER output into BASE64.

When I execute the OpenSSL function:

$ openssl smime -decrypt -in tmp -inkey private_key.pem

All I get is the following:

Error reading S/MIME message
140702704453280:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1338:
140702704453280:error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error:tasn_dec.c:852:
140702704453280:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:772:Field=type, Type=PKCS7
140702704453280:error:0D0D106E:asn1 encoding routines:B64_READ_ASN1:decode error:asn_mime.c:193:
140702704453280:error:0D0D40CB:asn1 encoding routines:SMIME_read_ASN1:asn1 parse error:asn_mime.c:528:

Do you have any idea what could be the problem? Is there any caveat when encoding asn1crypto structures like the above?

Hi @joernheissler and everyone, I'm stuck on the 'attributes' key of AttributeCertificateInfoV2. I tried many ways, no success:

attribute_certificate_infov2 = cms.AttributeCertificateInfoV2({
                                'version': 1,
                                'serial_number': int(SERIAL),
                                'issuer': cms.AttCertIssuer({
                                    'v1_form':  [GeneralName('directory_name', Name.build({'common_name': EEA_COMMON_NAME})),
                                                 GeneralName('directory_name', Name.build({'organization_name':'Some organization name'})),
                                                 GeneralName('directory_name', Name.build({'organizational_unit_name':'Some CA Name'}))
                                     ]})
                                ,
                                'holder': {
                                        'entity_name': [GeneralName('directory_name',Name.build({'common_name': COMMON_NAME})),
                                                        GeneralName('directory_name',Name.build({'country_name':'BR'})),
                                                        GeneralName('directory_name',Name.build({'organization_name': 'Some organization name'})),
                                                        GeneralName('directory_name',Name.build({'organizational_unit_name':'Some Name'}))
                                                        ]
                                    },
                                'attributes': [cms.AttCertAttribute(cms.AttCertAttributeType('authentication_info'), cms.SvceAuthInfo({'service':Name.build({'common_name':'Test'}), 'ident':Name.build({'common_name':'Test2'})}))],

                                'signature': {
                                    'algorithm': signed_digest_algo,
                                    'parameters': None,
                                },
                                'extensions': (extensions_tuple),

                                'att_cert_validity_period': cms.AttCertValidityPeriod({
                                    'not_before_time': GeneralizedTime(parser.parse(NOT_VALID_BEFORE)),
                                    'not_after_time': GeneralizedTime(parser.parse(NOT_VALID_AFTER))
                                })
                            })

File "agent.py", line 149, in createCertificateOsCrypto
    'attributes': [cms.AttCertAttribute(cms.AttCertAttributeType('authentication_info'), cms.SvceAuthInfo({'service':Name.build({'common_name':'Teste'}), 'ident':Name.build({'common_name':'Test2'})}))],
  File "/root/sigcerta/.virtualenv/lib/python3.5/site-packages/asn1crypto/core.py", line 3154, in __init__
    self.__setitem__(key, value[key])
  File "/root/sigcerta/.virtualenv/lib/python3.5/site-packages/asn1crypto/core.py", line 3310, in __setitem__
    new_value = self._make_value(field_name, field_spec, value_spec, field_params, value)
  File "/root/sigcerta/.virtualenv/lib/python3.5/site-packages/asn1crypto/core.py", line 3541, in _make_value
    wrapper.validate(value.class_, value.tag, value.contents)
  File "/root/sigcerta/.virtualenv/lib/python3.5/site-packages/asn1crypto/core.py", line 1224, in validate
    asn1 = self._format_class_tag(class_, tag)
  File "/root/sigcerta/.virtualenv/lib/python3.5/site-packages/asn1crypto/core.py", line 1243, in _format_class_tag
    return '[%s %s]' % (CLASS_NUM_TO_NAME_MAP[class_].upper(), tag)
KeyError: None

What's wrong? This error is not so helpfull

If I try to use AttributeCertificateInfoV1:

attribute_certificate_infov1 = cms.AttributeCertificateInfoV1({
                            'subject': cms.AttCertSubject('subject_name', [GeneralName('directory_name', Name.build({'common_name': COMMON_NAME}))]),
                            'issuer': [GeneralName('directory_name', Name.build({'common_name': EEA_COMMON_NAME}))],
                            'signature': {
                                'algorithm': signed_digest_algo,
                                'parameters': None,
                            },
                            'serial_number': int(SERIAL),
                            'att_cert_validity_period': cms.AttCertValidityPeriod({
                                'not_before_time': GeneralizedTime(parser.parse(NOT_VALID_BEFORE)),
                                'not_after_time': GeneralizedTime(parser.parse(NOT_VALID_AFTER))
                            }),
                            'extensions': (extensions_tuple),
                            'attributes': [Attribute(ObjectIdentifier('2.5.4.3'), {'common_name': 'test'})]

                            })

I get:

File "agent.py", line 177, in createCertificateOsCrypto
    'attributes': [Attribute( ObjectIdentifier('2.5.4.3'), {'common_name': 'test'})]
  File "/root/sigcerta/.virtualenv/lib/python3.5/site-packages/aenum/__init__.py", line 1961, in __call__
    return cls._create_(value, names, module=module, type=type, start=start)
  File "/root/sigcerta/.virtualenv/lib/python3.5/site-packages/aenum/__init__.py", line 2087, in _create_
    _, first_enum = cls._get_mixins_(bases)
  File "/root/sigcerta/.virtualenv/lib/python3.5/site-packages/aenum/__init__.py", line 2152, in _get_mixins_
    raise TypeError("cannot extend enumerations via subclassing.")
TypeError: cannot extend enumerations via subclassing.

I don't really know how to set the sequence of Attribute object, I tried some ways, no success too.

https://github.com/wbond/asn1crypto/blob/9e15efd73f1b7cfba73cb56b3188eb879480f77c/asn1crypto/_perf/_big_num_ctypes.py#L35-L39

This code may cause SEGV, when binary incompatible OpenSSL version is used in same process. In our case, we use custom (newer) OpenSSL for Python's ssl, uwsgi, cryptography, and pysqlcipher. But asn1crypto loads system's libcrypto and it caused SEGV.

We solved the SEGV by manually removing _perf module. But this manual step is not idiomatic. How about making libcrypto dependency optional and make it asn1crypto (and pyca/cryptography) safe by default?

Hi, thanks for a great library. I am writing a small library intended to be a high level (as in simple to use) library for digitally signing pdf's generated with the WeasyPrint library (https://github.com/Kozea/WeasyPrint).

I have already got it working for self-signed certificates and now I'm working on an adapter for digital signatures from the Globalsign DSS API (https://www.globalsign.com/en/resources/apis/api-documentation/digital-signing-service-api-documentation.html)

This is a direct link to the API Doc for the API call for a timestamp: https://www.globalsign.com/en/resources/apis/api-documentation/digital-signing-service-api-documentation.html#timestamp__digest__get

I get an error when I try to load the timestamp token:

resp = requests.get(self._url + '/timestamp/{digest}'.format(digest=signed_value.hex().upper()))
timestamp_token = resp.json()['token']
timestamp_token = base64.b64decode(timestamp_token)
tsp_resp = tsp.TimeStampResp.load(timestamp_token)

# When I try to access properties I get exceptions
print(tsp_resp['status'])

  File "/usr/local/src/python/WeasySign/weasysign/globalsign.py", line 335, in _sign
    print(tsp_resp['status'])
  File "/usr/local/lib/python3.6/site-packages/asn1crypto/core.py", line 3514, in __getitem__
    raise e
  File "/usr/local/lib/python3.6/site-packages/asn1crypto/core.py", line 3509, in __getitem__
    return self._lazy_child(key)
  File "/usr/local/lib/python3.6/site-packages/asn1crypto/core.py", line 3456, in _lazy_child
    child = self.children[index] = _build(*child)
  File "/usr/local/lib/python3.6/site-packages/asn1crypto/core.py", line 5535, in _build
    METHOD_NUM_TO_NAME_MAP.get(method, method)
ValueError: Error parsing asn1crypto.tsp.PKIStatusInfo - method should have been constructed, but primitive was found
    while parsing asn1crypto.tsp.TimeStampResp

# And when I try to access the 'time_stamp_token' property:
print(tsp_resp['time_stamp_token'])

 File "/usr/local/src/python/WeasySign/weasysign/globalsign.py", line 336, in _sign
    print(tsp_resp['time_stamp_token'])
  File "/usr/local/lib/python3.6/site-packages/asn1crypto/core.py", line 3514, in __getitem__
    raise e
  File "/usr/local/lib/python3.6/site-packages/asn1crypto/core.py", line 3509, in __getitem__
    return self._lazy_child(key)
  File "/usr/local/lib/python3.6/site-packages/asn1crypto/core.py", line 3456, in _lazy_child
    child = self.children[index] = _build(*child)
  File "/usr/local/lib/python3.6/site-packages/asn1crypto/core.py", line 5522, in _build
    CLASS_NUM_TO_NAME_MAP.get(class_, class_)
ValueError: Error parsing asn1crypto.cms.ContentInfo - class should have been universal, but context was found
    while parsing asn1crypto.tsp.TimeStampResp

Do you have an idea of what is wrong? Is globalsign using it a different format for the timestamp token? Thanks Bjarni

v0.21.1

Encountered a p12 file using indefinite length encoding in auth_safe. The Content-Info OctetString is not aggregated correctly from the substrings. The reconstructed OctetString is too large and the native value contains the ASN.1 headers of the substrings instead of only content.

Test case

Input string in hex = '2480040d8dfff0980736af936e423acfcc04159277f7f0e479ffc7dc33b2d03d7b1a186d4472aa490000'

dummy.zip

$ openssl asn1parse -inform DER -in dummy.da2 0:d=0 hl=2 l=inf cons: OCTET STRING
2:d=1 hl=2 l= 13 prim: OCTET STRING [HEX DUMP]:8DFFF0980736AF936E423ACFCC 17:d=1 hl=2 l= 21 prim: OCTET STRING [HEX DUMP]:9277F7F0E479FFC7DC33B2D03D7B1A186D4472AA49 40:d=1 hl=2 l= 0 prim: EOC

Expected behaviour: an OctetString whose native value is a byte string of length 34

>>> data = binascii.unhexlify('2480040d8dfff0980736af936e423acfcc04159277f7f0e479ffc7dc33b2d03d7b1a186d4472aa490000')
>>> x = core.OctetString.load(data)
>>> len(x.native)
34
>>> binascii.hexlify(x.native)
b'8dfff0980736af936e423acfcc9277f7f0e479ffc7dc33b2d03d7b1a186d4472aa49'

Observed behaviour:

>>> data = binascii.unhexlify('2480040d8dfff0980736af936e423acfcc04159277f7f0e479ffc7dc33b2d03d7b1a186d4472aa490000')
>>> x = core.OctetString.load(data)
>>> len(x.native)
38
>>> binascii.hexlify(x.native)
b'040d8dfff0980736af936e423acfcc04159277f7f0e479ffc7dc33b2d03d7b1a186d4472aa49'

## note ASN.1 headers 040d and 0415 are in the native value

I have this code below working, but:

1. I'm unable to read pubkey from the generated certificate. AFAIK, a certificate is composed by some elements, including signature algorithm, public key and the signature itself, so anyone could verify the signature using same algorithm and the pubkey, right? I tried

openssl x509 -pubkey -noout -in cert.pem 
Error getting public key
140003854860736:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:../crypto/asn1/tasn_dec.c:1129:
140003854860736:error:0D06C03A:asn1 encoding routines:asn1_d2i_ex_primitive:nested asn1 error:../crypto/asn1/tasn_dec.c:693:
140003854860736:error:0D08303A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:626:Field=n, Type=RSA
140003854860736:error:0408B004:rsa routines:rsa_pub_decode:RSA lib:../crypto/rsa/rsa_ameth.c:51:
140003854860736:error:0B09407D:x509 certificate routines:x509_pubkey_decode:public key decode error:../crypto/x509/x_pubkey.c:124:

Code:

            try:
                for token in lib.get_tokens():
                    if token.serial.decode() == TOKEN_SERIAL:
                        with token.open(user_pin=PIN) as session:
                            priv = ''
                            pub = ''
                            try:
                                # priv = session.get_key(object_class=pkcs11.constants.ObjectClass.PRIVATE_KEY, label=TOKEN_LABEL)
                                priv = session.get_key(object_class=pkcs11.constants.ObjectClass.PRIVATE_KEY)
                            except pkcs11.exceptions.NoSuchKey:
                                for j in session.get_objects({Attribute.CLASS: ObjectClass.PRIVATE_KEY}):
                                    priv = j
                                    break
                            except pkcs11.exceptions.MultipleObjectsReturned:
                                for j in session.get_objects({Attribute.CLASS: ObjectClass.PRIVATE_KEY}):
                                    priv = j
                                    break

                            certificate = next(session.get_objects({Attribute.CLASS: pkcs11.constants.ObjectClass.CERTIFICATE}))
                            der_bytes = certificate[Attribute.VALUE]
                            pem_bytes = pem.armor('CERTIFICATE', der_bytes)
                            token_certificate = pem_bytes.decode()

                            try:
                                # pub = session.get_key(object_class=pkcs11.constants.ObjectClass.PUBLIC_KEY, label=TOKEN_LABEL)
                                pub = encode_rsa_public_key(session.get_key(object_class=pkcs11.constants.ObjectClass.PUBLIC_KEY))

                            except pkcs11.MultipleObjectsReturned:
                                for i in session.get_objects({Attribute.CLASS: pkcs11.constants.ObjectClass.PUBLIC_KEY}):
                                    pub = encode_rsa_public_key(i)
                                    break

                            except pkcs11.exceptions.NoSuchKey:
                                cert2 = x509.load_pem_x509_certificate(pem.armor('CERTIFICATE', der_bytes),default_backend())
                                # pubdata = cert2.public_key().public_bytes(cryptography.hazmat.primitives.serialization.Encoding.DER,cryptography.hazmat.primitives.serialization.PublicFormat.SubjectPublicKeyInfo)
                                pubdata = cert2.public_key().public_bytes(cryptography.hazmat.primitives.serialization.Encoding.DER,cryptography.hazmat.primitives.serialization.PublicFormat.SubjectPublicKeyInfo)
                                # pub = pem.armor('RSA PUBLIC KEY', pubdata)
                                pub = pubdata

                            NASC_CPF_MATRICULA_RG_SIGLAEXPEDIDOR_UF = NASCIMENTO + CPF + MATRICULA + RG + SIGLAEXPEDIDOR_E_UF
                            INSTENSINO_GRAUESCOLARIDADE_NOMECURSO_MUNICINSTIT_UF = str(INSTENSINO) + str(ESCOLARIDADE) + str(NOME_CURSO) + str(MUNICIPIO_INSTENSINO) + str(UF_INSTENSINO)

                            extension1 = Extension({'extn_id': ExtensionId('2.16.76.1.10.1'),
                                                    'critical': False,
                                                    'extn_value': NASC_CPF_MATRICULA_RG_SIGLAEXPEDIDOR_UF.encode()
                                                    })
                            extension2 = Extension({'extn_id': ExtensionId('2.16.76.1.10.2'),
                                                    'critical': False,
                                                    'extn_value': unidecode.unidecode(
                                                        INSTENSINO_GRAUESCOLARIDADE_NOMECURSO_MUNICINSTIT_UF).encode()
                                                    })

                            extension3 = False

                            if NOME_SOCIAL is not False or NOME_SOCIAL != "False":
                                extension3 = Extension({'extn_id': ExtensionId('2.16.76.1.4.3'),
                                                        'critical': False,
                                                        'extn_value': unidecode.unidecode(
                                                            NOME_SOCIAL).encode()
                                                        })


                            authority_key_identifier = Extension({
                                'extn_id': ExtensionId('authority_key_identifier'),
                                'critical': False,
                                'extn_value': AuthorityKeyIdentifier({
                                  'key_identifier': AUTHORITY_KEY_IDENTIFIER.encode()
                                    })
                            })

                            authority_information_access = Extension({
                                'extn_id': ExtensionId('authority_information_access'),
                                'critical': False,
                                'extn_value': [{
                                    'access_method': AccessMethod('1.3.6.1.5.5.7.48.5'),
                                    'access_location': GeneralName('uniform_resource_identifier', URI(AUTHORITY_INFORMATION_ACCESS))
                                }]
                            })
                            crl_distribution_point = Extension({
                                'extn_id': ExtensionId('crl_distribution_points'),
                                'critical': False,
                                'extn_value': [{
                                    'distribution_point': DistributionPointName('full_name', [GeneralName('uniform_resource_identifier', URI(CRL_DISTRIBUTION_POINT))]),
                                    # 'crl_issuer': [GeneralName('uniform_resource_identifier', URI(CRL_DISTRIBUTION_POINT))]
                                }]
                            })

                            # sha256_rsa
                            signed_digest_algo = 'sha256_rsa'


                            if extension3:
                                extensions_tuple = (extension1, extension2, extension3, authority_information_access, crl_distribution_point, authority_key_identifier)
                            else:
                                extensions_tuple = (extension1, extension2, authority_information_access, crl_distribution_point, authority_key_identifier)


                            tbs = TbsCertificate({
                                'version': Version(1),
                                'serial_number': int(SERIAL),
                                'issuer': Name.build({
                                    'common_name': EEA_COMMON_NAME,
                                }),
                                'subject': Name.build({
                                    'common_name': COMMON_NAME,
                                }),
                                'signature': {
                                    'algorithm': signed_digest_algo,
                                    'parameters': None,
                                },
                                'extensions': (extensions_tuple),

                                'validity': {
                                    'not_before': Time({
                                        'general_time': GeneralizedTime(parser.parse(NOT_VALID_BEFORE)),
                                    }),
                                    'not_after': Time({
                                        'general_time': GeneralizedTime(parser.parse(NOT_VALID_AFTER)),
                                    }),
                                },
                                'subject_public_key_info': {
                                    'algorithm': {
                                        'algorithm': 'rsa',
                                        'parameters': None,
                                    },
                                    # 'public_key': RSAPublicKey.load(encode_rsa_public_key(pub)),
                                    'public_key': RSAPublicKey.load(pub),
                                }
                            })

                            # Sign the TBS Certificate
                            value = priv.sign(tbs.dump(),
                                              mechanism=Mechanism.SHA256_RSA_PKCS)

                            cert = Certificate({
                                'tbs_certificate': tbs,
                                'signature_algorithm': {
                                    'algorithm': signed_digest_algo,
                                    'parameters': None,
                                },
                                'signature_value': value,
                            })
                            attribute_certificate = pem.armor('CERTIFICATE', cert.dump()).decode()
                            return (attribute_certificate + token_certificate).strip()
                    else:
                        return 'Token not found'
            except TokenNotPresent:
                pass

I noticed that the PrimePoint class for elliptic curve implements multiplication and addition over an elliptic curve. Internally it uses a pure Python implementation with an optional accelerator for inverse mod using CFFI and OpenSSL's big numbers. I'm rather worried about the custom implementation in asn1crypto. It doesn't seem to implement protection against malicious input, see https://safecurves.cr.yp.to/

Does asn1crypto really need to come with a custom EC math implementation? After all isn't its primary purpose ASN.1 handling and a high level interface to common ASN.1 data structures?

Trying to run the unittests in my environment I could not get them to work:

[cooper:~/asn1crypto-0.22.0:]$ ~/virtualenvs/setup_py_fun/bin/python3 setup.py test
running test
running egg_info
writing asn1crypto.egg-info/PKG-INFO
writing dependency_links to asn1crypto.egg-info/dependency_links.txt
writing top-level names to asn1crypto.egg-info/top_level.txt
reading manifest file 'asn1crypto.egg-info/SOURCES.txt'
writing manifest file 'asn1crypto.egg-info/SOURCES.txt'
running build_ext
tests (unittest.loader._FailedTest) ... ERROR

======================================================================
ERROR: tests (unittest.loader._FailedTest)
----------------------------------------------------------------------
ImportError: Failed to import test module: tests
Traceback (most recent call last):
  File "/usr/local/lib/python3.6/unittest/loader.py", line 153, in loadTestsFromName
    module = __import__(module_name)
ModuleNotFoundError: No module named 'tests'


----------------------------------------------------------------------
Ran 1 test in 0.000s

FAILED (errors=1)
Test failed: <unittest.runner.TextTestResult run=1 errors=1 failures=0>
error: Test failed: <unittest.runner.TextTestResult run=1 errors=1 failures=0>

Playing with setup.py now.

Closes: #147

Work in Progress

This breaks a few test cases, see travis. I wonder if those certificates are correct or not. There are two edge cases to consider:

• unused bits are all zero. Should the code ignore those unused bits instead of breaking?
• unused bits are not all zero. Should those be kept, zeroed out or should an exception be raised?

I've found the bug in this commit: link to commit c29117fd57deb80fb345cf76cad9d0d48e8bbf17 Definition of length of asn1 package in this part of code "self._header[-1:] == b'\x80':" is incorrect. According this documentation: https://www.w3.org/Protocols/HTTP-NG/asn1.html For the definite form, if the length is less than 128, you just use a single byte, with the high bit set to zero. Otherwise the high bit is set to one, and the low seven bits set to the length of length. The length is then encoded in that many bytes.

More correct code is:

if self._header is not None and  self._header[1]<128 and  self._header[-1:] == b'\x80':

    force = True

While checking a certificate using OCSP, I get the following exception: (Hashed lines added using print(...) just before the exception happens)

# ocsp url=http://ocsp.quovadisglobal.com
# ocsp request=<urllib.request.Request object at 0x7efe1df7ada0>
# ocsp dump=b'0|0z0Q0O0M0\t\x06\x05+\x0e\x03\x02\x1a\x05\x00\x04\x14\xf2\x85\xc2\x91\xd4\x0e\x17\x85\x02\xc5e\x1by\xbb\xe4\xfcL;\x18u\x04\x14\x1a\x84b\xbcHL3%\x04\xd4\xee\xd0\xf6\x03\xc4\x19F\xd1\x94k\x02\x14\x1an\xe8\x93\xc3t\x978\xe1*\xcc\xc7z\x8c\n\xcb\x16~\xaf\x14\xa2%0#0!\x06\t+\x06\x01\x05\x05\x070\x01\x02\x04\x14\x04\x12\x04\x10k\xaf1n\xfd\x0e=\x9f\xacwQ\xd5#\x9d\xc7x'
# urlopen status=200, reason=OK, headers=Date: Thu, 17 Nov 2022 17:50:55 GMT
Server: Apache
Content-Type: application/ocsp-response
Content-Length: 5
Connection: close


# ocsp response=<asn1crypto.ocsp.OCSPResponse 139629889564456 b'0\x03\n\x01\x06'>
# request nonce=<asn1crypto.core.OctetString 139629889697216 b'\x04\x12\x04\x10k\xaf1n\xfd\x0e=\x9f\xacwQ\xd5#\x9d\xc7x'>
UNKNOWN: Exception caught during EAPOL check: 'Void' object is not subscriptable
Traceback (most recent call last):
  File "./check_ocsp.py", line 102, in main
    file_name, verbose=verbose
  File "./check_ocsp.py", line 54, in validate_certificate_chain
    validator.validate_usage(set(usage))
  File "/home/zeuz/git/wpa_eapol_checker/venv/lib64/python3.6/site-packages/certvalidator/__init__.py", line 193, in validate_usage
    self._validate_path()
  File "/home/zeuz/git/wpa_eapol_checker/venv/lib64/python3.6/site-packages/certvalidator/__init__.py", line 121, in _validate_path
    validate_path(self._context, candidate_path)
  File "/home/zeuz/git/wpa_eapol_checker/venv/lib64/python3.6/site-packages/certvalidator/validate.py", line 50, in validate_path
    return _validate_path(validation_context, path)
  File "/home/zeuz/git/wpa_eapol_checker/venv/lib64/python3.6/site-packages/certvalidator/validate.py", line 386, in _validate_path
    end_entity_name_override=end_entity_name_override
  File "/home/zeuz/git/wpa_eapol_checker/venv/lib64/python3.6/site-packages/certvalidator/validate.py", line 891, in verify_ocsp_response
    ocsp_responses = validation_context.retrieve_ocsps(cert, issuer)
  File "/home/zeuz/git/wpa_eapol_checker/venv/lib64/python3.6/site-packages/certvalidator/context.py", line 497, in retrieve_ocsps
    **self._ocsp_fetch_params
  File "/home/zeuz/git/wpa_eapol_checker/venv/lib64/python3.6/site-packages/certvalidator/ocsp_client.py", line 114, in fetch
    response_nonce = ocsp_response.nonce_value
  File "/home/zeuz/git/wpa_eapol_checker/venv/lib64/python3.6/site-packages/asn1crypto/ocsp.py", line 671, in nonce_value
    self._set_extensions()
  File "/home/zeuz/git/wpa_eapol_checker/venv/lib64/python3.6/site-packages/asn1crypto/ocsp.py", line 631, in _set_extensions
    for extension in self['response_bytes']['response'].parsed['tbs_response_data']['response_extensions']:
TypeError: 'Void' object is not subscriptable

Minimum working implementation:

# High-level API for cert validation
from asn1crypto import pem
from certvalidator import CertificateValidator, ValidationContext, errors

# Lower-level API for cert info
from cryptography import x509


def load_certs(cert_file):
    end_entity_cert = None
    intermediates = []
    with open(cert_file, "rb") as f:
        data = f.read()
        if not pem.detect(data):
            raise RuntimeError("Invalid cert contents")
        # Usually, the cert is the first part and then the intermediates follow; Seemingly Radiator doesn't follow this convention.
        for _type_name, _headers, der_bytes in pem.unarmor(data, multiple=True):
            cert = x509.load_der_x509_certificate(der_bytes)
            key_usages = cert.extensions.get_extension_for_class(x509.KeyUsage)
            if key_usages.value.key_cert_sign:
                intermediates.append(der_bytes)
            else:
                end_entity_cert = der_bytes
    return intermediates, end_entity_cert


def validate_certificate_chain( cert_file, usage=["key_encipherment"]):
    # Checks certificate chain for: usage
    rc = 1
    msg = "Unknown validation status"
    intermediates, end_entity_cert = load_certs(cert_file)
    try:
        validation_context = ValidationContext( allow_fetching=True, revocation_mode="soft-fail")
        validator = CertificateValidator( end_entity_cert, intermediates, validation_context)
        validator.validate_usage(set(usage))
        rc = 0
        msg = "Cert valid"
    except (errors.PathValidationError) as e:
        msg = getattr(e, "message", e)
        rc = 1
    except (errors.PathBuildingError) as e:
        msg = getattr(e, "message", e)
        rc = 1
    return rc, msg

validate_certificate_chain('ocsp-fail.pem')

--> If I set allow_fetching=False when creating ValidationContext, I don't get the exception, but OCSP is not validated.

cms.py contains TWO definitions of "class RecipientKeyIdentifier". Unfortunately, the first defines the field "subject_key_identifier" and the latter defines the field "subjectKeyIdentifier". This snowballs, causing problems due to Python binding time rules. That is, the definition of KeyAgreementRecipientIdentifier picks up the former definition, but a program that imports cms.py will pick up the latter.

To wit, the following fails:

>>> temp=RecipientKeyIdentifier()
>>> temp['subjectKeyIdentifier'] = b'12345678'
>>> KeyAgreementRecipientIdentifier(name='r_key_id', value=temp)

The following works, but it took me over a day to figure out what was going on:

>>> temp.native
OrderedDict([('subjectKeyIdentifier', b'12345678'), ('date', None), ('other', None)])
>>> temp2=util.OrderedDict([('subject_key_identifier', b'12345678'), ('date', None), ('other', None)])
>>> KeyAgreementRecipientIdentifier(name='r_key_id', value=temp2)