certvalidator
This library started as a fork of wbond/certvalidator with patches for pyHanko, but has since diverged considerably from its parent repository.
GitHub issues are disabled on this repository. Bug reports regarding this library should be submitted to the pyHanko issue tracker. Similarly, questions regarding this library's usage can be asked in the pyHanko discussion forum.
pyhanko-certvalidator is a Python library for validating X.509 certificates paths. It supports various
options, including: validation at a specific moment in time, whitelisting and revocation checks.
Features
- X.509 path building
- X.509 basic path validation
- Signatures
- RSA (including PSS padding), DSA, ECDSA and EdDSA algorithms.
- Name chaining
- Validity dates
- Basic constraints extension
- CA flag
- Path length constraint
- Key usage extension
- Extended key usage extension
- Certificate policies
- Policy constraints
- Policy mapping
- Inhibit anyPolicy
- Failure on unknown/unsupported critical extensions
- Signatures
- Blacklisting hash algorithms
- Revocation checks
- CRLs
- Indirect CRLs
- Delta CRLs
- OCSP checks
- Delegated OCSP responders
- Disable, require or allow soft failures
- Caching of CRLs/OCSP responses
- CRLs
- CRL and OCSP HTTP clients
- Point-in-time validation
- Name constraints
- Attribute certificate support
Current Release
Dependencies
- asn1crypto
- cryptography
- uritools
- oscrypto
- requests or aiohttp (use the latter for more efficient asyncio, requires resource management)
- Python 3.7 or higher
Note on compatibility
Starting with pyhanko-certvalidator version 0.17.0, the library has been refactored to use asynchronous I/O as much as possible. Most high-level API entrypoints can still be used synchronously, but have been deprecated in favour of their asyncio equivalents.
As part of this move, the OCSP and CRL clients now have two separate implementations: a requests-based one, and an aiohttp-based one. The latter is probably more performant, but requires more resource management efforts on the caller's part, which was impossible to implement without making major breaking changes to the public API that would make the migration path more complicated. Therefore, the requests-based fetcher will remain the default for the time being.
Installation
pip install pyhanko-certvalidator
License
certvalidator is licensed under the terms of the MIT license. See the LICENSE file for the exact license text.
Testing
Test framework
Tests are written using pytest and require an asynchronous test case backend
such as pytest-asyncio.
Test cases
The test cases for the library are comprised of:
- Public Key Interoperability Test Suite from NIST
- OCSP tests from OpenSSL
- Various certificates generated for bespoke X.509 certificate validation scenarios
Existing releases can be found at https://pypi.org/project/pyhanko-certvalidator.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file pyhanko_certvalidator-0.32.1.tar.gz.
File metadata
- Download URL: pyhanko_certvalidator-0.32.1.tar.gz
- Upload date:
- Size: 597.2 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
4780e5697f9d8a02fb4648a1b8f2cd0df67615cae491298491467ca53c0fc08d
|
|
| MD5 |
c20cb2b4a926793a5163f788e5f9aab2
|
|
| BLAKE2b-256 |
2d94559f4ffadb51fbc33d0ce8cee34f1a32f1ee6d4ada3495d6e7ef1c9d1a0c
|
Provenance
The following attestation bundles were made for pyhanko_certvalidator-0.32.1.tar.gz:
Publisher:
release.yml on MatthiasValvekens/pyHanko
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
pyhanko_certvalidator-0.32.1.tar.gz -
Subject digest:
4780e5697f9d8a02fb4648a1b8f2cd0df67615cae491298491467ca53c0fc08d - Sigstore transparency entry: 2778653390
- Sigstore integration time:
-
Permalink:
MatthiasValvekens/pyHanko@6cd63e82e2ea91e62bdb78d8980c08cc100cdb22 -
Branch / Tag:
refs/tags/pyhanko-certvalidator/v0.32.1 - Owner: https://github.com/MatthiasValvekens
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@6cd63e82e2ea91e62bdb78d8980c08cc100cdb22 -
Trigger Event:
workflow_dispatch
-
Statement type:
File details
Details for the file pyhanko_certvalidator-0.32.1-py3-none-any.whl.
File metadata
- Download URL: pyhanko_certvalidator-0.32.1-py3-none-any.whl
- Upload date:
- Size: 115.7 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
76100cdda13bd085beaa94d4b9080fe6f4ee67248976ec9a19c4d58642558a2b
|
|
| MD5 |
80c27bcaafa63b07f115c64ddeb9cc85
|
|
| BLAKE2b-256 |
f44981f92016547077d004a883864da9148e725741f365064a1c9dfe5558f49a
|
Provenance
The following attestation bundles were made for pyhanko_certvalidator-0.32.1-py3-none-any.whl:
Publisher:
release.yml on MatthiasValvekens/pyHanko
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
pyhanko_certvalidator-0.32.1-py3-none-any.whl -
Subject digest:
76100cdda13bd085beaa94d4b9080fe6f4ee67248976ec9a19c4d58642558a2b - Sigstore transparency entry: 2778653607
- Sigstore integration time:
-
Permalink:
MatthiasValvekens/pyHanko@6cd63e82e2ea91e62bdb78d8980c08cc100cdb22 -
Branch / Tag:
refs/tags/pyhanko-certvalidator/v0.32.1 - Owner: https://github.com/MatthiasValvekens
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@6cd63e82e2ea91e62bdb78d8980c08cc100cdb22 -
Trigger Event:
workflow_dispatch
-
Statement type:
