Nice getter for CRLDistributionPoints?

[OlegAndrianov]

Hi, it appears there is no good and easy way to extract a CDP list from a certificate object (or it is not very well documented).
Would love to have this added to the Certificate Object or at least to the CRLDistributionPoints extention object.
This way i will be able to get a list of URIs to work with -get the CRLs, check connections, etc.
(Same goes for OCSP)

[alex]

Given a certificate, you can get the CRLDP extension with https://cryptography.io/en/latest/x509/reference/#cryptography.x509.Extensions.get_extension_for_class

Then you'll have a https://cryptography.io/en/latest/x509/reference/#cryptography.x509.CRLDistributionPoints and you can access whatever attributes you need.

[github-actions]

This issue has been waiting for a reporter response for 3 days. It will be auto-closed if no activity occurs in the next 5 days.

[OlegAndrianov]

Alex, that is my issue, the object as far as i see can only return me oid field, that i do not need, and i need a list of distribution points. Can you advise how can i get them?

[reaperhulk]

It is an iterable so you can iterate over it to get distribution points.

[OlegAndrianov]

Are you sure?

   print (len(cdp))
           ^^^^^^^^
TypeError: object of type 'Extension' has no len()
    print (cdp[0])
               ^^^
TypeError: 'Extension' object is not subscriptable
    print (next(cdp))
           ^^^^^^^^^
TypeError: 'Extension' object is not an iterator
    print (list(cdp))
           ^^^^^^^^^
TypeError: 'Extension' object is not iterable

[alex]

You need to access the .value attribute to get the CDP value

…

On Wed, Jan 8, 2025, 2:44 PM Oleg Andrianov ***@***.***> wrote: Are you sure? print (len(cdp)) ^^^^^^^^ TypeError: object of type 'Extension' has no len() print (cdp[0]) ^^^ TypeError: 'Extension' object is not subscriptable print (next(cdp)) ^^^^^^^^^ TypeError: 'Extension' object is not an iterator print (list(cdp)) ^^^^^^^^^ TypeError: 'Extension' object is not iterable — Reply to this email directly, view it on GitHub <#12234 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBG4BLUQUI7VLMYP7BT2JV5Z5AVCNFSM6AAAAABUS6Q5SWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNZYGQ4TGOJWGY> . You are receiving this because you commented.Message ID: ***@***.***>

[OlegAndrianov]

Oh, that value attribute was not int he documentation, so that confused me,
Ok, so it appears to get a CRL URLs i need to do:

    for ext in cert.extensions:
        if ext.oid.dotted_string == "2.5.29.31":
            cdps = ext.value  # iterable of distribution points
            break
    if cdps:  # if exists cause certs might not have it at all.
        for dp in cdps:  # cdps is a list
            for name in dp.full_name:  # because it is also a list 
                crlnames.append(url)

So i am back to my original question:
can we have a nice getter to get a list of all URLs right from the extension object (even better for certificate object).
I guess we can not because it is not always URLs, right? it almost feels like a supporting function that will extract ONLY URLs, will be helpfull.

[alex]

You can simplify this code a bit with cert.extensions.get_extension_for_class(x509.CRLDistributionPoints).

But yes, your intuition is basically right: there's no guarantee that a CRL DP will have any particular structure, which means writing utilities to handle one use case need lots of different behaviors (what should happen if not all elements are URLs? Exception? Silently ignore? Does it need to handle relative names? Filter for different reasons?)

For that reason, we generally prefer offering APIs with full generality, and then encourage users to write and publish their utilities that cover exactly their case cases.

[OlegAndrianov]

Yeah, but i wish the .value thing was better documented. Autocomplete offers only .oid as possible method for extension.

[alex]

We'd be delighted to get a PR to the docs making the `.value` attribute more clear.

…

On Wed, Jan 8, 2025 at 7:50 PM Oleg Andrianov ***@***.***> wrote: Yeah, but i with the .value thing was better documented. Autocomplete offers only .oid as possible method for extension. — Reply to this email directly, view it on GitHub <#12234 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBE7LO6F3MLQZWUKHVT2JXBTXAVCNFSM6AAAAABUS6Q5SWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNZYHE3TCNZVGI> . You are receiving this because you commented.Message ID: ***@***.***>

-- All that is necessary for evil to succeed is for good people to do nothing.

[OlegAndrianov]

Yes, I would love to help, but I do not feel competent enough to do that.