Certificate extension not parsed

[jensguballa]

I get an exception when accessing the extensions of a parsed certificate (probably due to "Certificate Policies").

Here is what I am using:

Python 3.9.5


cffi          1.15.0
cryptography  36.0.0.dev1
pip           21.3.1
pkg_resources 0.0.0
pycparser     2.20
setuptools    44.1.1

Certificate to parse: Subject: CN = ACCVRAIZ1, OU = PKIACCV, O = ACCV, C = ES
The certificate is present in the truststore on an Ubuntu system (/etc/ssl/certs/ACCVRAIZ1.pem)

-----BEGIN CERTIFICATE-----
MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJKoZIhvcNAQEFBQAwQjESMBAGA1UE
AwwJQUNDVlJBSVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQsw
CQYDVQQGEwJFUzAeFw0xMTA1MDUwOTM3MzdaFw0zMDEyMzEwOTM3MzdaMEIxEjAQ
BgNVBAMMCUFDQ1ZSQUlaMTEQMA4GA1UECwwHUEtJQUNDVjENMAsGA1UECgwEQUND
VjELMAkGA1UEBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCb
qau/YUqXry+XZpp0X9DZlv3P4uRm7x8fRzPCRKPfmt4ftVTdFXxpNRFvu8gMjmoY
HtiP2Ra8EEg2XPBjs5BaXCQ316PWywlxufEBcoSwfdtNgM3802/J+Nq2DoLSRYWo
G2ioPej0RGy9ocLLA76MPhMAhN9KSMDjIgro6TenGEyxCQ0jVn8ETdkXhBilyNpA
lHPrzg5XPAOBOp0KoVdDaaxXbXmQeOW1tDvYvEyNKKGno6e6Ak4l0Squ7a4DIrhr
IA8wKFSVf+DuzgpmndFALW4ir50awQUZ0m/A8p/4e7MCQvtQqR0tkw8jq8bBD5L/
0KIV9VMJcRz/RROE5iZe+OCIHAr8Fraocwa48GOEAqDGWuzndN9wrqODJerWx5eH
k6fGioozl2A3ED6XPm4pFdahD9GILBKfb6qkxkLrQaLjlUPTAYVtjrs78yM2x/47
4KElB0iryYl0/wiPgL/AlmXz7uxLaL2diMMxs0Dx6M/2OLuc5NF/1OVYm3z61PMO
m3WR5LpSLhl+0fXNWhn8ugb2+1KoS5kE3fj5tItQo05iifCHJPqDQsGH+tUtKSpa
cXpkatcnYGMN285J9Y0fkIkyF/hzQ7jSWpOGYdbhdQrqeWZ2iE9x6wQl1gpaepPl
uUsXQA+xtrn13k/c4LOsOxFwYIRKQ26ZIMApcQrAZQIDAQABo4ICyzCCAscwfQYI
KwYBBQUHAQEEcTBvMEwGCCsGAQUFBzAChkBodHRwOi8vd3d3LmFjY3YuZXMvZmls
ZWFkbWluL0FyY2hpdm9zL2NlcnRpZmljYWRvcy9yYWl6YWNjdjEuY3J0MB8GCCsG
AQUFBzABhhNodHRwOi8vb2NzcC5hY2N2LmVzMB0GA1UdDgQWBBTSh7Tj3zcnk1X2
VuqB5TbMjB4/vTAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNKHtOPfNyeT
VfZW6oHlNsyMHj+9MIIBcwYDVR0gBIIBajCCAWYwggFiBgRVHSAAMIIBWDCCASIG
CCsGAQUFBwICMIIBFB6CARAAQQB1AHQAbwByAGkAZABhAGQAIABkAGUAIABDAGUA
cgB0AGkAZgBpAGMAYQBjAGkA8wBuACAAUgBhAO0AegAgAGQAZQAgAGwAYQAgAEEA
QwBDAFYAIAAoAEEAZwBlAG4AYwBpAGEAIABkAGUAIABUAGUAYwBuAG8AbABvAGcA
7QBhACAAeQAgAEMAZQByAHQAaQBmAGkAYwBhAGMAaQDzAG4AIABFAGwAZQBjAHQA
cgDzAG4AaQBjAGEALAAgAEMASQBGACAAUQA0ADYAMAAxADEANQA2AEUAKQAuACAA
QwBQAFMAIABlAG4AIABoAHQAdABwADoALwAvAHcAdwB3AC4AYQBjAGMAdgAuAGUA
czAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu
aHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt
aW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud
DwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXMwDQYJKoZIhvcNAQEF
BQADggIBAJcxAp/n/UNnSEQU5CmH7UwoZtCPNdpNYbdKl02125DgBS4OxnnQ8pdp
D70ER9m+27Up2pvZrqmZ1dM8MJP1jaGo/AaNRPTKFpV8M9xii6g3+CfYCS0b78gU
JyCpZET/LtZ1qmxNYEAZSUNUY9rizLpm5U9EelvZaoErQNV/+QEnWCzI7UiRfD+m
AM/EKXMRNt6GGT6d7hmKG9Ww7Y49nCrADdg9ZuM8Db3VlFzi4qc1GwQA9j9ajepD
vV+JHanBsMyZ4k0ACtrJJ1vnE5Bc5PUzolVt3OAJTS+xJlsndQAJxGJ3KQhfnlms
tn6tn1QwIgPBHnFk/vk4CpYY3QIUrCPLBhwepH2NDd4nQeit2hW3sCPdK6jT2iWH
7ehVRE2I9DZ+hJp4rPcOVkkO1jMl1oRQQmwgEh0q1b688nCBpHBgvgW1m54ERL5h
I6zppSSMEYCUWqKiuUnSwdzRp+0xESyeGabu4VXhwOrPDYTkF7eifKXeVSUG7szA
h1xA2syVP1XgNce4hL60Xc16gwFy7ofmXx2utYXGJt/mwZrpHgJHnyqobalbz+xF
d3+YJ5oyXSrjhO7FmGYvliAd3djDJ9ew+f7Zfc3Qn48LFFhRny+Lwzgt3uiP1o2H
pPVWQxaZLPSkVrQ0uGE3ycJYgBugl6H8WY3pEfbRD0tVNEYqi4Y7
-----END CERTIFICATE-----

After parsing the certificate an exception is raised when accessing the extensions:

>>> with open("/etc/ssl/certs/ACCVRAIZ1.pem", "rb") as fd:
...     pem = fd.read()
... 
>>> from cryptography.x509 import load_pem_x509_certificate
>>> cert = load_pem_x509_certificate(pem)
>>> cert.extensions
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: error parsing asn1 value: ParseError { kind: ExtraData, location: ["0", "PolicyInformation::policy_qualifiers", "0", "PolicyQualifierInfo::qualifier", "Qualifier::UserNotice"] }

The problem does not occur using cryptography 3.4.8. Here the extension looks like follows:

<Extension(oid=<ObjectIdentifier(oid=2.5.29.32, name=certificatePolicies)>, critical=False,
value=<CertificatePolicies([<PolicyInformation(policy_identifier=<ObjectIdentifier(oid=2.5.29.32.0, name=Unknown OID)>,
policy_qualifiers=[
    <UserNotice(
        notice_reference=None,
        explicit_text='Autoridad de Certificación Raíz de la ACCV (Agencia de Tecnología y Certificación Electrónica, CIF Q4601156E). CPS en http://www.accv.es'
    )>,
    'http://www.accv.es/legislacion_c.htm'
])>])>)>,

Openssl decodes the certificate, but leaves the explicit text blank.

            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy
                  User Notice:
                    Explicit Text: 
                  CPS: http://www.accv.es/legislacion_c.htm

[alex]

Ok the actual problem here is that the DisplayText value is a BMPString, which we currently do not support.

[dainnilsson]

Hi! I ran into the what looks like the same issue when parsing a certificate used for TPM attestation for WebAuthn authentication using the Windows platform authenticator. This is a problem for https://github.com/Yubico/python-fido2

Error when accessing certificate.extensions:

ValueError: error parsing asn1 value: ParseError { kind: ExtraData, location: ["0", "PolicyInformation::policy_qualifiers", "0", "PolicyQualifierInfo::qualifier", "Qualifier::UserNotice"] }

Here's the certificate for reference:

-----BEGIN CERTIFICATE-----
MIIFwDCCA6igAwIBAgIQeNmosmT5TSiCwNMbQDzI2TANBgkqhkiG9w0BAQsFADBB
MT8wPQYDVQQDEzZFVVMtU1RNLUtFWUlELTFBREI5OTRBQjU4QkU1N0EwQ0M5Qjkw
MEU3ODUxRTFBNDNDMDg2NjAwHhcNMjEwNzE1MTExMjEzWhcNMjUwMzIxMjAyOTE1
WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyr53n0WXF40B4RjM
8LXtmrc2rAUmvjXZXABcXYtvKrj2Ak8z/oRFTE9626lqYg8ZNV3SNBqdc1XlPgSi
1r7nWrkWbFUYqEuyN7mjh/x2qFXJ5zDlDjx7dNIeqAXV4uPLr2MzEqr9MTJxT0GW
BbVpc0W+b5DZEDavehzxbRSwHruuHDXsHLUO9jOYE05Ee1yXR+1P/r0I0qnGvowE
ntw9vpjpKrH0+kX5yJpVhSb8X60Ai8hB8oZOulUcsonohW4eAp9VcL7955+6WaAu
mnQR562px3tYxBbTNcthAOw2SqNRo91httYpy3bhq1E66L/bCUo5ltmsj2xi4AMj
JL7UgwIDAQABo4IB8zCCAe8wDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB/wQCMAAw
bQYDVR0gAQH/BGMwYTBfBgkrBgEEAYI3FR8wUjBQBggrBgEFBQcCAjBEHkIAVABD
AFAAQQAgACAAVAByAHUAcwB0AGUAZAAgACAAUABsAGEAdABmAG8AcgBtACAAIABJ
AGQAZQBuAHQAaQB0AHkwEAYDVR0lBAkwBwYFZ4EFCAMwWQYDVR0RAQH/BE8wTaRL
MEkxFjAUBgVngQUCAQwLaWQ6NTM1NDREMjAxFzAVBgVngQUCAgwMU1QzM0hUUEhB
SEI0MRYwFAYFZ4EFAgMMC2lkOjAwNDkwMDA0MB8GA1UdIwQYMBaAFLhf1WfKksQO
zwzYH20/A1VvOKZRMB0GA1UdDgQWBBTUBGT8blAKVkgPBakAtx1eVwjV3DCBsgYI
KwYBBQUHAQEEgaUwgaIwgZ8GCCsGAQUFBzAChoGSaHR0cDovL2F6Y3Nwcm9kZXVz
YWlrcHVibGlzaC5ibG9iLmNvcmUud2luZG93cy5uZXQvZXVzLXN0bS1rZXlpZC0x
YWRiOTk0YWI1OGJlNTdhMGNjOWI5MDBlNzg1MWUxYTQzYzA4NjYwL2FiZDYxNWYy
LTE1OGEtNDU4ZS1hMTU1LTdjNGM4Y2IxM2M2NS5jZXIwDQYJKoZIhvcNAQELBQAD
ggIBAKIQxb9BprqMcsoPPl5/4stguD/73gPi/iAp3xH1sFBtMugbBa1rYLXt86RK
6gnlZX7g1Tpq22S3B4+hY7OJiqxJl6Cao9M6whOyu6sN8jXFA94crWoDCkzhN4+8
E8CaF9QuNhdRErB5v5uzsHQlgX4hMbfCXvs2q/N6X6Rejwy9z/VQ5wxRVUjmFbbU
r5VyVpT3DtaQ49NdvZOhvWzk8jlNVHTP9etw209SzTmPEVQoBimPI96eL3u2X6OJ
BJkK8S35ZtMTRb1sIlf1sbnfW3saOt1rxzWI7cQJcE5ftT7RC9DK7wvpi2/DFsM9
eQbvgfBgCzLjhmuSOJBi7YQ6t0VDLtA6cZ6AzJysJxCRt7K9QUCnt8/nOMpo3WIJ
/2jOuuIHSQnnH9/mJuUPqb8qW2eSoRBTsnoHKZ39bbY7RcGUyxzDzvaKGoFmsKUU
x54fbrb/i5CHOj+owi2Pb9u0xBQ8HRIdbc+mBGqoE17yXneAa4WD/rvrcMtf5JWq
D2E2fLsiHrqYQ1Izru1dECyzqTGOYFSvQG0uGMJq9Huacw9YaSO7xIRTMOLWHhDB
7IITq1OGornauzqivrAQmQ7lnMnxznZG6oaqNoOZCZsw0ybH32bH8N0ICRUVIUlG
2IpmymKceR2B6l2CsKZrXPW4jPYWASz4J/jPiP7zpPwXl+cH
-----END CERTIFICATE-----

[reaperhulk]

Thanks for the report. I’ll take a look at this when I’m back at a computer but hopefully it’s another case where we just need to implement the missing DisplayText types!

[reaperhulk]

Yeah this is also a BMPString in certificate policies (with value BMPString { u"TCPA Trusted Platform Identity" })