{"action":"created","issue":{"url":"https://api.github.com/repos/pyca/cryptography/issues/2381","labels_url":"https://api.github.com/repos/pyca/cryptography/issues/2381/labels{/name}","comments_url":"https://api.github.com/repos/pyca/cryptography/issues/2381/comments","events_url":"https://api.github.com/repos/pyca/cryptography/issues/2381/events","html_url":"https://github.com/pyca/cryptography/issues/2381","id":108671995,"number":2381,"title":"Add x509 Certificate Validation","user":{"login":"danetrain","id":4893574,"avatar_url":"https://avatars.githubusercontent.com/u/4893574?v=3","gravatar_id":"","url":"https://api.github.com/users/danetrain","html_url":"https://github.com/danetrain","followers_url":"https://api.github.com/users/danetrain/followers","following_url":"https://api.github.com/users/danetrain/following{/other_user}","gists_url":"https://api.github.com/users/danetrain/gists{/gist_id}","starred_url":"https://api.github.com/users/danetrain/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danetrain/subscriptions","organizations_url":"https://api.github.com/users/danetrain/orgs","repos_url":"https://api.github.com/users/danetrain/repos","events_url":"https://api.github.com/users/danetrain/events{/privacy}","received_events_url":"https://api.github.com/users/danetrain/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-09-28T14:41:24Z","updated_at":"2015-09-29T19:04:07Z","closed_at":null,"body":"Currently, cryptography contains no functionality to validate a certificate chain against a trusted root certificate. This is a fairly standard operation; it is described in detail by [RFC 5280] (https://tools.ietf.org/html/rfc5280#section-6). I would like to implement this by adding a x509Validator interface to the cryptography.x509 module. "},"comment":{"url":"https://api.github.com/repos/pyca/cryptography/issues/comments/144157890","html_url":"https://github.com/pyca/cryptography/issues/2381#issuecomment-144157890","issue_url":"https://api.github.com/repos/pyca/cryptography/issues/2381","id":144157890,"user":{"login":"schlenk","id":979026,"avatar_url":"https://avatars.githubusercontent.com/u/979026?v=3","gravatar_id":"","url":"https://api.github.com/users/schlenk","html_url":"https://github.com/schlenk","followers_url":"https://api.github.com/users/schlenk/followers","following_url":"https://api.github.com/users/schlenk/following{/other_user}","gists_url":"https://api.github.com/users/schlenk/gists{/gist_id}","starred_url":"https://api.github.com/users/schlenk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schlenk/subscriptions","organizations_url":"https://api.github.com/users/schlenk/orgs","repos_url":"https://api.github.com/users/schlenk/repos","events_url":"https://api.github.com/users/schlenk/events{/privacy}","received_events_url":"https://api.github.com/users/schlenk/received_events","type":"User","site_admin":false},"created_at":"2015-09-29T19:04:07Z","updated_at":"2015-09-29T19:04:07Z","body":"The code is probably too simple to handle all the tricky details in RFC 5280. Especially the `_is_root_cert()` and `_get_issuing_root_cert()` code is naive and will probably fail miserably for the cases @reaperhulk mentioned in his two links about certifi (cross certification). \r\n\r\nIf you have want to have any hope of getting verification right, assume you have the proper certificate chain completely and in the correct order upfront. Do not try to do path building in a first step.\r\n\r\nI'm not sure if it is better to have a rather limited API for cert validation on the python layer or if a wrapper for the openssl verify code is better. It should be possible to write it with the cryptography API alone."}}