Validation fails with TypeError
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 115
- Forks
- 34
- PR merge metrics
- No merged PRs in 30d
Description
Given an individual PEM-encoded certificate cert, I want to validate it against a certification chain located in ./cc_certs/PT.pem which I open to build a list of intermediate certificates:
def validate(cert):
intermediates = []
with open('./cc_certs/PT.pem', 'rb') as f:
for _, _, der_bytes in pem.unarmor(f.read(), multiple=True):
intermediates.append(der_bytes)
validator = CertificateValidator(cert, intermediates)
validator.validate_usage(set(['digital_signature']))
Simple use-case that's well documented. However when running this it blows up complaining about a TypeError
Traceback (most recent call last):
File "client.py", line 114, in <module>
smartcard.validate(cc_cert)
File "/Users/fabio/Code/security2017-p1g2/src/chat/smartcard.py", line 38, in validate
validator.validate_usage(set(['digital_signature']))
File "/usr/local/lib/python3.6/site-packages/certvalidator/__init__.py", line 193, in validate_usage
self._validate_path()
File "/usr/local/lib/python3.6/site-packages/certvalidator/__init__.py", line 121, in _validate_path
validate_path(self._context, candidate_path)
File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 50, in validate_path
return _validate_path(validation_context, path)
File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 407, in _validate_path
end_entity_name_override=end_entity_name_override
File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 1243, in verify_crl
if isinstance(distribution_point['crl_issuer'], x509.GeneralNames):
TypeError: string indices must be integers
Sometimes the error also happens to be
Traceback (most recent call last):
File "client.py", line 114, in <module>
smartcard.validate(cc_cert)
File "/Users/fabio/Code/security2017-p1g2/src/chat/smartcard.py", line 39, in validate
validator.validate_usage(set(['digital_signature']))
File "/usr/local/lib/python3.6/site-packages/certvalidator/__init__.py", line 193, in validate_usage
self._validate_path()
File "/usr/local/lib/python3.6/site-packages/certvalidator/__init__.py", line 121, in _validate_path
validate_path(self._context, candidate_path)
File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 50, in validate_path
return _validate_path(validation_context, path)
File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 386, in _validate_path
end_entity_name_override=end_entity_name_override
File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 956, in verify_ocsp_response
if moment > cert_response['next_update'].native:
TypeError: '>' not supported between instances of 'datetime.datetime' and 'NoneType'
What do these errors mean? Or why does the error appear to be random? I tried to trace the exception in the source code but I don't know why it's being raised.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the validation call in client.py and smartcard.py, then inspect certvalidator/validate.py at verify_crl() and verify_ocsp_response(), the traceback locations named in the report. Reproduce the provided certificate-chain validation flow and examine the differing CRL and OCSP data that reaches those checks. Done means identifying why the input types or missing values vary and documenting or correcting the resulting validation behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100