_synta/certificate/

mod.rs

//! Python bindings for X.509 and related PKI types.
//!
//! Exposes [`PyCertificate`], [`PyCsr`], [`PyCrl`], and [`PyOcspResponse`] as
//! pyo3 classes, along with OID-lookup helper functions and the
//! ``synta.oids`` / ``synta.oids.attr`` submodules.
//!
//! This module is part of the `synta-python` cdylib.  Call [`register_module`]
//! from the `#[pymodule]` entry point to expose these types to Python.

use std::str::FromStr;

use pyo3::prelude::*;

use synta::ObjectIdentifier;

use crate::types::PyObjectIdentifier;

pub mod ac;
pub mod cert;
pub mod cert_builder;
pub mod cmp;
pub mod cms;
pub mod crmf;
pub mod csr_builder;
pub mod key_types;
pub mod name_builder;
pub mod pkix;
pub mod pkixalgs;

use ac::register_ac_submodule;
use cert::PyCertificate;
use cert_builder::PyCertificateBuilder;
use cmp::register_cmp_submodule;
use cms::register_cms_submodule;
use crmf::register_crmf_submodule;
use csr_builder::PyCsrBuilder;
use key_types::{PyMlDsaPrivateKey, PyMlDsaPublicKey, PyRsaPublicKey, PyRsassaPssParams};
use name_builder::PyNameBuilder;
use pkix::{PyCrl, PyCsr, PyOcspResponse};
use pkixalgs::register_pkixalgs_submodule;

pub use pkix::{
    create_pkcs12, encode_extended_key_usage, encode_subject_alt_names,
    load_der_pkcs7_certificates, load_pem_pkcs7_certificates, load_pkcs12,
    load_pkcs12_certificates, load_pkcs12_keys, name_der_equal, read_pki_blocks,
};

/// Accept either a Python ``str`` (dotted-decimal OID) or an
/// ``ObjectIdentifier`` object and return the underlying Rust value.
pub(crate) fn oid_from_pyany(obj: &Bound<'_, PyAny>) -> PyResult<ObjectIdentifier> {
    if let Ok(oid_ref) = obj.extract::<PyRef<PyObjectIdentifier>>() {
        return Ok(oid_ref.inner.clone());
    }
    if let Ok(s) = obj.extract::<String>() {
        return ObjectIdentifier::from_str(&s)
            .map_err(|_| pyo3::exceptions::PyValueError::new_err(format!("invalid OID: {s}")));
    }
    Err(pyo3::exceptions::PyTypeError::new_err(
        "oid must be a str or ObjectIdentifier",
    ))
}

/// Convert a well-known `&[u32]` component slice to a Python `ObjectIdentifier`.
///
/// Panics at module-init time if the slice is not a valid OID — every caller
/// passes a constant generated from the ASN.1 schema, so a panic here is a
/// bug in the source data.
pub(crate) fn oid_const(py: Python<'_>, components: &[u32]) -> Py<PyAny> {
    let inner = ObjectIdentifier::new(components)
        .expect("oid constant has invalid components — bug in synta-certificate");
    Py::new(py, PyObjectIdentifier::from_oid(inner))
        .expect("PyObjectIdentifier allocation failed")
        .into_any()
}

/// Call this from a cdylib extension crate's `#[pymodule]` function:
///
/// ```rust,ignore
/// #[pymodule]
/// fn my_extension(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
///     synta_certificate::python::register_module(m)
/// }
/// ```
pub fn register_module(m: &Bound<'_, PyModule>) -> PyResult<()> {
    m.add_class::<PyObjectIdentifier>()?;
    m.add_class::<PyCertificate>()?;
    m.add_class::<PyCertificateBuilder>()?;
    m.add_class::<PyCsrBuilder>()?;
    m.add_class::<PyNameBuilder>()?;
    m.add_class::<PyCsr>()?;
    m.add_class::<PyCrl>()?;
    m.add_class::<PyOcspResponse>()?;
    m.add_class::<PyMlDsaPrivateKey>()?;
    m.add_class::<PyMlDsaPublicKey>()?;
    m.add_class::<PyRsaPublicKey>()?;
    m.add_class::<PyRsassaPssParams>()?;
    // ML-DSA algorithm OID constants — also available as synta.oids.ML_DSA_*.
    // Exposed here so users can write synta.ML_DSA_44 instead of synta.oids.ML_DSA_44
    // when working with MlDsaPrivateKey / MlDsaPublicKey in the same import.
    let py = m.py();
    m.add(
        "ML_DSA_44",
        oid_const(py, synta_certificate::oids::ML_DSA_44),
    )?;
    m.add(
        "ML_DSA_65",
        oid_const(py, synta_certificate::oids::ML_DSA_65),
    )?;
    m.add(
        "ML_DSA_87",
        oid_const(py, synta_certificate::oids::ML_DSA_87),
    )?;
    m.add_function(wrap_pyfunction!(load_der_pkcs7_certificates, m)?)?;
    m.add_function(wrap_pyfunction!(load_pem_pkcs7_certificates, m)?)?;
    m.add_function(wrap_pyfunction!(load_pkcs12_certificates, m)?)?;
    m.add_function(wrap_pyfunction!(load_pkcs12_keys, m)?)?;
    m.add_function(wrap_pyfunction!(load_pkcs12, m)?)?;
    m.add_function(wrap_pyfunction!(read_pki_blocks, m)?)?;
    m.add_function(wrap_pyfunction!(create_pkcs12, m)?)?;
    register_oids_submodule(m)?;
    register_cms_submodule(m)?;
    register_general_name_submodule(m)?;
    register_pkixalgs_submodule(m)?;
    register_ac_submodule(m)?;
    register_crmf_submodule(m)?;
    register_cmp_submodule(m)?;
    Ok(())
}

// ── OID helper functions (exposed in synta.oids) ─────────────────────────────
//
// Each function accepts either a PyObjectIdentifier or a dotted-decimal str,
// delegating to the corresponding crate-level helper in lib.rs.

/// Return the canonical display name for a signature algorithm OID.
///
/// Recognises RSA (PKCS #1) variants, ECDSA variants, EdDSA, ML-DSA (FIPS
/// 204), and SLH-DSA (FIPS 205). Returns ``"Other"`` for unknown OIDs.
///
/// :param oid: :class:`~synta.ObjectIdentifier` or dotted-decimal ``str``.
/// :returns: algorithm name string (one of the ``synta.oids`` name constants).
#[pyfunction]
fn identify_signature_algorithm(oid: &Bound<'_, PyAny>) -> PyResult<&'static str> {
    let inner = oid_from_pyany(oid)?;
    Ok(synta_certificate::identify_signature_algorithm(&inner))
}

/// Return the canonical display name for a public-key algorithm OID, if known.
///
/// Recognises RSA, EC/ECDSA, DSA, EdDSA, ML-DSA, and ML-KEM.
/// Returns ``None`` for unrecognised OIDs.
///
/// :param oid: :class:`~synta.ObjectIdentifier` or dotted-decimal ``str``.
/// :returns: algorithm name string or ``None``.
#[pyfunction]
fn identify_public_key_algorithm(oid: &Bound<'_, PyAny>) -> PyResult<Option<&'static str>> {
    let inner = oid_from_pyany(oid)?;
    Ok(synta_certificate::identify_public_key_algorithm(&inner))
}

/// Return the short ASN.1 name for a well-known EC named-curve OID.
///
/// Returns ``None`` for unrecognised curves.
///
/// :param oid: :class:`~synta.ObjectIdentifier` or dotted-decimal ``str``.
/// :returns: e.g. ``"prime256v1"``, ``"secp384r1"``, or ``None``.
#[pyfunction]
fn ec_curve_short_name(oid: &Bound<'_, PyAny>) -> PyResult<Option<&'static str>> {
    let inner = oid_from_pyany(oid)?;
    Ok(synta_certificate::ec_curve_short_name(inner.components()))
}

/// Return the NIST name for a well-known EC named-curve OID.
///
/// Returns ``None`` for curves with no NIST name (e.g. ``secp256k1``).
///
/// :param oid: :class:`~synta.ObjectIdentifier` or dotted-decimal ``str``.
/// :returns: e.g. ``"P-256"``, ``"P-384"``, or ``None``.
#[pyfunction]
fn ec_curve_nist_name(oid: &Bound<'_, PyAny>) -> PyResult<Option<&'static str>> {
    let inner = oid_from_pyany(oid)?;
    Ok(synta_certificate::ec_curve_nist_name(inner.components()))
}

/// Return the key size in bits for a well-known EC named-curve OID.
///
/// Returns the field size (security parameter) as reported by OpenSSL.
/// Returns ``None`` for unrecognised curves.
///
/// :param oid: :class:`~synta.ObjectIdentifier` or dotted-decimal ``str``.
/// :returns: e.g. ``256``, ``384``, ``521``, or ``None``.
#[pyfunction]
fn ec_curve_key_bits(oid: &Bound<'_, PyAny>) -> PyResult<Option<usize>> {
    let inner = oid_from_pyany(oid)?;
    Ok(synta_certificate::ec_curve_key_bits(inner.components()))
}

/// Return the display name for a well-known X.509v3 extension OID.
///
/// Covers all RFC 5280 standard extensions and the Certificate Transparency
/// SCT extension. Returns the dotted-decimal string for unknown OIDs.
///
/// :param oid: :class:`~synta.ObjectIdentifier` or dotted-decimal ``str``.
/// :returns: human-readable name, e.g. ``"X509v3 Subject Alternative Name"``.
#[pyfunction]
fn extension_oid_name(oid: &Bound<'_, PyAny>) -> PyResult<String> {
    let inner = oid_from_pyany(oid)?;
    Ok(synta_certificate::extension_oid_name(&inner))
}

// ── OID constants submodule ──────────────────────────────────────────────────

/// Build and register the ``synta.oids`` submodule.
///
/// Also registers ``synta.oids.attr`` for DN attribute OIDs and installs both
/// into ``sys.modules`` so that ``from synta.oids import ...`` works.
fn register_oids_submodule(parent: &Bound<'_, PyModule>) -> PyResult<()> {
    let py = parent.py();
    let m = PyModule::new(py, "oids")?;

    // ── ML-DSA (FIPS 204) ────────────────────────────────────────────────────
    m.add(
        "ML_DSA_44",
        oid_const(py, synta_certificate::oids::ML_DSA_44),
    )?;
    m.add(
        "ML_DSA_65",
        oid_const(py, synta_certificate::oids::ML_DSA_65),
    )?;
    m.add(
        "ML_DSA_87",
        oid_const(py, synta_certificate::oids::ML_DSA_87),
    )?;

    // ── ML-KEM (FIPS 203) ────────────────────────────────────────────────────
    m.add(
        "ML_KEM_512",
        oid_const(py, synta_certificate::oids::ML_KEM_512),
    )?;
    m.add(
        "ML_KEM_768",
        oid_const(py, synta_certificate::oids::ML_KEM_768),
    )?;
    m.add(
        "ML_KEM_1024",
        oid_const(py, synta_certificate::oids::ML_KEM_1024),
    )?;

    // ── SLH-DSA (FIPS 205) ───────────────────────────────────────────────────
    m.add(
        "SLH_DSA_SHA2_128S",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHA2_128S),
    )?;
    m.add(
        "SLH_DSA_SHA2_128F",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHA2_128F),
    )?;
    m.add(
        "SLH_DSA_SHA2_192S",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHA2_192S),
    )?;
    m.add(
        "SLH_DSA_SHA2_192F",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHA2_192F),
    )?;
    m.add(
        "SLH_DSA_SHA2_256S",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHA2_256S),
    )?;
    m.add(
        "SLH_DSA_SHA2_256F",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHA2_256F),
    )?;
    m.add(
        "SLH_DSA_SHAKE_128S",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHAKE_128S),
    )?;
    m.add(
        "SLH_DSA_SHAKE_128F",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHAKE_128F),
    )?;
    m.add(
        "SLH_DSA_SHAKE_192S",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHAKE_192S),
    )?;
    m.add(
        "SLH_DSA_SHAKE_192F",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHAKE_192F),
    )?;
    m.add(
        "SLH_DSA_SHAKE_256S",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHAKE_256S),
    )?;
    m.add(
        "SLH_DSA_SHAKE_256F",
        oid_const(py, synta_certificate::oids::ID_SLH_DSA_SHAKE_256F),
    )?;

    // ── EdDSA (RFC 8410) ─────────────────────────────────────────────────────
    m.add("ED25519", oid_const(py, synta_certificate::oids::ED25519))?;
    m.add("ED448", oid_const(py, synta_certificate::oids::ED448))?;

    // ── RSA (PKCS #1) ────────────────────────────────────────────────────────
    m.add(
        "RSA_ENCRYPTION",
        oid_const(py, synta_certificate::oids::RSA_ENCRYPTION),
    )?;
    m.add(
        "MD5_WITH_RSA",
        oid_const(py, synta_certificate::oids::MD5_WITH_RSA),
    )?;
    m.add(
        "SHA1_WITH_RSA",
        oid_const(py, synta_certificate::oids::SHA1_WITH_RSA),
    )?;
    m.add(
        "SHA256_WITH_RSA",
        oid_const(py, synta_certificate::oids::SHA256_WITH_RSA),
    )?;
    m.add(
        "SHA384_WITH_RSA",
        oid_const(py, synta_certificate::oids::SHA384_WITH_RSA),
    )?;
    m.add(
        "SHA512_WITH_RSA",
        oid_const(py, synta_certificate::oids::SHA512_WITH_RSA),
    )?;
    // Prefix OID covering all PKCS #1 RSA variants
    m.add("RSA", oid_const(py, synta_certificate::oids::RSA))?;
    // PKCS #1 algorithm OIDs (RFC 8017)
    m.add(
        "MD2_WITH_RSA",
        oid_const(py, synta_certificate::oids::MD2_WITH_RSA),
    )?;
    m.add(
        "SHA512_224_WITH_RSA",
        oid_const(py, synta_certificate::oids::SHA512_224_WITH_RSA),
    )?;
    m.add(
        "SHA512_256_WITH_RSA",
        oid_const(py, synta_certificate::oids::SHA512_256_WITH_RSA),
    )?;
    m.add(
        "RSASSA_PSS",
        oid_const(py, synta_certificate::oids::RSASSA_PSS),
    )?;
    m.add(
        "RSAES_OAEP",
        oid_const(py, synta_certificate::oids::RSAES_OAEP),
    )?;
    m.add("MGF1", oid_const(py, synta_certificate::oids::MGF1))?;
    m.add(
        "P_SPECIFIED",
        oid_const(py, synta_certificate::oids::P_SPECIFIED),
    )?;

    // ── ECDSA (ANSI X9.62 / RFC 5758) ────────────────────────────────────────
    m.add(
        "EC_PUBLIC_KEY",
        oid_const(py, synta_certificate::oids::EC_PUBLIC_KEY),
    )?;
    m.add(
        "ECDSA_WITH_SHA1",
        oid_const(py, synta_certificate::oids::ECDSA_WITH_SHA1),
    )?;
    m.add(
        "ECDSA_WITH_SHA256",
        oid_const(py, synta_certificate::oids::ECDSA_WITH_SHA256),
    )?;
    m.add(
        "ECDSA_WITH_SHA384",
        oid_const(py, synta_certificate::oids::ECDSA_WITH_SHA384),
    )?;
    m.add(
        "ECDSA_WITH_SHA512",
        oid_const(py, synta_certificate::oids::ECDSA_WITH_SHA512),
    )?;
    // Prefix OID covering all ECDSA signature variants
    m.add("ECDSA", oid_const(py, synta_certificate::oids::ECDSA_SIG))?;

    // ── EC named curves (SEC 2 / RFC 5480) ───────────────────────────────────
    m.add(
        "EC_CURVE_P256",
        oid_const(py, synta_certificate::oids::EC_CURVE_P256),
    )?;
    m.add(
        "EC_CURVE_P384",
        oid_const(py, synta_certificate::oids::EC_CURVE_P384),
    )?;
    m.add(
        "EC_CURVE_P521",
        oid_const(py, synta_certificate::oids::EC_CURVE_P521),
    )?;
    m.add(
        "EC_CURVE_SECP256K1",
        oid_const(py, synta_certificate::oids::EC_CURVE_SECP256K1),
    )?;

    // ── SHA-2 hash algorithms (FIPS 180-4) ───────────────────────────────────
    m.add("SHA224", oid_const(py, synta_certificate::oids::ID_SHA224))?;
    m.add("SHA256", oid_const(py, synta_certificate::oids::ID_SHA256))?;
    m.add("SHA384", oid_const(py, synta_certificate::oids::ID_SHA384))?;
    m.add("SHA512", oid_const(py, synta_certificate::oids::ID_SHA512))?;
    m.add(
        "SHA512_224",
        oid_const(py, synta_certificate::oids::ID_SHA512_224),
    )?;
    m.add(
        "SHA512_256",
        oid_const(py, synta_certificate::oids::ID_SHA512_256),
    )?;

    // ── SHA-3 hash algorithms and XOFs (FIPS 202) ────────────────────────────
    m.add(
        "SHA3_224",
        oid_const(py, synta_certificate::oids::ID_SHA3_224),
    )?;
    m.add(
        "SHA3_256",
        oid_const(py, synta_certificate::oids::ID_SHA3_256),
    )?;
    m.add(
        "SHA3_384",
        oid_const(py, synta_certificate::oids::ID_SHA3_384),
    )?;
    m.add(
        "SHA3_512",
        oid_const(py, synta_certificate::oids::ID_SHA3_512),
    )?;
    m.add(
        "SHAKE128",
        oid_const(py, synta_certificate::oids::ID_SHAKE128),
    )?;
    m.add(
        "SHAKE256",
        oid_const(py, synta_certificate::oids::ID_SHAKE256),
    )?;

    // ── X.509v3 extension OIDs (RFC 5280 / 2.5.29.*) ─────────────────────────
    m.add(
        "SUBJECT_KEY_IDENTIFIER",
        oid_const(py, synta_certificate::oids::SUBJECT_KEY_IDENTIFIER),
    )?;
    m.add(
        "KEY_USAGE",
        oid_const(py, synta_certificate::oids::KEY_USAGE),
    )?;
    m.add(
        "SUBJECT_ALT_NAME",
        oid_const(py, synta_certificate::oids::SUBJECT_ALT_NAME),
    )?;
    m.add(
        "ISSUER_ALT_NAME",
        oid_const(py, synta_certificate::oids::ISSUER_ALT_NAME),
    )?;
    m.add(
        "BASIC_CONSTRAINTS",
        oid_const(py, synta_certificate::oids::BASIC_CONSTRAINTS),
    )?;
    m.add(
        "CRL_DISTRIBUTION_POINTS",
        oid_const(py, synta_certificate::oids::CRL_DISTRIBUTION_POINTS),
    )?;
    m.add(
        "CERTIFICATE_POLICIES",
        oid_const(py, synta_certificate::oids::CERTIFICATE_POLICIES),
    )?;
    m.add(
        "AUTHORITY_KEY_IDENTIFIER",
        oid_const(py, synta_certificate::oids::AUTHORITY_KEY_IDENTIFIER),
    )?;
    m.add(
        "EXTENDED_KEY_USAGE",
        oid_const(py, synta_certificate::oids::EXTENDED_KEY_USAGE),
    )?;
    m.add(
        "AUTHORITY_INFO_ACCESS",
        oid_const(py, synta_certificate::oids::AUTHORITY_INFO_ACCESS),
    )?;
    m.add(
        "CT_PRECERT_SCTS",
        oid_const(py, synta_certificate::oids::CT_PRECERT_SCTS),
    )?;

    // ── Extended Key Usage key-purpose OIDs (RFC 5280 §4.2.1.12) ─────────────
    m.add(
        "KP_SERVER_AUTH",
        oid_const(py, synta_certificate::oids::KP_SERVER_AUTH),
    )?;
    m.add(
        "KP_CLIENT_AUTH",
        oid_const(py, synta_certificate::oids::KP_CLIENT_AUTH),
    )?;
    m.add(
        "KP_CODE_SIGNING",
        oid_const(py, synta_certificate::oids::KP_CODE_SIGNING),
    )?;
    m.add(
        "KP_EMAIL_PROTECTION",
        oid_const(py, synta_certificate::oids::KP_EMAIL_PROTECTION),
    )?;
    m.add(
        "KP_TIME_STAMPING",
        oid_const(py, synta_certificate::oids::KP_TIME_STAMPING),
    )?;
    m.add(
        "KP_OCSP_SIGNING",
        oid_const(py, synta_certificate::oids::KP_OCSP_SIGNING),
    )?;
    m.add(
        "ANY_EXTENDED_KEY_USAGE",
        oid_const(py, synta_certificate::oids::ANY_EXTENDED_KEY_USAGE),
    )?;

    // ── PKINIT OIDs (RFC 4556 + RFC 6112 + RFC 8636) ─────────────────────────
    m.add(
        "PKINIT_SAN",
        oid_const(py, synta_certificate::oids::ID_PKINIT_SAN),
    )?;
    m.add(
        "PKINIT_KP_CLIENT_AUTH",
        oid_const(py, synta_certificate::oids::ID_PKINIT_KPCLIENT_AUTH),
    )?;
    m.add(
        "PKINIT_KP_KDC",
        oid_const(py, synta_certificate::oids::ID_PKINIT_KPKDC),
    )?;
    m.add(
        "PKINIT_AUTH_DATA",
        oid_const(py, synta_certificate::oids::ID_PKINIT_AUTH_DATA),
    )?;
    m.add(
        "PKINIT_DHKEY_DATA",
        oid_const(py, synta_certificate::oids::ID_PKINIT_DHKEY_DATA),
    )?;
    m.add(
        "PKINIT_RKEY_DATA",
        oid_const(py, synta_certificate::oids::ID_PKINIT_RKEY_DATA),
    )?;
    m.add(
        "PKINIT_KDF",
        oid_const(py, synta_certificate::oids::ID_PKINIT_KDF),
    )?;
    m.add(
        "PKINIT_KDF_SHA1",
        oid_const(py, synta_certificate::oids::ID_PKINIT_KDF_AH_SHA1),
    )?;
    m.add(
        "PKINIT_KDF_SHA256",
        oid_const(py, synta_certificate::oids::ID_PKINIT_KDF_AH_SHA256),
    )?;
    m.add(
        "PKINIT_KDF_SHA384",
        oid_const(py, synta_certificate::oids::ID_PKINIT_KDF_AH_SHA384),
    )?;
    m.add(
        "PKINIT_KDF_SHA512",
        oid_const(py, synta_certificate::oids::ID_PKINIT_KDF_AH_SHA512),
    )?;

    // ── Microsoft PKI OIDs (AD CS) ────────────────────────────────────────────
    m.add(
        "MS_SAN_UPN",
        oid_const(py, synta_certificate::oids::ID_MS_SAN_UPN),
    )?;
    m.add(
        "MS_CERTIFICATE_TEMPLATE_NAME",
        oid_const(py, synta_certificate::oids::ID_MS_CERTIFICATE_TEMPLATE_NAME),
    )?;
    m.add(
        "MS_CERTIFICATE_TEMPLATE",
        oid_const(py, synta_certificate::oids::ID_MS_CERTIFICATE_TEMPLATE),
    )?;
    m.add(
        "MS_KP_SMARTCARD_LOGON",
        oid_const(py, synta_certificate::oids::ID_MS_KP_SMARTCARD_LOGON),
    )?;
    m.add(
        "MS_NTDS_REPLICATION",
        oid_const(py, synta_certificate::oids::ID_MS_NTDS_REPLICATION),
    )?;

    // ── CMS content-type OIDs (RFC 5652 §14) ─────────────────────────────────
    m.add("CMS_DATA", oid_const(py, synta_certificate::oids::CMS_DATA))?;
    m.add(
        "CMS_SIGNED_DATA",
        oid_const(py, synta_certificate::oids::CMS_SIGNED_DATA),
    )?;
    m.add(
        "CMS_ENVELOPED_DATA",
        oid_const(py, synta_certificate::oids::CMS_ENVELOPED_DATA),
    )?;
    m.add(
        "CMS_DIGESTED_DATA",
        oid_const(py, synta_certificate::oids::CMS_DIGESTED_DATA),
    )?;
    m.add(
        "CMS_ENCRYPTED_DATA",
        oid_const(py, synta_certificate::oids::CMS_ENCRYPTED_DATA),
    )?;
    m.add(
        "CMS_AUTH_DATA",
        oid_const(py, synta_certificate::oids::CMS_AUTH_DATA),
    )?;
    // ── CMS-KEM OtherRecipientInfo OIDs (RFC 9629 §6.2) ──────────────────────
    m.add("CMS_ORI", oid_const(py, synta_certificate::oids::CMS_ORI))?;
    m.add(
        "CMS_ORI_KEM",
        oid_const(py, synta_certificate::oids::CMS_ORI_KEM),
    )?;

    // ── PKCS#9 attribute OIDs (RFC 2985 / RFC 5652 §11 / RFC 2986 / RFC 7292) ─
    m.add(
        "PKCS9_EMAIL_ADDRESS",
        oid_const(py, synta_certificate::oids::PKCS9_EMAIL_ADDRESS),
    )?;
    m.add(
        "PKCS9_CONTENT_TYPE",
        oid_const(py, synta_certificate::oids::PKCS9_CONTENT_TYPE),
    )?;
    m.add(
        "PKCS9_MESSAGE_DIGEST",
        oid_const(py, synta_certificate::oids::PKCS9_MESSAGE_DIGEST),
    )?;
    m.add(
        "PKCS9_SIGNING_TIME",
        oid_const(py, synta_certificate::oids::PKCS9_SIGNING_TIME),
    )?;
    m.add(
        "PKCS9_COUNTERSIGNATURE",
        oid_const(py, synta_certificate::oids::PKCS9_COUNTERSIGNATURE),
    )?;
    m.add(
        "PKCS9_CHALLENGE_PASSWORD",
        oid_const(py, synta_certificate::oids::PKCS9_CHALLENGE_PASSWORD),
    )?;
    m.add(
        "PKCS9_EXTENSION_REQUEST",
        oid_const(py, synta_certificate::oids::PKCS9_EXTENSION_REQUEST),
    )?;
    m.add(
        "PKCS9_FRIENDLY_NAME",
        oid_const(py, synta_certificate::oids::PKCS9_FRIENDLY_NAME),
    )?;
    m.add(
        "PKCS9_LOCAL_KEY_ID",
        oid_const(py, synta_certificate::oids::PKCS9_LOCAL_KEY_ID),
    )?;

    // ── RFC 9925 Unsigned X.509 Certificates ─────────────────────────────────
    m.add(
        "ALG_UNSIGNED",
        oid_const(py, synta_certificate::oids::ALG_UNSIGNED),
    )?;
    m.add(
        "RDNA_UNSIGNED",
        oid_const(py, synta_certificate::oids::RDNA_UNSIGNED),
    )?;

    // ── Helper functions ─────────────────────────────────────────────────────
    m.add_function(wrap_pyfunction!(identify_signature_algorithm, &m)?)?;
    m.add_function(wrap_pyfunction!(identify_public_key_algorithm, &m)?)?;
    m.add_function(wrap_pyfunction!(ec_curve_short_name, &m)?)?;
    m.add_function(wrap_pyfunction!(ec_curve_nist_name, &m)?)?;
    m.add_function(wrap_pyfunction!(ec_curve_key_bits, &m)?)?;
    m.add_function(wrap_pyfunction!(extension_oid_name, &m)?)?;

    // ── DN attribute OID submodule ────────────────────────────────────────────
    let attr = PyModule::new(py, "attr")?;
    attr.add(
        "__doc__",
        "OIDs for X.500 Distinguished Name attribute types (RFC 4519).",
    )?;
    attr.add(
        "COMMON_NAME",
        oid_const(py, synta_certificate::oids::attr::COMMON_NAME),
    )?;
    attr.add(
        "COUNTRY",
        oid_const(py, synta_certificate::oids::attr::COUNTRY),
    )?;
    attr.add("STATE", oid_const(py, synta_certificate::oids::attr::STATE))?;
    attr.add(
        "LOCALITY",
        oid_const(py, synta_certificate::oids::attr::LOCALITY),
    )?;
    attr.add(
        "ORGANIZATION",
        oid_const(py, synta_certificate::oids::attr::ORGANIZATION),
    )?;
    attr.add(
        "ORG_UNIT",
        oid_const(py, synta_certificate::oids::attr::ORG_UNIT),
    )?;
    attr.add(
        "ORG_IDENTIFIER",
        oid_const(py, synta_certificate::oids::attr::ORG_IDENTIFIER),
    )?;
    attr.add(
        "STREET",
        oid_const(py, synta_certificate::oids::attr::STREET),
    )?;
    attr.add(
        "SURNAME",
        oid_const(py, synta_certificate::oids::attr::SURNAME),
    )?;
    attr.add(
        "GIVEN_NAME",
        oid_const(py, synta_certificate::oids::attr::GIVEN_NAME),
    )?;
    attr.add(
        "INITIALS",
        oid_const(py, synta_certificate::oids::attr::INITIALS),
    )?;
    attr.add("TITLE", oid_const(py, synta_certificate::oids::attr::TITLE))?;
    attr.add(
        "SERIAL_NUMBER",
        oid_const(py, synta_certificate::oids::attr::SERIAL_NUMBER),
    )?;
    attr.add(
        "EMAIL_ADDRESS",
        oid_const(py, synta_certificate::oids::attr::EMAIL_ADDRESS),
    )?;
    attr.add(
        "USER_ID",
        oid_const(py, synta_certificate::oids::attr::USER_ID),
    )?;
    attr.add(
        "DOMAIN_COMPONENT",
        oid_const(py, synta_certificate::oids::attr::DOMAIN_COMPONENT),
    )?;
    attr.add(
        "BUSINESS_CATEGORY",
        oid_const(py, synta_certificate::oids::attr::BUSINESS_CATEGORY),
    )?;
    attr.add(
        "POSTAL_CODE",
        oid_const(py, synta_certificate::oids::attr::POSTAL_CODE),
    )?;
    attr.add(
        "GENERATION_QUALIFIER",
        oid_const(py, synta_certificate::oids::attr::GENERATION_QUALIFIER),
    )?;
    attr.add(
        "DN_QUALIFIER",
        oid_const(py, synta_certificate::oids::attr::DN_QUALIFIER),
    )?;
    attr.add(
        "PSEUDONYM",
        oid_const(py, synta_certificate::oids::attr::PSEUDONYM),
    )?;
    attr.add(
        "JURISDICTION_LOCALITY",
        oid_const(py, synta_certificate::oids::attr::JURISDICTION_LOCALITY),
    )?;
    attr.add(
        "JURISDICTION_STATE",
        oid_const(py, synta_certificate::oids::attr::JURISDICTION_STATE),
    )?;
    attr.add(
        "JURISDICTION_COUNTRY",
        oid_const(py, synta_certificate::oids::attr::JURISDICTION_COUNTRY),
    )?;

    crate::install_submodule(&m, &attr, "synta.oids.attr", None)?;
    crate::install_submodule(
        parent,
        &m,
        "synta.oids",
        Some("OID constants for X.509 signature, public-key, and extension algorithms."),
    )
}

// ── GeneralName tag constants (synta.general_name) ───────────────────────────

fn register_general_name_submodule(parent: &Bound<'_, PyModule>) -> PyResult<()> {
    let py = parent.py();
    let m = PyModule::new(py, "general_name")?;

    // ── GeneralName alternatives ─────────────────────────────────────────────
    m.add("OTHER_NAME", synta_certificate::general_name::OTHER_NAME)?;
    m.add("RFC822_NAME", synta_certificate::general_name::RFC822_NAME)?;
    m.add("DNS_NAME", synta_certificate::general_name::DNS_NAME)?;
    m.add(
        "X400_ADDRESS",
        synta_certificate::general_name::X400_ADDRESS,
    )?;
    m.add(
        "DIRECTORY_NAME",
        synta_certificate::general_name::DIRECTORY_NAME,
    )?;
    m.add(
        "EDI_PARTY_NAME",
        synta_certificate::general_name::EDI_PARTY_NAME,
    )?;
    m.add("URI", synta_certificate::general_name::URI)?;
    m.add("IP_ADDRESS", synta_certificate::general_name::IP_ADDRESS)?;
    m.add(
        "REGISTERED_ID",
        synta_certificate::general_name::REGISTERED_ID,
    )?;

    crate::install_submodule(
        parent,
        &m,
        "synta.general_name",
        Some(concat!(
            "Context-specific tag numbers for the ``GeneralName`` CHOICE type ",
            "(RFC 5280 \u{a7}4.2.1.6).\n\n",
            "These integer constants correspond to the first element of tuples returned by\n",
            ":func:`~synta.parse_general_names` and ",
            ":meth:`~synta.Certificate.subject_alt_names`.\n\n",
            "Example usage::\n\n",
            "    import synta.general_name as gn\n",
            "    for tag, content in cert.subject_alt_names():\n",
            "        if tag == gn.DNS_NAME:\n",
            "            print('DNS:', content.decode())\n",
            "        elif tag == gn.IP_ADDRESS:\n",
            "            print('IP:', content.hex())",
        )),
    )
}