Module x509_verification 

Python bindings for X.509 certificate chain verification.

This module builds the synta.x509 Python submodule, exposing RFC 5280 / CABF certificate path validation powered by synta_x509_verification with the default signature backend from synta_certificate.

Quick start

import synta
import synta.x509 as x509

# Load trust anchors (DER bytes).
with open("root.der", "rb") as f:
    root_der = f.read()
store = x509.TrustStore([root_der])

# Verify a TLS server certificate chain.
with open("leaf.der", "rb") as f:
    leaf_der = f.read()
policy = x509.VerificationPolicy(server_names=["example.com"])
chain = x509.verify_server_certificate(leaf_der, [], store, policy)
# chain is list[bytes], root-first: chain[0] is the trust anchor.
for cert_der in chain:
    cert = synta.Certificate.from_der(cert_der)
    print(cert.subject)

# CRL-based revocation checking (optional):
crl_ders = synta.pem_to_der(open("issuing-ca.crl", "rb").read())
crl_store = x509.CrlStore(crl_ders)
chain = x509.verify_server_certificate(leaf_der, [], store, policy, crls=crl_store)

# OCSP-based revocation checking (optional):
ocsp_resp_der = open("ocsp-response.der", "rb").read()
ocsp_store = x509.OcspStore([ocsp_resp_der])
chain = x509.verify_server_certificate(leaf_der, [], store, policy, ocsp=ocsp_store)

# Both CRL and OCSP revocation at once:
chain = x509.verify_server_certificate(
    leaf_der, [], store, policy, crls=crl_store, ocsp=ocsp_store
)

Structs

PyCrlStore

A store of Certificate Revocation Lists (CRLs) for revocation checking.

PyOcspStore

A store of pre-fetched OCSP responses for revocation checking.

PyTrustStore

A set of trusted CA certificates for X.509 chain verification.

PyVerificationPolicy

Optional parameters that control certificate chain verification.

X509VerificationError

Functions

register_x509_module

Register the synta.x509 submodule onto parent.