support issuer alternative name encoding
diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
index ad88dd9..569d025 100644
--- a/src/cryptography/hazmat/backends/openssl/backend.py
+++ b/src/cryptography/hazmat/backends/openssl/backend.py
@@ -281,7 +281,7 @@
return general_names
-def _encode_subject_alt_name(backend, san):
+def _encode_alt_name(backend, san):
general_names = _encode_general_names(backend, san)
general_names = backend._ffi.gc(
general_names, backend._lib.GENERAL_NAMES_free
@@ -477,7 +477,8 @@
x509.OID_BASIC_CONSTRAINTS: _encode_basic_constraints,
x509.OID_SUBJECT_KEY_IDENTIFIER: _encode_subject_key_identifier,
x509.OID_KEY_USAGE: _encode_key_usage,
- x509.OID_SUBJECT_ALTERNATIVE_NAME: _encode_subject_alt_name,
+ x509.OID_SUBJECT_ALTERNATIVE_NAME: _encode_alt_name,
+ x509.OID_ISSUER_ALTERNATIVE_NAME: _encode_alt_name,
x509.OID_EXTENDED_KEY_USAGE: _encode_extended_key_usage,
x509.OID_AUTHORITY_KEY_IDENTIFIER: _encode_authority_key_identifier,
x509.OID_AUTHORITY_INFORMATION_ACCESS: (
diff --git a/tests/hazmat/backends/test_openssl.py b/tests/hazmat/backends/test_openssl.py
index 8f559c8..1c7a718 100644
--- a/tests/hazmat/backends/test_openssl.py
+++ b/tests/hazmat/backends/test_openssl.py
@@ -50,6 +50,11 @@
skip_if_libre_ssl(u"LibreSSL 2.1.6")
+@utils.register_interface(x509.ExtensionType)
+class DummyExtension(object):
+ oid = x509.ObjectIdentifier("1.2.3.4")
+
+
@utils.register_interface(Mode)
class DummyMode(object):
name = "dummy-mode"
@@ -529,7 +534,7 @@
).not_valid_after(
datetime.datetime(2020, 1, 1)
).add_extension(
- x509.IssuerAlternativeName([x509.DNSName(u"crypto.io")]), False
+ DummyExtension(), False
)
with pytest.raises(NotImplementedError):
diff --git a/tests/test_x509.py b/tests/test_x509.py
index 26bd3cb..9100b44 100644
--- a/tests/test_x509.py
+++ b/tests/test_x509.py
@@ -27,6 +27,11 @@
from .utils import load_vectors_from_file
+@utils.register_interface(x509.ExtensionType)
+class DummyExtension(object):
+ oid = x509.ObjectIdentifier("1.2.3.4")
+
+
@utils.register_interface(x509.GeneralName)
class FakeGeneralName(object):
def __init__(self, value):
@@ -1416,6 +1421,43 @@
@pytest.mark.requires_backend_interface(interface=RSABackend)
@pytest.mark.requires_backend_interface(interface=X509Backend)
+ def test_issuer_alt_name(self, backend):
+ issuer_private_key = RSA_KEY_2048.private_key(backend)
+ subject_private_key = RSA_KEY_2048.private_key(backend)
+
+ not_valid_before = datetime.datetime(2002, 1, 1, 12, 1)
+ not_valid_after = datetime.datetime(2030, 12, 31, 8, 30)
+
+ cert = x509.CertificateBuilder().subject_name(
+ x509.Name([x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US')])
+ ).issuer_name(
+ x509.Name([x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US')])
+ ).not_valid_before(
+ not_valid_before
+ ).not_valid_after(
+ not_valid_after
+ ).public_key(
+ subject_private_key.public_key()
+ ).serial_number(
+ 123
+ ).add_extension(
+ x509.IssuerAlternativeName([
+ x509.DNSName(u"myissuer"),
+ x509.RFC822Name(u"email@domain.com"),
+ ]), critical=False
+ ).sign(issuer_private_key, hashes.SHA256(), backend)
+
+ ext = cert.extensions.get_extension_for_oid(
+ x509.OID_ISSUER_ALTERNATIVE_NAME
+ )
+ assert ext.critical is False
+ assert ext.value == x509.IssuerAlternativeName([
+ x509.DNSName(u"myissuer"),
+ x509.RFC822Name(u"email@domain.com"),
+ ])
+
+ @pytest.mark.requires_backend_interface(interface=RSABackend)
+ @pytest.mark.requires_backend_interface(interface=X509Backend)
def test_extended_key_usage(self, backend):
issuer_private_key = RSA_KEY_2048.private_key(backend)
subject_private_key = RSA_KEY_2048.private_key(backend)
@@ -1718,7 +1760,7 @@
x509.SubjectAlternativeName([x509.DNSName(u"cryptography.io")]),
critical=False,
).add_extension(
- x509.IssuerAlternativeName([x509.DNSName(u"crypto.io")]), False
+ DummyExtension(), False
)
with pytest.raises(NotImplementedError):
builder.sign(private_key, hashes.SHA256(), backend)