improve x509 load error handling
diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
index ceb10cf..19d149b 100644
--- a/src/cryptography/hazmat/backends/openssl/backend.py
+++ b/src/cryptography/hazmat/backends/openssl/backend.py
@@ -682,14 +682,20 @@
x509 = self._lib.PEM_read_bio_X509(
mem_bio.bio, self._ffi.NULL, self._ffi.NULL, self._ffi.NULL
)
- assert x509 != self._ffi.NULL
+ if x509 == self._ffi.NULL:
+ self._consume_errors()
+ raise ValueError("Unable to load certificate")
+
x509 = self._ffi.gc(x509, self._lib.X509_free)
return _X509Certificate(self, x509)
def load_der_x509_certificate(self, data):
mem_bio = self._bytes_to_bio(data)
x509 = self._lib.d2i_X509_bio(mem_bio.bio, self._ffi.NULL)
- assert x509 != self._ffi.NULL
+ if x509 == self._ffi.NULL:
+ self._consume_errors()
+ raise ValueError("Unable to load certificate")
+
x509 = self._ffi.gc(x509, self._lib.X509_free)
return _X509Certificate(self, x509)
diff --git a/tests/test_x509.py b/tests/test_x509.py
index 0a120eb..1e1bde1 100644
--- a/tests/test_x509.py
+++ b/tests/test_x509.py
@@ -103,3 +103,11 @@
)
)
assert cert.version == x509.X509Version.v1
+
+ def test_invalid_pem(self, backend):
+ with pytest.raises(ValueError):
+ x509.load_pem_x509_certificate(b"notacert", backend)
+
+ def test_invalid_der(self, backend):
+ with pytest.raises(ValueError):
+ x509.load_der_x509_certificate(b"notacert", backend)