add test to confirm IDNA2003 is disallowed
document that this is a possible exception
diff --git a/docs/x509.rst b/docs/x509.rst
index c8505a8..c570f19 100644
--- a/docs/x509.rst
+++ b/docs/x509.rst
@@ -313,6 +313,9 @@
:raises cryptography.x509.UnsupportedGeneralNameType: If an extension
contains a general name that is not supported.
+ :raises UnicodeError: If an extension contains IDNA encoding that is
+ invalid or not compliant with IDNA 2008.
+
.. doctest::
>>> for ext in cert.extensions:
diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index d3488a9..20a016b 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -1332,6 +1332,17 @@
rfc822name = san.get_values_for_type(x509.RFC822Name)
assert [u"email@em\xe5\xefl.com"] == rfc822name
+ def test_idna2003_invalid(self, backend):
+ cert = _load_cert(
+ os.path.join(
+ "x509", "custom", "san_idna2003_dnsname.pem"
+ ),
+ x509.load_pem_x509_certificate,
+ backend
+ )
+ with pytest.raises(UnicodeError):
+ cert.extensions
+
def test_unicode_rfc822_name_dns_name_uri(self, backend):
cert = _load_cert(
os.path.join(