add extendedkeyusage extension
diff --git a/docs/x509.rst b/docs/x509.rst
index d8fce97..af24944 100644
--- a/docs/x509.rst
+++ b/docs/x509.rst
@@ -475,6 +475,15 @@
subordinate CA, but the subordinate CA is not allowed to create
subordinates with ``ca`` set to true.
+.. class:: ExtendedKeyUsage
+
+ .. versionadded:: 0.9
+
+ This extension indicates one or more purposes for which the certified
+ public key may be used, in addition to or in place of the basic
+ purposes indicated in the key usage extension. The object is
+ iterable to obtain the list of :ref:`extended key usage OIDs <eku_oids>`.
+
Object Identifiers
~~~~~~~~~~~~~~~~~~
@@ -633,6 +642,8 @@
Corresponds to the dotted string ``"2.16.840.1.101.3.4.3.2"``. This is
a SHA256 digest signed by a DSA key.
+.. _eku_oids:
+
Extended Key Usage OIDs
~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/src/cryptography/x509.py b/src/cryptography/x509.py
index 8b4ee20..791d1ef 100644
--- a/src/cryptography/x509.py
+++ b/src/cryptography/x509.py
@@ -222,6 +222,23 @@
"value={0.value})>").format(self)
+class ExtendedKeyUsage(object):
+ def __init__(self, usages):
+ for oid in usages:
+ if not isinstance(oid, ObjectIdentifier):
+ raise TypeError(
+ "Every item in the usages list must be an ObjectIdentifier"
+ )
+
+ self._usages = usages
+
+ def __iter__(self):
+ return iter(self._usages)
+
+ def __len__(self):
+ return len(self._usages)
+
+
class BasicConstraints(object):
def __init__(self, ca, path_length):
if not isinstance(ca, bool):
diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index af13f27..87580a0 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -62,6 +62,23 @@
)
+class TestExtendedKeyUsage(object):
+ def test_not_all_oids(self):
+ with pytest.raises(TypeError):
+ x509.ExtendedKeyUsage(["notoid"])
+
+ def test_iter_len(self):
+ eku = x509.ExtendedKeyUsage([
+ x509.ObjectIdentifier("1.3.6.1.5.5.7.3.1"),
+ x509.ObjectIdentifier("1.3.6.1.5.5.7.3.2"),
+ ])
+ assert len(eku) == 2
+ assert list(eku) == [
+ x509.OID_SERVER_AUTH,
+ x509.OID_CLIENT_AUTH
+ ]
+
+
@pytest.mark.requires_backend_interface(interface=RSABackend)
@pytest.mark.requires_backend_interface(interface=X509Backend)
class TestExtensions(object):