I am seeing a new error (to me) loading a X509 certificate after updating my Python version and the cryptography library. Searching I ran across #6386 that seems similar. I was hoping that someone familiar with the ASN.1 might be causing this, and if that is the case, provide some advice on what version of what library I need to load to correct this issue.
The full exception I am seeing is:
ValueError: error parsing asn1 value: ParseError { kind: EncodedDefault, location: ["RawCertificate::tbs_cert", "TbsCertificate::extensions", "2", "Extension::critical"] }
My end goal is to load this certificate containing a public key, then use that key to verify a signature attached to a binary file. Because this is a public key only I will release (attach) an example script I have put together that shows this issue I am seeing. The full 'verify' script was working previously under Python 3.8.1 (I believe) and an earlier cryptography library, version unrecorded/unknown. That earlier configuration was able to load signatures created using both SHA256 and SHA512 hashes using the appropriate certificates that went with those signatures. The current configuration works for the SHA256 signature but fails loading the certificated associated with the SHA512 hash. The example contains the public part of the failing certificate.
I am running on Windows 10 Enterprise, V21H2 with Python 3.10.6, but have regressed and see the same failure with both 3.9.13 and 3.8.10. All of these versions are using the crypto library version 37.0.4.
C:>python --version
Python 3.10.6
C:>pip list
Package Version
cffi 1.15.1
cryptography 37.0.4
Pillow 9.2.0
pip 22.2.2
pycparser 2.21
setuptools 65.0.1
six 1.16.0
Example Script:
certRawData = """-----BEGIN CERTIFICATE-----
MIIFVzCCAz+gAwIBAgIEYfgE3jANBgkqhkiG9w0BAQ0FADBPMSMwIQYDVQQKExpI
ZXdsZXR0IFBhY2thcmQgRW50ZXJwcmlzZTEoMCYGA1UEAxMfSFBFIEFsbGVydGEg
NDA5Ni1iaXQgUlNBIDIwMjEtMTAeFw0yMTEyMDEwMDAwMDBaFw0zNjEyMDIwMDAw
MDBaME8xIzAhBgNVBAoTGkhld2xldHQgUGFja2FyZCBFbnRlcnByaXNlMSgwJgYD
VQQDEx9IUEUgQWxsZXJ0YSA0MDk2LWJpdCBSU0EgMjAyMS0xMIICIjANBgkqhkiG
9w0BAQEFAAOCAg8AMIICCgKCAgEAl5tDLch9CBx8ZRmCkk8Acau+wX4et3pzOjXX
RxJAMnsakHNgt1c1AsP9iAxf1DPDClvLhsOJ6AV75LbrzX07bpNaBjIDTctI96Iv
HeyFotuNGtwBsQJqp1b9hbZ1qm9OxvY+uEQi3eRHVQbuk5xe3mr7706ORNBNkMhh
ovKkfa+2G6/sl9gZ96PFTmXybYBl/O5PqK61xz9XQ11t7p55kCT8DErILtrLKsYX
RKlvvWcJ6oZgUCcUpuGeC5pilfLdWxQ4Vfi6Veu13pOW1UrqVwihwTvN8LLsQ6mb
tRt9/Iiowe6mXqXhCyoCfQhw8Y/nUbIJol96+MZepEH6dhpu1zVfKuNivMnTPLOa
nTK9xFgsgSxEER/4E0ZV9GaW/9jda6CqJpdKXY4KVJIUVk36b5f9Si2SsOEfOmM7
/h0mpRV2vKCJ0mvWAGqiG7pJWB+lMq+Cr8DZCjc0t/eF996a5aqO/DcrD6WcM/+S
SaENeWpHjhxNd3sqwAolFjdtFIVWKho4qE5TjXtKEMg0D3GntEKj+t41fHr4cLpC
XQ3hOVfncdSD4nAPno0yXUwFOeplfInMGgX9zvizRoUykbbCXXxjc9XaeKO5dYmP
TG8hoJ9x8XPnaVEoeWmpG0Yr7lzsaGn30Ysoqppz2TWbATKQLAsicavinqRxZ5bs
UlsHrY8CAwEAAaM7MDkwDgYDVR0PAQH/BAQDAgeAMA8GA1UdEwEB/wQFMAMBAQAw
FgYDVR0lAQEABAwwCgYIKwYBBQUHAwMwDQYJKoZIhvcNAQENBQADggIBAARMeFl0
vRxjJDQx5jupZ+I9+VY0i+jvJn/id37OqyEZwJH/prpUeMfp3eXrbZNEsEKy2UaM
ZCP0CwucR+2LnJRcThib2fFj/UE4u2dEI9THYyj8GaITPfClQ91Mgi1OhjLvOQ8K
HOUGeZVL5jsqo9qbgiA2UnHKRuofppYVTQQPd7v0atQ+3fNLqVyQUuS/TKYlPdOO
6+oeMIT4cOkQrQYnpzaWDyt6GOKLcBrkTRpFSS+QA1BOw2xx0Z7ovbQSOZ37VJ78
tNSqsflpQhvSvcHLja5TE5MxtXKdSWcp3JxpRRb7winioZnVZBHsH6dhVO4Lpq71
zW5CkG65StP+cJGnR50KZzbo0K6nlMwe0AVc5zoBfZEp09ux1SM869IY1snbHkKi
4FBE6wjG5QLDACqqOzEuSbMpLI0Eqb6ix2/BAZUtIGNMQRJuLt/taH2mcX0f4QR9
8Vo2kx+35Wenk3Avi+QL5J3b9M7EX8EkSD/Fgj9tdXaxDe+QVCeV3TVdKQKp9isR
N4RD8Es4VLCpfQOgpZQjXx513xXbKNi4I7Kk6+Vwp59uQRNrtRbz0QVZ6KB3RJiI
dm89xAjpU5Lr/1Ws6IHd8Zo1tUwe5LlzqHatykzk3slb5QjODZhOc0DoUgmeDJjO
ENf8/LeTUQGuKbiLT1e5YIvT+GUjN4Eh3XvD
-----END CERTIFICATE-----
"""
from cryptography.hazmat.backends import default_backend
from cryptography.x509 import load_pem_x509_certificate
load_pem_x509_certificate(certRawData.encode(), default_backend())
print "Certificate load successful."