certvalidator

from datetime import datetime from oscrypto import tls from certvalidator import CertificateValidator, errors from certvalidator.stores import TrustStore # Target host and port for certificate retrieval hostname = "google.com" port = 443 try: # Step 1: Obtain the end-entity (leaf) certificate and its chain from a TLS server. # oscrypto.tls.TLSSocket provides the full chain (peer_certificate and intermediate_certificates). # This establishes a connection to fetch the server's certificate chain. connection = tls.TLSSocket(hostname, port, timeout=5) # The attributes are oscrypto.asymmetric.Certificate objects; dump() gets their DER bytes. leaf_cert_der = connection.peer_certificate.dump() intermediate_certs_der = [c.dump() for c in connection.intermediate_certificates] connection.close() # Close the connection once certs are retrieved # Step 2: Prepare the trust anchors (root CAs). # TrustStore() by default loads system-wide trust anchors (e.g., from OS certificate store). # For custom roots, use: SimpleTrustStore([root_ca_der_bytes, ...]). trust_store = TrustStore() # Step 3: Create a CertificateValidator instance. # Arguments: leaf certificate, list of intermediate certificates, and the trust store. validator = CertificateValidator( leaf_cert_der, intermediate_certs_der, trust_store=trust_store ) # Step 4: Perform validation for a specific purpose (e.g., TLS server certificate). # validate_tls_server verifies hostname, key usage, validity period, and revocation status. # validation_time is optional, defaults to datetime.utcnow(). validation_path = validator.validate_tls_server(hostname, validation_time=datetime.utcnow()) print(f"Certificate for {hostname} is valid.") print("Validated path:") for cert_in_path in validation_path: print(f" - Subject: {cert_in_path.subject.human_friendly}") print(f" Issuer: {cert_in_path.issuer.human_friendly}") except errors.PathValidationError as e: print(f"Certificate validation failed for {hostname}: {e}") except Exception as e: print(f"An error occurred: {e}") print("Ensure network connectivity and that 'oscrypto' and 'certvalidator' are installed.")