django_ca.extensions.base - Extension base classes

Base classes for x509 extensions.

class django_ca.extensions.base.AlternativeNameExtension(value=None)

Base class for extensions that contain a list of general names.

This class also allows you to pass GeneralName instances:

>>> san = SubjectAlternativeName({'value': [x509.DNSName('example.com'), 'example.net']})
>>> san
<SubjectAlternativeName: ['DNS:example.com', 'DNS:example.net'], critical=False>
>>> 'example.com' in san, 'DNS:example.com' in san, x509.DNSName('example.com') in san
(True, True, True)

class django_ca.extensions.base.CRLDistributionPointsBase(value=None)

Base class for CRLDistributionPoints and FreshestCRL.

class django_ca.extensions.base.Extension(value=None)

Convenience class to handle X509 Extensions.

The value is a dict as used by the CA_PROFILES setting:

>>> KeyUsage({'value': ['keyAgreement', 'keyEncipherment']})
<KeyUsage: ['keyAgreement', 'keyEncipherment'], critical=True>
>>> KeyUsage({'critical': False, 'value': ['key_agreement', 'key_encipherment']})
<KeyUsage: ['keyAgreement', 'keyEncipherment'], critical=False>

… but can also use a subclass of ExtensionType from cryptography:

>>> from cryptography import x509
>>> cg_ext = x509.extensions.Extension(
...    oid=ExtensionOID.EXTENDED_KEY_USAGE,
...    critical=False,
...    value=x509.ExtendedKeyUsage([ExtendedKeyUsageOID.SERVER_AUTH])
... )
>>> ExtendedKeyUsage(cg_ext)
<ExtendedKeyUsage: ['serverAuth'], critical=False>
>>> ExtendedKeyUsage({'value': ['serverAuth']})
<ExtendedKeyUsage: ['serverAuth'], critical=False>

Changed in version 1.18.0: This class is now an abstract base class.

Parameters

valuelist or tuple or dict or str or ExtensionType

The value of the extension, the description provides further details.

Attributes

name

A human readable name of this extension

value

Raw value for this extension. The type various from subclass to subclass.

criticalbool

If this extension is marked as critical

oid

The OID for this extension.

keystr

The key is a reusable ID used in various parts of the application.

default_criticalbool

The default critical value if you pass a dict without the "critical" key.

as_extension()

This extension as Extension.

as_text()

Human-readable version of the value, not including the “critical” flag.

abstract property extension_type

The ExtensionType instance of this extension.

Implementing classes are expected to implement this function.

for_builder()

Return a tuple suitable for a CertificateBuilder.

Example:

>>> ext = KeyUsage({'value': ['keyAgreement', 'keyEncipherment']})
>>> builder = x509.CertificateBuilder()
>>> builder.add_extension(*ext.for_builder())  
<cryptography.x509.base.CertificateBuilder object at ...>

abstract from_dict(value)

Load class from a dictionary.

Implementing classes are expected to implement this function.

abstract from_extension(value)

Load a wrapper class from a cryptography extension instance.

Implementing classes are expected to implement this function.

from_other(value)

Load class from any other value type.

This class can be overwritten to allow loading classes from different types.

hash_value()

Return the current extension value in hashable form.

This function is used for the default implementations for hash() and the == equality operator.

abstract repr_value()

String representation of the current value for this extension.

Implementing classes are expected to implement this function.

serialize()

Serialize this extension to a string in a way that it can be passed to a constructor again.

For example, this should always be True:

>>> ku = KeyUsage({'value': ['keyAgreement', 'keyEncipherment']})
>>> ku == KeyUsage(ku.serialize())
True

abstract serialize_value()

Serialize the value for this extension.

Implementing classes are expected to implement this function.

class django_ca.extensions.base.IterableExtension(value=None)

Base class for iterable extensions.

Extensions of this class can be used just like any other iterable, e.g.:

>>> e = KeyUsage({'value': ['cRLSign'], 'critical': True})
>>> 'cRLSign' in e
True
>>> len(e)
1
>>> for val in e:
...     print(val)
cRLSign

parse_value(value)

Parse a single value (presumably from an iterable).

serialize_item(value)

Serialize a single item in the iterable contained in this extension.

serialize_value()

Serialize the whole iterable contained in this extension.

class django_ca.extensions.base.ListExtension(value=None)

Base class for extensions with multiple ordered values.

Changed in version 1.18.0: This class is now an abstract base class.

class django_ca.extensions.base.NullExtension(value=None)

Base class for extensions that do not have a value.

Changed in version 1.18.0: This class is now an abstract base class.

Some extensions, like OCSPNoCheck or PrecertPoison do not encode any information, but the presence of the extension itself carries meaning.

Extensions using this base class will ignore any "value" key in their dict, only the "critical" key is relevant:

>>> OCSPNoCheck()
<OCSPNoCheck: critical=False>
>>> OCSPNoCheck({'critical': True})
<OCSPNoCheck: critical=True>
>>> OCSPNoCheck({'critical': True})
<OCSPNoCheck: critical=True>
>>> OCSPNoCheck(x509.extensions.Extension(oid=ExtensionOID.OCSP_NO_CHECK, critical=True, value=None))
<OCSPNoCheck: critical=True>

class django_ca.extensions.base.OrderedSetExtension(value=None)

Base class for extensions that contain a set of values.

Changed in version 1.18.0: This class is now an abstract base class.

For reproducibility, any serialization will always sort the values contained in this extension.

Extensions derived from this class can be used like a normal set, for example:

>>> e = KeyUsage({'value': {'cRLSign', }})
>>> e.add('keyAgreement')
>>> e
<KeyUsage: ['cRLSign', 'keyAgreement'], critical=True>
>>> e -= {'keyAgreement', }
>>> e
<KeyUsage: ['cRLSign'], critical=True>

parse_iterable(iterable)

Parse values from the given iterable.

class django_ca.extensions.base.SignedCertificateTimestampsBase(value=None)

Base class for extensions containing signed certificate timestamps.

Derived classes cannot be instantiated by any custom value, only the matching subclass of ExtensionType is supported. Unfortunately cryptography currently does not support creating instances of SignedCertificateTimestamp (see issue #4820). This extension thus also has no way of adding/removing any elements. Any attempt of updating an instance will raise NotImplementedError.

See also

• RFC 6962

• https://certificate.transparency.dev/howctworks/

class django_ca.extensions.base.UnrecognizedExtension(value, name='', error='')

Class wrapping any extension this module does not support.