pyhanko-certvalidator

pyhanko-certvalidator is a Python library for validating X.509 certificate paths, maintained as part of the pyHanko project. A fork of wbond’s certvalidator, it builds and verifies certificate chains against a set of trust roots while checking revocation status through CRLs and OCSP.

It is central to pyHanko’s PDF signature validation but is usable standalone, offering support for name constraints, extended key usage, policy processing, and point-in-time (historical) validation needed for long-term signature verification.

What You Get

• Full X.509 certificate path building and RFC 5280 path validation
• Revocation checking through CRLs and OCSP, with configurable fetching
• Point-in-time (historical) validation for long-term signature verification
• Support for name constraints, extended key usage, and certificate policies

Common Use Cases

• Validating certificate chains behind PDF digital signatures in pyHanko
• Checking certificate revocation status via OCSP or CRL in a PKI workflow
• Performing historical validation of signatures at a past point in time

Under The Hood

Architecture - The library exposes a CertificateValidator plus a ValidationContext that holds trust roots, revocation policy, and a moment-in-time clock. Path building assembles candidate chains from intermediate certificates, then a validator walks each chain applying RFC 5280 checks (signatures, validity windows, basic constraints, name constraints, key usage, policies) and consults CRL and OCSP fetchers/checkers for revocation. Async fetching lets it retrieve CRLs and OCSP responses on demand or work purely from supplied evidence.

Tech Stack - Pure Python built on asn1crypto for certificate, CRL, and OCSP parsing, with oscrypto/pyca cryptography backends for signature verification and aiohttp-style async fetching. It ships as a subpackage of the pyHanko monorepo under pkgs/pyhanko-certvalidator.

Code Quality - As part of the actively developed pyHanko project (38+ commits/month, 72 releases, Codecov-tracked), it carries a substantial test suite covering path-building and revocation edge cases. It descends from wbond’s well-regarded certvalidator, inheriting a mature, standards-focused codebase.

API Design - The core flow is a few objects: build a ValidationContext, then call CertificateValidator(cert, …).validate_usage(…). The abstraction is clean, but correctly configuring trust, revocation modes, and historical validation demands real PKI knowledge, so the learning curve tracks the complexity of X.509 rather than the API itself.