certvalidator
Validates X.509 certificates and paths
Decision gist · record as of 2026-08-14
Yes, if you need fine-grained X.509 validation control beyond what the standard library offers. The library is actively maintained, has low install friction, carries no known vulnerabilities, and is licensed permissively. Install with caution if you require name constraint support or depend on cutting-edge Python versions, as the latest release predates modern Python versions in the classifier list.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Low friction: pure Python wheel with only two runtime dependencies (asn1crypto and oscrypto).
- Actively maintained with recent commits; last release was 3668 days ago but repository shows ongoing activity.
License · maintenance · safety
MIT (permissive) — MIT license permits use in commercial and proprietary projects with minimal restrictions; only requires preserving the license notice.
last release 2016-07-29 (3668 days) · last repo commit 2026-07-18 · 115 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 446,967 downloads/mo, #6,610 on PyPI
Alternatives
Verify before relying
pip install certvalidator
from certvalidator import CertificateValidator
from certvalidator.context import ValidationContext
context = ValidationContext()
validator = CertificateValidator(context=context)
# validator.validate_tls(hostname, cert_chain)- Current maintenance status relative to Python 3.13+ support (classifiers list 3.14 but latest_release is 2016-07-29)
- Whether revocation checking (CRL/OCSP) works reliably with modern certificate authorities
- Performance characteristics when validating large certificate chains or under high throughput
What it is and what it does
certvalidator is a Python library for validating X.509 certificates and certificate paths according to PKI standards. It handles the core validation logic—signature verification, name chaining, validity dates, key usage extensions, and policy constraints—plus advanced features like revocation checking through CRL and OCSP, whitelisting/blacklisting, and validation at a specific point in time. The library depends on asn1crypto for ASN.1 parsing and oscrypto for cryptographic operations.
The package is designed for developers who need to verify TLS/SSL server certificates, build and validate certificate chains, or implement custom PKI validation logic. It includes support for indirect and delta CRLs, delegated OCSP responders, and configurable soft-failure modes for revocation checks. The library does not support name constraints, which is a known limitation for some advanced PKI scenarios.
Use it for
- Validate TLS/SSL server certificates in custom HTTPS clients or proxies
- Build and verify certificate chains for PKI-based authentication systems
- Perform revocation checks against CRLs or OCSP responders in security-critical applications
- Implement point-in-time certificate validation for historical or audit purposes
- Whitelist or blacklist specific certificates or hash algorithms in custom security policies
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need fine-grained X.509 validation control beyond what the standard library offers.
The library is actively maintained, has low install friction, carries no known vulnerabilities, and is licensed permissively. Install with caution if you require name constraint support or depend on cutting-edge Python versions, as the latest release predates modern Python versions in the classifier list.
Install
certvalidator on PyPI
Before you install
Low friction: pure Python wheel with only two runtime dependencies (asn1crypto and oscrypto). Actively maintained with recent commits; last release was 3668 days ago but repository shows ongoing activity.
License in practice
MIT license permits use in commercial and proprietary projects with minimal restrictions; only requires preserving the license notice.
Quickstart
pip install certvalidator
from certvalidator import CertificateValidator
from certvalidator.context import ValidationContext
context = ValidationContext()
validator = CertificateValidator(context=context)
# validator.validate_tls(hostname, cert_chain)Verify before relying
- Current maintenance status relative to Python 3.13+ support (classifiers list 3.14 but latest_release is 2016-07-29)
- Whether revocation checking (CRL/OCSP) works reliably with modern certificate authorities
- Performance characteristics when validating large certificate chains or under high throughput
Package facts
| License | MIT permissive |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 2 packagesasn1cryptooscrypto |
| Maintenance | Actively maintained 3,668 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 446,967 / month, #6,610 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 4 - BetaIntended Audience :: DevelopersLicense :: OSI Approved :: MIT LicenseProgramming Language :: Python :: 2.6Programming Language :: Python :: 2.7Programming Language :: Python :: 3.2Programming Language :: Python :: 3.3Programming Language :: Python :: 3.4Programming Language :: Python :: 3.5Programming Language :: Python :: Implementation :: PyPyTopic :: Security :: Cryptography |
Evidence: certvalidator-0.11.1-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “x.509 certificate validation”
- certvalidatorValidates X.509 certificates and certificate chains, supporting path…
- pyhanko-certvalidatorValidates X.509 certificate paths with support for revocation checks…
- asn1cryptoA pure Python library for parsing and serializing ASN.1 structures,…
Give your agent the search over MCP, or paste the wish link into any chat.
More Cryptography packages
Certifi provides Mozilla's curated collection of root SSL certificates for Python applications to validate TLS hosts and verify certificate trustworthiness.
cryptography provides cryptographic recipes and low-level primitives for symmetric encryption, message digests, key derivation, and other common cryptographic algorithms in Python.
Pure-Python RSA encryption, decryption, signing, and key generation following PKCS#1 v1.5, with command-line and library interfaces.
pyOpenSSL wraps OpenSSL's SSL/TLS functionality for Python, providing high-level connection objects and certificate handling through a Python-friendly interface around OpenSSL's cryptographic operations.
Provides Microsoft Entra ID token-based authentication for Azure SDK clients through a set of TokenCredential implementations that handle OAuth flows and managed identity support.
PyNaCl provides Python bindings to libsodium for digital signatures, secret-key and public-key encryption, hashing, message authentication, and password-based key derivation.
See also ocspbuilder · pyhanko-certvalidator · asn1crypto · aia · ocspresponder · openssl-ocsp-responder · wincertstore · oscrypto · igwn-auth-utils