certvalidator

What it is and what it does

certvalidator is a Python library for validating X.509 certificates and certificate paths according to PKI standards. It handles the core validation logic—signature verification, name chaining, validity dates, key usage extensions, and policy constraints—plus advanced features like revocation checking through CRL and OCSP, whitelisting/blacklisting, and validation at a specific point in time. The library depends on asn1crypto for ASN.1 parsing and oscrypto for cryptographic operations.

The package is designed for developers who need to verify TLS/SSL server certificates, build and validate certificate chains, or implement custom PKI validation logic. It includes support for indirect and delta CRLs, delegated OCSP responders, and configurable soft-failure modes for revocation checks. The library does not support name constraints, which is a known limitation for some advanced PKI scenarios.

Use it for:

• Validate TLS/SSL server certificates in custom HTTPS clients or proxies
• Build and verify certificate chains for PKI-based authentication systems
• Perform revocation checks against CRLs or OCSP responders in security-critical applications
• Implement point-in-time certificate validation for historical or audit purposes
• Whitelist or blacklist specific certificates or hash algorithms in custom security policies

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Validates X.509 certificates and certificate chains, supporting path building, revocation checks via CRL and OCSP, whitelisting, and point-in-time validation.

Yes, if you need fine-grained X.509 validation control beyond what the standard library offers. The library is actively maintained, has low install friction, carries no known vulnerabilities, and is licensed permissively. Install with caution if you require name constraint support or depend on cutting-edge Python versions, as the latest release predates modern Python versions in the classifier list.

Install

certvalidator on PyPI

pip install certvalidator

uv add certvalidator

poetry add certvalidator

Installing certvalidator

Before you install

Low friction: pure Python wheel with only two runtime dependencies (asn1crypto and oscrypto). Actively maintained with recent commits; last release was 3668 days ago but repository shows ongoing activity.

License in practice

MIT license permits use in commercial and proprietary projects with minimal restrictions; only requires preserving the license notice.

Quickstart

pip install certvalidator

from certvalidator import CertificateValidator
from certvalidator.context import ValidationContext

context = ValidationContext()
validator = CertificateValidator(context=context)
# validator.validate_tls(hostname, cert_chain)

Verify before relying

• Current maintenance status relative to Python 3.13+ support (classifiers list 3.14 but latest_release is 2016-07-29)
• Whether revocation checking (CRL/OCSP) works reliably with modern certificate authorities
• Performance characteristics when validating large certificate chains or under high throughput

Package facts

Evidence: certvalidator-0.11.1-py2.py3-none-any.whl

Keywords: crypto, pki, x509, certificate, crl, ocsp

Tags

More Cryptography packages