---
id: certvalidator
version: "0.11.1"
license: MIT
license_treatment: permissive
maintenance: active
---

# certvalidator — Validates X.509 certificates and paths

License: permissive · Maintenance: active · Downloads: 447.0K/mo

## What it is and what it does

certvalidator is a Python library for validating X.509 certificates and certificate paths according to PKI standards. It handles the core validation logic—signature verification, name chaining, validity dates, key usage extensions, and policy constraints—plus advanced features like revocation checking through CRL and OCSP, whitelisting/blacklisting, and validation at a specific point in time. The library depends on asn1crypto for ASN.1 parsing and oscrypto for cryptographic operations.

The package is designed for developers who need to verify TLS/SSL server certificates, build and validate certificate chains, or implement custom PKI validation logic. It includes support for indirect and delta CRLs, delegated OCSP responders, and configurable soft-failure modes for revocation checks. The library does not support name constraints, which is a known limitation for some advanced PKI scenarios.

Use it for:

- Validate TLS/SSL server certificates in custom HTTPS clients or proxies
- Build and verify certificate chains for PKI-based authentication systems
- Perform revocation checks against CRLs or OCSP responders in security-critical applications
- Implement point-in-time certificate validation for historical or audit purposes
- Whitelist or blacklist specific certificates or hash algorithms in custom security policies

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Validates X.509 certificates and certificate chains, supporting path building, revocation checks via CRL and OCSP, whitelisting, and point-in-time validation.

Yes, if you need fine-grained X.509 validation control beyond what the standard library offers. The library is actively maintained, has low install friction, carries no known vulnerabilities, and is licensed permissively. Install with caution if you require name constraint support or depend on cutting-edge Python versions, as the latest release predates modern Python versions in the classifier list.

## Install

pip install certvalidator
uv add certvalidator
poetry add certvalidator

## Installing certvalidator

Before you install: Low friction: pure Python wheel with only two runtime dependencies (asn1crypto and oscrypto). Actively maintained with recent commits; last release was 3668 days ago but repository shows ongoing activity.

License in practice: MIT license permits use in commercial and proprietary projects with minimal restrictions; only requires preserving the license notice.

Quickstart:

pip install certvalidator

from certvalidator import CertificateValidator
from certvalidator.context import ValidationContext

context = ValidationContext()
validator = CertificateValidator(context=context)
# validator.validate_tls(hostname, cert_chain)

Verify before relying:

- Current maintenance status relative to Python 3.13+ support (classifiers list 3.14 but latest_release is 2016-07-29)
- Whether revocation checking (CRL/OCSP) works reliably with modern certificate authorities
- Performance characteristics when validating large certificate chains or under high throughput

## Package facts

- License: MIT (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 447.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

x.509 certificate validation, certificate chain validation, crl ocsp revocation checking, tls ssl certificate verification, pki certificate path building, certificate expiry validation, certificate signature verification, pki, tls-ssl, revocation-checking

[View on SkillFed](https://skillfed.io/packages/certvalidator) · [View on PyPI](https://pypi.org/project/certvalidator/)