Skip to content

add Statement of Possession attribute support to CSRs - #15777

Open
anishbhujbal7 wants to merge 2 commits into
pyca:mainfrom
anishbhujbal7:feat/x509-statement-of-possession
Open

anishbhujbal7 wants to merge 2 commits into
pyca:mainfrom
anishbhujbal7:feat/x509-statement-of-possession

Conversation

@anishbhujbal7

@anishbhujbal7 anishbhujbal7 commented Oct 6, 2026 •

Copy link
Copy Markdown

Overview

resolves #15313

This PR adds support for the Statement of Possession attribute (1.3.6.1.5.5.7.11.2) in Certificate Signing Requests (CSRs) per RFC 4210 / RFC 2875.

Changes Made

  • src/cryptography/hazmat/_oid.py:

    • Added STATEMENT_OF_POSSESSION OID (1.3.6.1.5.5.7.11.2) under AttributeOID.
    • Registered human-readable mapping in _OID_NAMES.
  • src/cryptography/x509/:

    • Defined the Python class for the Statement of Possession attribute in base.py.
    • Exposed the public class/OID interface in __init__.py and updated __all__.
  • src/rust/src/x509/csr.rs:

    • Updated Rust CSR parsing/encoding logic to handle the STATEMENT_OF_POSSESSION attribute bytes via PyO3 bindings.
  • tests/x509/test_x509.py:

    • Added unit tests for parsing, constructing, and testing equivalence of CSRs containing the Statement of Possession attribute.

Verification

All Python formatters, linters, type checks, Rust checks, and unit tests pass cleanly:

ruff format --check .
ruff check .
python -m mypy src/cryptography/ tests/
cargo fmt --manifest-path src/rust/Cargo.toml --check
cargo clippy --manifest-path src/rust/Cargo.toml --all-targets --all-features -- -D warnings
pytest tests/x509/test_x509.py


 

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

Allow CSRs to be created for encryption-only public keys (such as ML-KEM)

1 participant