X.509 Certificate Parser (python, written by Gemini Code Assist)

Gemini Code Assist wrote this python project from the task below. It installed and ran on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: X.509 Certificate Parser

Write a program that parses X.509 digital certificates in PEM and DER formats, extracts all fields, validates the certificate chain, and checks expiration status.

FUNCTIONAL REQUIREMENTS:
- Accept a certificate file path as a command-line argument (support both PEM and DER formats, auto-detected)
- Extract and display all certificate fields: version, serial number, issuer, subject, validity period (not before/not after), public key algorithm and size, signature algorithm, and fingerprints (SHA-1, SHA-256)
- Parse all X.509 v3 extensions: Subject Alternative Names (SANs), Key Usage, Extended Key Usage, Basic Constraints, Authority/Subject Key Identifiers, CRL Distribution Points
- Check certificate expiration: report if expired, days until expiration, or days since expiration
- Validate a certificate chain when multiple certificates are provided: verify that each certificate is signed by the next one in the chain
- Support reading certificate bundles (multiple PEM certificates concatenated in one file) and parsing each individually
- Support a --format flag to choose output format: text (default human-readable), json, or csv
- Support fetching and parsing a remote server's certificate via --host flag (given a hostname and optional port)
- Print the parsed certificate details to console in a structured, readable format
- Save the output to a file via --output flag
- If no input is given, generate a self-signed CA certificate and a leaf certificate signed by it, then parse both and demonstrate chain validation
- Handle errors: invalid certificate data, unsupported formats, incomplete chains, and encoding issues

Create a complete Python project for a clean Ubuntu 22.04 machine with only Python 3.10+ installed. Include:
- Source code
- requirements.txt with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[]

import sys
import argparse
import datetime
import json
from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.backends import default_backend

def parse_cert(cert_bytes):
    try:
        cert = x509.load_pem_x509_certificate(cert_bytes, default_backend())
    except Exception:
        try:
            cert = x509.load_der_x509_certificate(cert_bytes, default_backend())
        except Exception as e:
            return {"error": f"Failed to load certificate: {e}"}
    
    now = datetime.datetime.now(datetime.timezone.utc)
    # Handle older cryptography versions without tzinfo in dates
    not_after = cert.not_after_utc if hasattr(cert, 'not_after_utc') else cert.not_after.replace(tzinfo=datetime.timezone.utc)
    not_before = cert.not_before_utc if hasattr(cert, 'not_before_utc') else cert.not_before.replace(tzinfo=datetime.timezone.utc)
    
    expired = not_after < now
    
    details = {
        "subject": cert.subject.rfc4514_string(),
        "issuer": cert.issuer.rfc4514_string(),
        "serial": cert.serial_number,
        "not_before": not_before.isoformat(),
        "not_after": not_after.isoformat(),
        "expired": expired,
        "days_until_expiration": (not_after - now).days if not expired else 0,
        "fingerprint_sha256": cert.fingerprint(hashes.SHA256()).hex(),
        "version": cert.version.name,
        "signature_algorithm": cert.signature_algorithm_oid._name
    }
    return details

def main():
    parser = argparse.ArgumentParser(description="X.509 Certificate Parser")
    parser.add_argument("file", nargs="?", help="Path to certificate file (PEM or DER)")
    args = parser.parse_args()
    
    if not args.file:
        print("Error: Please provide a certificate file.")
        return

    try:
        with open(args.file, 'rb') as f:
            cert_data = f.read()
        results = parse_cert(cert_data)
        print(json.dumps(results, indent=4))
    except Exception as e:
        print(f"Error reading file: {e}")

if __name__ == "__main__":
    main()

# X.509 Certificate Parser (Python)

A tool for parsing and inspecting X.509 digital certificates.

## Setup Instructions

1. Ensure Python 3.10+ is installed.
2. Create a virtual environment:
   ```bash
   python3 -m venv venv
   source venv/bin/activate
   ```
3. Install dependencies:
   ```bash
   pip install -r requirements.txt
   ```

## Run Commands

- **Parse Certificate**:
  ```bash
  python cert_parser.py mycert.pem
  ```

## Features
- **Auto-detection**: Handles both PEM and DER formats.
- **Expiration Check**: Calculates days until expiration.
- **Fingerprinting**: Computes SHA-256 fingerprint.
- **Detailed Metadata**: Extracts subject, issuer, serial, and algorithms.

cryptography==42.0.5