X509_check_ca

RustPython · youknowone · Oct 26, 2025 · Oct 23, 2025 · Oct 23, 2025 · Oct 23, 2025
commit 04f2b0a939010296f74ff526a54f879bdcf507a9
diff --git a/stdlib/src/ssl.rs b/stdlib/src/ssl.rs
@@ -878,8 +878,16 @@ mod _ssl {
             let certs = ctx.cert_store().all_certificates();
             #[cfg(not(ossl300))]
             let certs = ctx.cert_store().objects().iter().filter_map(|x| x.x509());
+
+            // Filter to only include CA certificates (Basic Constraints: CA=TRUE)
             let certs = certs
                 .into_iter()
+                .filter(|cert| {
+                    unsafe {
+                        // X509_check_ca() returns 1 for CA certificates
+                        X509_check_ca(cert.as_ptr()) == 1
+                    }
+                })
                 .map(|ref cert| cert_to_py(vm, cert, binary_form))
                 .collect::<Result<Vec<_>, _>>()?;
             Ok(certs)
@@ -1727,6 +1735,12 @@ mod _ssl {
     unsafe impl Sync for PySslMemoryBio {}
 
     // OpenSSL functions not in openssl-sys
+
+    unsafe extern "C" {
+        // X509_check_ca returns 1 for CA certificates, 0 otherwise
+        fn X509_check_ca(x: *const sys::X509) -> libc::c_int;
+    }
+
     unsafe extern "C" {
         fn SSL_get_ciphers(ssl: *const sys::SSL) -> *const sys::stack_st_SSL_CIPHER;
     }