lemur certificate check_revoked - failed to verify - bunch of tracebacks

[arthurzenika]

Failed to verify
Traceback (most recent call last):
  File "/var/www/lemur/lemur/certificates/verify.py", line 107, in verify
    return ocsp_verify(cert_path, issuer_chain_path)
  File "/var/www/lemur/lemur/certificates/verify.py", line 46, in ocsp_verify
    raise Exception("Did not receive a valid response")
Exception: Did not receive a valid response

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/var/www/lemur/lemur/certificates/verify.py", line 110, in verify
    return crl_verify(cert_path)
  File "/var/www/lemur/lemur/certificates/verify.py", line 62, in crl_verify
    distribution_points = cert.extensions.get_extension_for_oid(x509.OID_CRL_DISTRIBUTION_POINTS).value
  File "/var/www/lemur/lib/python3.4/site-packages/cryptography/x509/extensions.py", line 103, in get_extension_for_oid
    raise ExtensionNotFound("No {0} extension was found".format(oid), oid)
cryptography.x509.extensions.ExtensionNotFound: No <ObjectIdentifier(oid=2.5.29.31, name=cRLDistributionPoints)> extension was found

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/var/www/lemur/lemur/certificates/cli.py", line 360, in check_revoked
    status = verify_string(cert.body, cert.chain)
  File "/var/www/lemur/lemur/certificates/verify.py", line 129, in verify_string
    status = verify(cert_tmp, issuer_tmp)
  File "/var/www/lemur/lemur/certificates/verify.py", line 112, in verify
    raise Exception("Failed to verify")
Exception: Failed to verify

I'm not entirely sure if we're missing some configuration, or a python dependency or what.

[kevgliss]

It looks like your certificate does not have a CRL in it to check, so it can't be determined if it's been revoked. Is it perhaps an internal certificate?

[arthurzenika]

Indeed. It doesn't have a CRL, maybe there could be an option to not get a traceback or is this a bug ?

[kevgliss]

We could catch the exception and issue a warning instead. I'd be happy to merge a PR covering that use case.